fix: update _SERVICE_ACCOUNT_EMAIL_PATTERN to require .gserviceaccount.com suffix (#17748)

Addresses issue where some environments provide something that is
email-like but is NOT a service account email address when attempting to
retrieve the compute SA

Author: macastelaz

packages/google-auth/google/auth/compute_engine/_metadata.py

@@ -38,7 +38,9 @@
 
 _LOGGER = logging.getLogger(__name__)
 
-_SERVICE_ACCOUNT_EMAIL_PATTERN = re.compile(r"^[^@]+@[^@]+\.[^@]+$")
+_SERVICE_ACCOUNT_EMAIL_PATTERN = re.compile(
+    r"^[^@]+@[^@]+\.gserviceaccount\.com$", re.IGNORECASE
+)
 
 _GCE_DEFAULT_MDS_IP = "169.254.169.254"
 _GCE_DEFAULT_HOST = "metadata.google.internal"

packages/google-auth/tests/compute_engine/test__metadata.py

@@ -993,9 +993,13 @@ def test__is_service_account_email():
         _metadata._is_service_account_email("my-sa@my-project.iam.gserviceaccount.com")
         is True
     )
-    assert _metadata._is_service_account_email("test@example.com") is True
+    assert (
+        _metadata._is_service_account_email("my-sa@my-project.iam.GSERVICEACCOUNT.COM")
+        is True
+    )
 
     # Empty inputs and standard string placeholders
+    assert _metadata._is_service_account_email("test@example.com") is False
     assert _metadata._is_service_account_email("default") is False
     assert _metadata._is_service_account_email("") is False
     assert _metadata._is_service_account_email(None) is False