chore(librarian): clean up owlbot files and pin image sha (#861)

Additional clean up following
#856

---------

Co-authored-by: ohmayr <omairn@google.com>
Co-authored-by: Victor Chudnovsky <vchudnov@google.com>

Author: 3 people

.github/auto-approve.yml

@@ -1,4 +1,4 @@
-image: us-central1-docker.pkg.dev/cloud-sdk-librarian-prod/images-prod/python-librarian-generator:latest
+image: us-central1-docker.pkg.dev/cloud-sdk-librarian-prod/images-prod/python-librarian-generator@sha256:c8612d3fffb3f6a32353b2d1abd16b61e87811866f7ec9d65b59b02eb452a620
 libraries:
   - id: google-api-core
     version: 2.28.1

.librarian/config.yaml

@@ -91,6 +91,8 @@ ignore_missing_imports = true
 filterwarnings = [
   # treat all warnings as errors
   "error",
+  # Prevent Python version warnings from interfering with tests
+  "ignore:.* Python version .*:FutureWarning",
   # Remove once https://github.com/pytest-dev/pytest-cov/issues/621 is fixed
   "ignore:.*The --rsyncdir command line argument and rsyncdirs config variable are deprecated:DeprecationWarning",
   # Remove once https://github.com/protocolbuffers/protobuf/issues/12186 is fixed

.librarian/state.yaml

@@ -260,7 +260,7 @@ async def test_wrap_method_with_overriding_timeout_as_a_number():
     actual_timeout = method.call_args[1]["timeout"]
     metadata = method.call_args[1]["metadata"]
     assert metadata == mock.ANY
-    assert actual_timeout == pytest.approx(22, abs=0.01)
+    assert actual_timeout == pytest.approx(22, abs=0.05)
 
 
 @pytest.mark.asyncio

owlbot.py

@@ -17,6 +17,7 @@
     from unittest.mock import AsyncMock  # pragma: NO COVER  # noqa: F401
 except ImportError:  # pragma: NO COVER
     import mock  # type: ignore
+from ..helpers import warn_deprecated_credentials_file
 import pytest  # noqa: I202
 
 try:
@@ -522,11 +523,12 @@ def test_create_channel_explicit_with_duplicate_credentials():
     target = "example:443"
 
     with pytest.raises(exceptions.DuplicateCredentialArgs) as excinfo:
-        grpc_helpers_async.create_channel(
-            target,
-            credentials_file="credentials.json",
-            credentials=mock.sentinel.credentials,
-        )
+        with warn_deprecated_credentials_file():
+            grpc_helpers_async.create_channel(
+                target,
+                credentials_file="credentials.json",
+                credentials=mock.sentinel.credentials,
+            )
 
     assert "mutually exclusive" in str(excinfo.value)
 
@@ -641,9 +643,10 @@ def test_create_channel_with_credentials_file(
     credentials_file = "/path/to/credentials/file.json"
     composite_creds = composite_creds_call.return_value
 
-    channel = grpc_helpers_async.create_channel(
-        target, credentials_file=credentials_file
-    )
+    with warn_deprecated_credentials_file():
+        channel = grpc_helpers_async.create_channel(
+            target, credentials_file=credentials_file
+        )
 
     google.auth.load_credentials_from_file.assert_called_once_with(
         credentials_file, scopes=None, default_scopes=None
@@ -670,9 +673,10 @@ def test_create_channel_with_credentials_file_and_scopes(
     credentials_file = "/path/to/credentials/file.json"
     composite_creds = composite_creds_call.return_value
 
-    channel = grpc_helpers_async.create_channel(
-        target, credentials_file=credentials_file, scopes=scopes
-    )
+    with warn_deprecated_credentials_file():
+        channel = grpc_helpers_async.create_channel(
+            target, credentials_file=credentials_file, scopes=scopes
+        )
 
     google.auth.load_credentials_from_file.assert_called_once_with(
         credentials_file, scopes=scopes, default_scopes=None
@@ -699,9 +703,10 @@ def test_create_channel_with_credentials_file_and_default_scopes(
     credentials_file = "/path/to/credentials/file.json"
     composite_creds = composite_creds_call.return_value
 
-    channel = grpc_helpers_async.create_channel(
-        target, credentials_file=credentials_file, default_scopes=default_scopes
-    )
+    with warn_deprecated_credentials_file():
+        channel = grpc_helpers_async.create_channel(
+            target, credentials_file=credentials_file, default_scopes=default_scopes
+        )
 
     google.auth.load_credentials_from_file.assert_called_once_with(
         credentials_file, scopes=None, default_scopes=default_scopes

pyproject.toml

@@ -14,7 +14,9 @@
 
 """Helpers for tests"""
 
