ci(spanner): use airlock for presubmit jobs

.kokoro/build.sh

@@ -46,6 +46,23 @@ if [[ $KOKORO_BUILD_ARTIFACTS_SUBDIR = *"continuous"* ]]; then
   trap cleanup EXIT HUP
 fi
 
+set -x
+if [[ $USE_AIRLOCK = 'true' ]]; then
+cat > $HOME/.pypirc <<EOL
+[distutils]
+index-servers =
+    python-3p-trusted
+
+[python-3p-trusted]
+repository = https://us-python.pkg.dev/artifact-foundry-prod/python-3p-trusted/
+EOL
+  mkdir -p $HOME/.config/pip
+  cat > $HOME/.config/pip/pip.conf <<EOL
+[global]
+index-url = https://us-python.pkg.dev/artifact-foundry-prod/python-3p-trusted/simple/
+EOL
+fi
+
 # If NOX_SESSION is set, it only runs the specified session,
 # otherwise run all the sessions.
 if [[ -n "${NOX_SESSION:-}" ]]; then

.kokoro/presubmit/system-3.8.cfg

@@ -4,4 +4,9 @@
 env_vars: {
     key: "NOX_SESSION"
     value: "system-3.8"
+}
+
+env_vars: {
+   key: "USE_AIRLOCK"
+   value: "true"
 }

noxfile.py

@@ -85,12 +85,17 @@
     "format",
 ]
 
+
 # Error if a python version is missing
 nox.options.error_on_missing_interpreters = True
 
+def install_default_packages(session):
+    if os.environ.get("USE_AIRLOCK") == "true":
+        session.install("-r", ".kokoro/requirements-auth.txt", "-i", "https://pypi.org/simple/", "--require-hashes", "--only-binary", ":all:")
 
 @nox.session(python=DEFAULT_PYTHON_VERSION)
 def lint(session):
+    install_default_packages(session)
     """Run linters.
 
     Returns a failure if the linters find linting errors or sufficiently
@@ -107,6 +112,7 @@ def lint(session):
 
 @nox.session(python=DEFAULT_PYTHON_VERSION)
 def blacken(session):
+    install_default_packages(session)
     """Run black. Format code to uniform standard."""
     session.install(BLACK_VERSION)
     session.run(
@@ -117,6 +123,7 @@ def blacken(session):
 
 @nox.session(python=DEFAULT_PYTHON_VERSION)
 def format(session):
+    install_default_packages(session)
     """
     Run isort to sort imports. Then run black
     to format code to uniform standard.
@@ -137,12 +144,15 @@ def format(session):
 
 @nox.session(python=DEFAULT_PYTHON_VERSION)
 def lint_setup_py(session):
+    install_default_packages(session)
     """Verify that setup.py is valid (including RST check)."""
     session.install("docutils", "pygments")
     session.run("python", "setup.py", "check", "--restructuredtext", "--strict")
 
 
 def install_unittest_dependencies(session, *constraints):
+    install_default_packages(session)
+
     standard_deps = UNIT_TEST_STANDARD_DEPENDENCIES + UNIT_TEST_DEPENDENCIES
     session.install(*standard_deps, *constraints)
 
@@ -238,6 +248,7 @@ def unit(session, protobuf_implementation):
 @nox.session(python=DEFAULT_MOCK_SERVER_TESTS_PYTHON_VERSION)
 def mockserver(session):
     # Install all test dependencies, then install this package in-place.
+    install_default_packages(session)
 
     constraints_path = str(
         CURRENT_DIRECTORY / "testing" / f"constraints-{session.python}.txt"
@@ -267,6 +278,7 @@ def install_systemtest_dependencies(session, *constraints):
     # Use pre-release gRPC for system tests.
     # Exclude version 1.52.0rc1 which has a known issue.
     # See https://github.com/grpc/grpc/issues/32163
+    install_default_packages(session)
     session.install("--pre", "grpcio!=1.52.0rc1")
 
     session.install(*SYSTEM_TEST_STANDARD_DEPENDENCIES, *constraints)
@@ -292,7 +304,6 @@ def install_systemtest_dependencies(session, *constraints):
     else:
         session.install("-e", ".", *constraints)
 
