ci(google-auth): separate core vs extras lower-bound constraints

Author: ohmayr

packages/google-auth/noxfile.py

@@ -159,27 +159,37 @@ def mypy(session):
 
 
 @nox.session(python=ALL_PYTHON)
-@nox.parametrize(["install_deprecated_extras"], (True, False))
-def unit(session, install_deprecated_extras):
+@nox.parametrize(["install_extras"], (True, False))
+def unit(session, install_extras):
     # Install all test dependencies, then install this package in-place.
 
     min_py, max_py = UNIT_TEST_PYTHON_VERSIONS[0], UNIT_TEST_PYTHON_VERSIONS[-1]
-    if not install_deprecated_extras and session.python not in (min_py, max_py):
+    if not install_extras and session.python not in (min_py, max_py):
         # only run double tests on first and last supported versions
         session.skip(
             f"Extended tests only run on boundary Python versions ({min_py}, {max_py}) to reduce CI load."
         )
 
-    constraints_path = str(
+    core_constraints = (
         CURRENT_DIRECTORY / "testing" / f"constraints-{session.python}.txt"
     )
-    extras_str = "testing"
-    if install_deprecated_extras:
-        # rsa and oauth2client were both archived and support dropped,
-        # but we still  test old code paths
+    extras_constraints = (
+        CURRENT_DIRECTORY / "testing" / f"constraints-extras-{session.python}.txt"
+    )
+
+    install_args = ["-e"]
+    if install_extras:
         session.install("oauth2client")
-        extras_str += ",rsa"
-    session.install("-e", f".[{extras_str}]", "-c", constraints_path)
+        install_args.append(".[testing,enterprise_cert,rsa]")
+    else:
+        install_args.append(".[testing]")
+
+    if core_constraints.exists():
+        install_args.extend(["-c", str(core_constraints)])
+    if install_extras and extras_constraints.exists():
+        install_args.extend(["-c", str(extras_constraints)])
+
+    session.install(*install_args)
     session.run(
         "pytest",
         f"--junitxml=unit_{session.python}_sponge_log.xml",

packages/google-auth/setup.py

@@ -56,18 +56,23 @@
 
 # Unit test requirements.
 testing_extra_require = [
+    # gRPC extra
     *grpc_extra_require,
+    # PyJWT extra
+    *pyjwt_extra_require,
+    # Reauth extra
+    *reauth_extra_require,
+    # urllib3 extra
+    *urllib3_extra_require,
+    # aiohttp extra
+    *aiohttp_extra_require,
+    # Test runners & mocks
     "flask",
     "freezegun",
-    *pyjwt_extra_require,
     "pytest",
     "pytest-cov",
     "pytest-localserver",
-    *reauth_extra_require,
     "responses",
-    *urllib3_extra_require,
-    # Async Dependencies
-    *aiohttp_extra_require,
     "aioresponses",
     "pytest-asyncio",
 ]

packages/google-auth/testing/constraints-3.11.txt

@@ -1 +1,3 @@
-urllib3>2.0.0
+# Lower-bound constraints for Python 3.11 core dependencies.
+pyasn1-modules==0.2.1
+cryptography==38.0.3

packages/google-auth/testing/constraints-3.12.txt

@@ -1 +1,3 @@
-urllib3>2.0.0
+# Lower-bound constraints for Python 3.12 core dependencies.
+pyasn1-modules==0.2.1
+cryptography==38.0.3

packages/google-auth/testing/constraints-3.13.txt

@@ -0,0 +1,3 @@
+# Lower-bound constraints for Python 3.13 core dependencies.
+pyasn1-modules==0.2.1
+cryptography==38.0.3

packages/google-auth/testing/constraints-extras-3.10.txt

@@ -0,0 +1,10 @@
+# Lower-bound constraints for Python 3.10 optional extras & test dependencies.
+aiohttp==3.8.0
+requests==2.30.0
+pyjwt==2.0
+grpcio==1.59.0
+urllib3==1.26.15
+packaging==20.0
+pyu2f==0.1.5
+rsa==4.0.0
+oauth2client==4.1.3

packages/google-auth/testing/constraints-extras-3.14.txt

@@ -0,0 +1,10 @@
+# Lower-bound constraints for Python 3.14 optional extras & test dependencies.
+aiohttp==3.9.0
+requests==2.30.0
+pyjwt==2.0
+grpcio==1.75.1
+urllib3==2.0.0
+packaging==20.0
+pyu2f==0.1.5
+rsa==4.0.0
+oauth2client==4.1.3