fix(extraction): resolve gcloud ADC HOME for non-nested mounts

[aredenba-rh]

Summary

• Fixes "Failed to start Graph Management Assistant" in stage/prod: openshell provider create ... --from-gcloud-adc ... fails with no credentials resolved for provider type 'google-vertex-ai', even though the ADC secret is correctly mounted.
• Root cause: _home_for_adc() faked HOME for the openshell CLI subprocess by walking two parent directories up from gcloud_config_mount, assuming the mount is always shaped <home>/.config/gcloud. That assumption holds for dev compose (KARTOGRAPH_GCLOUD_CONFIG_MOUNT=${HOME}/.config/gcloud), but not for stage/prod, where the Vault-sourced kartograph-extraction-runtime secret is mounted flatly at /var/secrets/gcloud (see hp-fleet-gitops apps/kartograph/base/api-deployment.yaml). The derived HOME (/var) has no .config/gcloud, so openshell's own gcloud-ADC discovery can't find the file, even though it exists at the configured mount.
• Fix: stage a scratch HOME per invocation with a symlinked .config/gcloud/application_default_credentials.json pointing at the actual mounted ADC file, so credential resolution works regardless of the mount's shape. No GitOps manifest changes needed — the prod mount/secret/env wiring is already correct.

Test plan

• Added test_home_for_adc_resolves_flat_prod_style_mount, which reproduces the exact stage/prod failure against the old code (fails before the fix, passes after)
• Added test_home_for_adc_resolves_nested_dev_style_mount and test_home_for_adc_restores_previous_home for regression coverage
• uv run pytest tests/unit/extraction/infrastructure/test_openshell_vertex_provider.py -v — 6 passed
• uv run pytest tests/unit/extraction -v — 319 passed

Made with Cursor

[coderabbitai]

📝 Walkthrough

Summary by CodeRabbit

• Bug Fixes
  • Improved handling of application credentials to reliably locate the correct gcloud ADC configuration across different mount layouts.
  • Safely stages credentials using a temporary HOME setup and restores the prior HOME value after setup completes.
• Tests
  • Added unit tests covering nested vs. flat credential mount layouts and verifying HOME restoration behavior after the credential context exits.

Walkthrough

_home_for_adc now creates a temporary HOME, builds ~/.config/gcloud, symlinks application_default_credentials.json into that path, and restores the previous HOME value in a finally block. The unit tests add helpers and cases for nested and flat mount layouts plus environment restoration. This changes the credential lookup path handling surface, including symlink use and process-environment mutation (CWE-59, CWE-367, CWE-379, CWE-668).

Estimated code review effort: 3 (Moderate) | ~20 minutes

🚥 Pre-merge checks | ✅ 5 | ❌ 6

❌ Failed checks (6 inconclusive)

Check name	Status	Explanation	Resolution
Sec-02: Secrets In Log Output	❓ Inconclusive	Repository clone failed, so this custom check could not run with code access.	Retry the review run. If this persists, inspect pre-merge custom-check logs for infrastructure or agent runtime failures.
No Hardcoded Secrets	❓ Inconclusive	Repository clone failed, so this custom check could not run with code access.	Retry the review run. If this persists, inspect pre-merge custom-check logs for infrastructure or agent runtime failures.
No Weak Cryptography	❓ Inconclusive	Repository clone failed, so this custom check could not run with code access.	Retry the review run. If this persists, inspect pre-merge custom-check logs for infrastructure or agent runtime failures.
No Injection Vectors	❓ Inconclusive	Repository clone failed, so this custom check could not run with code access.	Retry the review run. If this persists, inspect pre-merge custom-check logs for infrastructure or agent runtime failures.
No Privileged Containers	❓ Inconclusive	Repository clone failed, so this custom check could not run with code access.	Retry the review run. If this persists, inspect pre-merge custom-check logs for infrastructure or agent runtime failures.
No Pii Or Sensitive Data In Logs	❓ Inconclusive	Repository clone failed, so this custom check could not run with code access.	Retry the review run. If this persists, inspect pre-merge custom-check logs for infrastructure or agent runtime failures.

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly matches the main change: fixing gcloud ADC HOME handling for non-nested mounts.
Description check	✅ Passed	The description is directly about the same ADC HOME fix, its root cause, and the added regression tests.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/openshell-vertex-adc-home-prod-mount

✨ Simplify code

• Create PR with simplified code
• Commit simplified code in branch fix/openshell-vertex-adc-home-prod-mount

Warning

Review ran into problems

🔥 Problems

Repository analysis: Couldn't refresh openshift-hyperfleet/kartograph clone - clone failed: Clone operation failed: Stream initialization permanently failed: 13 INTERNAL: Received RST_STREAM with code 2 (Internal server error)

---

Git: Failed to clone repository. Please run the @coderabbitai full review command to re-trigger a full review. If the issue persists, set path_filters to include or exclude specific files.

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (1)

src/api/tests/unit/extraction/infrastructure/test_openshell_vertex_provider.py (1)

95-140: 🩺 Stability & Availability | 🔵 Trivial | ⚖️ Poor tradeoff

No test covers the concurrent-call HOME race.

Given _home_for_adc mutates global os.environ["HOME"], add a test that runs two overlapping _home_for_adc contexts (e.g. via threads) and asserts each sees its own scratch ADC path — this would have caught the CWE-362 issue flagged in vertex_provider.py.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In
`@src/api/tests/unit/extraction/infrastructure/test_openshell_vertex_provider.py`
around lines 95 - 140, Add a regression test for the concurrent HOME mutation
race in _home_for_adc. Create two overlapping _home_for_adc contexts (preferably
with threads or another controlled concurrency helper) using different scratch
gcloud_config_mount paths, and assert each context resolves
_adc_lookup_path_from_home to its own application_default_credentials.json. Keep
the test focused on the global os.environ["HOME"] isolation behavior and use the
existing _home_for_adc and _adc_lookup_path_from_home helpers to locate the
code.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In
`@src/api/tests/unit/extraction/infrastructure/test_openshell_vertex_provider.py`:
- Around line 95-140: Add a regression test for the concurrent HOME mutation
race in _home_for_adc. Create two overlapping _home_for_adc contexts (preferably
with threads or another controlled concurrency helper) using different scratch
gcloud_config_mount paths, and assert each context resolves
_adc_lookup_path_from_home to its own application_default_credentials.json. Keep
the test focused on the global os.environ["HOME"] isolation behavior and use the
existing _home_for_adc and _adc_lookup_path_from_home helpers to locate the
code.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Central YAML (base), Organization UI (inherited)

Review profile: CHILL

Plan: Enterprise

Run ID: 28e0d947-86ea-416c-a38f-5049951c6825

📥 Commits

Reviewing files that changed from the base of the PR and between 43f0bbb and e80c08b.

📒 Files selected for processing (2)

• src/api/extraction/infrastructure/openshell/vertex_provider.py
• src/api/tests/unit/extraction/infrastructure/test_openshell_vertex_provider.py

🔗 Linked repositories identified

CodeRabbit considers these linked repositories for cross-repo context during reviews:

• openshift-hyperfleet/architecture (manual)
• openshift-hyperfleet/hyperfleet-api (manual)
• openshift-hyperfleet/hyperfleet-sentinel (manual)
• openshift-hyperfleet/hyperfleet-adapter (manual)
• openshift-hyperfleet/hyperfleet-broker (manual)