-
 @nox.session(python=SYSTEM_TEST_PYTHON_VERSIONS)
 @nox.parametrize("database_dialect", ["GOOGLE_STANDARD_SQL", "POSTGRESQL"])
 def system(session, database_dialect):
@@ -363,6 +374,7 @@ def cover(session):
     This outputs the coverage report aggregating coverage from the unit
     test runs (not system test runs), and then erases coverage data.
     """
+    install_default_packages(session)
     session.install("coverage", "pytest-cov")
     session.run("coverage", "report", "--show-missing", "--fail-under=98")
 
@@ -372,7 +384,7 @@ def cover(session):
 @nox.session(python="3.10")
 def docs(session):
     """Build the docs for this library."""
-
+    install_default_packages(session)
     session.install("-e", ".[tracing]")
     session.install(
         # We need to pin to specific versions of the `sphinxcontrib-*` packages
@@ -407,7 +419,7 @@ def docs(session):
 @nox.session(python="3.10")
 def docfx(session):
     """Build the docfx yaml files for this library."""
-
+    install_default_packages(session)
     session.install("-e", ".[tracing]")
     session.install(
         # We need to pin to specific versions of the `sphinxcontrib-*` packages
@@ -469,6 +481,7 @@ def prerelease_deps(session, protobuf_implementation, database_dialect):
         session.skip("cpp implementation is not supported in python 3.11+")
 
     # Install all dependencies
+    install_default_packages(session)
     session.install("-e", ".[all, tests, tracing]")
     unit_deps_all = UNIT_TEST_STANDARD_DEPENDENCIES + UNIT_TEST_EXTERNAL_DEPENDENCIES
     session.install(*unit_deps_all)

requirements.in

@@ -0,0 +1,14 @@
+backports.tarfile==1.2.0
+build==1.2.2.post1
+click==8.1.8
+importlib_metadata==8.5.0
+importlib_resources==6.4.5
+jaraco.classes==3.4.0
+jaraco.context==6.0.1
+jaraco.functools==4.1.0
+keyring==25.5.0
+more-itertools==10.5.0
+packaging==24.2
+pip-tools==7.4.1
+pyproject_hooks==1.2.0
+zipp==3.21.0

requirements.txt

@@ -0,0 +1,96 @@
+#
+# This file is autogenerated by pip-compile with Python 3.11
+# by the following command:
+#
+#    pip-compile --generate-hashes requirements.in
+#
+backports-tarfile==1.2.0 \
+    --hash=sha256:77e284d754527b01fb1e6fa8a1afe577858ebe4e9dad8919e34c862cb399bc34 \
+    --hash=sha256:d75e02c268746e1b8144c278978b6e98e85de6ad16f8e4b0844a154557eca991
+    # via
+    #   -r requirements.in
+    #   jaraco-context
+build==1.2.2.post1 \
+    --hash=sha256:1d61c0887fa860c01971625baae8bdd338e517b836a2f70dd1f7aa3a6b2fc5b5 \
+    --hash=sha256:b36993e92ca9375a219c99e606a122ff365a760a2d4bba0caa09bd5278b608b7
+    # via
+    #   -r requirements.in
+    #   pip-tools
+click==8.1.8 \
+    --hash=sha256:63c132bbbed01578a06712a2d1f497bb62d9c1c0d329b7903a866228027263b2 \
+    --hash=sha256:ed53c9d8990d83c2a27deae68e4ee337473f6330c040a31d4225c9574d16096a
+    # via
+    #   -r requirements.in
+    #   pip-tools
+importlib-metadata==8.5.0 \
+    --hash=sha256:45e54197d28b7a7f1559e60b95e7c567032b602131fbd588f1497f47880aa68b \
+    --hash=sha256:71522656f0abace1d072b9e5481a48f07c138e00f079c38c8f883823f9c26bd7
+    # via
+    #   -r requirements.in
+    #   keyring
+importlib-resources==6.4.5 \
+    --hash=sha256:980862a1d16c9e147a59603677fa2aa5fd82b87f223b6cb870695bcfce830065 \
+    --hash=sha256:ac29d5f956f01d5e4bb63102a5a19957f1b9175e45649977264a1416783bb717
+    # via -r requirements.in
+jaraco-classes==3.4.0 \
+    --hash=sha256:47a024b51d0239c0dd8c8540c6c7f484be3b8fcf0b2d85c13825780d3b3f3acd \
+    --hash=sha256:f662826b6bed8cace05e7ff873ce0f9283b5c924470fe664fff1c2f00f581790
+    # via
+    #   -r requirements.in
+    #   keyring
+jaraco-context==6.0.1 \
+    --hash=sha256:9bae4ea555cf0b14938dc0aee7c9f32ed303aa20a3b73e7dc80111628792d1b3 \
+    --hash=sha256:f797fc481b490edb305122c9181830a3a5b76d84ef6d1aef2fb9b47ab956f9e4
+    # via
+    #   -r requirements.in
+    #   keyring
+jaraco-functools==4.1.0 \
+    --hash=sha256:70f7e0e2ae076498e212562325e805204fc092d7b4c17e0e86c959e249701a9d \
+    --hash=sha256:ad159f13428bc4acbf5541ad6dec511f91573b90fba04df61dafa2a1231cf649
+    # via
+    #   -r requirements.in
+    #   keyring
+keyring==25.5.0 \
+    --hash=sha256:4c753b3ec91717fe713c4edd522d625889d8973a349b0e582622f49766de58e6 \
+    --hash=sha256:e67f8ac32b04be4714b42fe84ce7dad9c40985b9ca827c592cc303e7c26d9741
+    # via -r requirements.in
+more-itertools==10.5.0 \
+    --hash=sha256:037b0d3203ce90cca8ab1defbbdac29d5f993fc20131f3664dc8d6acfa872aef \
+    --hash=sha256:5482bfef7849c25dc3c6dd53a6173ae4795da2a41a80faea6700d9f5846c5da6
+    # via
+    #   -r requirements.in
+    #   jaraco-classes
+    #   jaraco-functools
+packaging==24.2 \
+    --hash=sha256:09abb1bccd265c01f4a3aa3f7a7db064b36514d2cba19a2f694fe6150451a759 \
+    --hash=sha256:c228a6dc5e932d346bc5739379109d49e8853dd8223571c7c5b55260edc0b97f
+    # via
+    #   -r requirements.in
+    #   build
+pip-tools==7.4.1 \
+    --hash=sha256:4c690e5fbae2f21e87843e89c26191f0d9454f362d8acdbd695716493ec8b3a9 \
+    --hash=sha256:864826f5073864450e24dbeeb85ce3920cdfb09848a3d69ebf537b521f14bcc9
+    # via -r requirements.in
+pyproject-hooks==1.2.0 \
+    --hash=sha256:1e859bd5c40fae9448642dd871adf459e5e2084186e8d2c2a79a824c970da1f8 \
+    --hash=sha256:9e5c6bfa8dcc30091c74b0cf803c81fdd29d94f01992a7707bc97babb1141913
+    # via
+    #   -r requirements.in
+    #   build
+    #   pip-tools
+wheel==0.45.1 \
+    --hash=sha256:661e1abd9198507b1409a20c02106d9670b2576e916d58f520316666abca6729 \
+    --hash=sha256:708e7481cc80179af0e556bbf0cc00b8444c7321e2700b8d8580231d13017248
+    # via pip-tools
+zipp==3.21.0 \
+    --hash=sha256:2c9958f6430a2040341a52eb608ed6dd93ef4392e02ffe219417c1b28b5dd1f4 \
+    --hash=sha256:ac1bbe05fd2991f160ebce24ffbac5f6d11d83dc90891255885223d42b3cd931
+    # via
+    #   -r requirements.in
+    #   importlib-metadata
+
+# WARNING: The following packages were not pinned, but pip requires them to be
+# pinned when the requirements file includes hashes and the requirement is not
+# satisfied by a package already installed. Consider using the --allow-unsafe flag.
+# pip
+# setuptools

spanner/pyvenv.cfg

@@ -0,0 +1,5 @@
+home = /Library/Frameworks/Python.framework/Versions/3.11/bin
+include-system-site-packages = false
+version = 3.11.6
+executable = /Library/Frameworks/Python.framework/Versions/3.11/bin/python3.11
+command = /usr/local/bin/python3 -m venv /Users/sakthivelmani/Repos/googleapis/python-spanner/spanner