+import functools
 import logging
+import pytest  # noqa: I202
 from typing import List
 
 import proto
@@ -69,3 +71,12 @@ def parse_responses(response_message_cls, all_responses: List[proto.Message]) ->
     logging.info(f"Sending JSON stream: {json_responses}")
     ret_val = "[{}]".format(",".join(json_responses))
     return bytes(ret_val, "utf-8")
+
+
+warn_deprecated_credentials_file = functools.partial(
+    # This is used to test that the auth credentials file deprecation
+    # warning is emitted as expected.
+    pytest.warns,
+    DeprecationWarning,
+    match="argument is deprecated because of a potential security risk",
+)

tests/asyncio/gapic/test_method_async.py

@@ -23,6 +23,7 @@
 
 import pytest
 from typing import Any, List
+from ...helpers import warn_deprecated_credentials_file
 
 try:
     import grpc  # noqa: F401
@@ -369,7 +370,8 @@ def test_operations_client_client_options(
         )
 
     # Check the case credentials_file is provided
-    options = client_options.ClientOptions(credentials_file="credentials.json")
+    with warn_deprecated_credentials_file():
+        options = client_options.ClientOptions(credentials_file="credentials.json")
     with mock.patch.object(transport_class, "__init__") as patched:
         patched.return_value = None
         client = client_class(client_options=options, transport=transport_name)
@@ -539,11 +541,14 @@ def test_operations_client_client_options_credentials_file(
     client_class, transport_class, transport_name
 ):
     # Check the case credentials file is provided.
-    options = client_options.ClientOptions(credentials_file="credentials.json")
+    with warn_deprecated_credentials_file():
+        options = client_options.ClientOptions(credentials_file="credentials.json")
     if "async" in str(client_class):
         # TODO(): Add support for credentials file to async REST transport.
         with pytest.raises(core_exceptions.AsyncRestUnsupportedParameterError):
-            client_class(client_options=options, transport=transport_name)
+            with warn_deprecated_credentials_file():
+
+                client_class(client_options=options, transport=transport_name)
     else:
         with mock.patch.object(transport_class, "__init__") as patched:
             patched.return_value = None
@@ -570,10 +575,18 @@ def test_operations_client_client_options_credentials_file(
     return_value=(mock.sentinel.credentials, mock.sentinel.project),
 )
 def test_list_operations_rest(google_auth_default, credentials_file):
-    sync_transport = transports.rest.OperationsRestTransport(
-        credentials_file=credentials_file,
-        http_options=HTTP_OPTIONS,
-    )
+    if credentials_file:
+        with warn_deprecated_credentials_file():
+            sync_transport = transports.rest.OperationsRestTransport(
+                credentials_file=credentials_file,
+                http_options=HTTP_OPTIONS,
+            )
+    else:
+        # no warning expected
+        sync_transport = transports.rest.OperationsRestTransport(
+            credentials_file=credentials_file,
+            http_options=HTTP_OPTIONS,
+        )
 
     client = AbstractOperationsClient(transport=sync_transport)
 
@@ -1130,10 +1143,11 @@ def test_transport_adc(client_class, transport_class, credentials):
 def test_operations_base_transport_error():
     # Passing both a credentials object and credentials_file should raise an error
     with pytest.raises(core_exceptions.DuplicateCredentialArgs):
-        transports.OperationsTransport(
-            credentials=ga_credentials.AnonymousCredentials(),
-            credentials_file="credentials.json",
-        )
+        with warn_deprecated_credentials_file():
+            transports.OperationsTransport(
+                credentials=ga_credentials.AnonymousCredentials(),
+                credentials_file="credentials.json",
+            )
 
 
 def test_operations_base_transport():
@@ -1171,10 +1185,11 @@ def test_operations_base_transport_with_credentials_file():
     ) as Transport:
         Transport.return_value = None
         load_creds.return_value = (ga_credentials.AnonymousCredentials(), None)
-        transports.OperationsTransport(
-            credentials_file="credentials.json",
-            quota_project_id="octopus",
-        )
+        with warn_deprecated_credentials_file():
+            transports.OperationsTransport(
+                credentials_file="credentials.json",
+                quota_project_id="octopus",
+            )
         load_creds.assert_called_once_with(
             "credentials.json",
             scopes=None,

tests/asyncio/test_grpc_helpers_async.py

@@ -14,6 +14,7 @@
 
 from re import match
 import pytest
+from ..helpers import warn_deprecated_credentials_file
 
 from google.api_core import client_options
 
@@ -27,19 +28,19 @@ def get_client_encrypted_cert():
 
 
 def test_constructor():
-
-    options = client_options.ClientOptions(
-        api_endpoint="foo.googleapis.com",
-        client_cert_source=get_client_cert,
-        quota_project_id="quote-proj",
-        credentials_file="path/to/credentials.json",
-        scopes=[
-            "https://www.googleapis.com/auth/cloud-platform",
-            "https://www.googleapis.com/auth/cloud-platform.read-only",
-        ],
-        api_audience="foo2.googleapis.com",
-        universe_domain="googleapis.com",
-    )
+    with warn_deprecated_credentials_file():
+        options = client_options.ClientOptions(
+            api_endpoint="foo.googleapis.com",
+            client_cert_source=get_client_cert,
+            quota_project_id="quote-proj",
+            credentials_file="path/to/credentials.json",
+            scopes=[
+                "https://www.googleapis.com/auth/cloud-platform",
+                "https://www.googleapis.com/auth/cloud-platform.read-only",
+            ],
+            api_audience="foo2.googleapis.com",
+            universe_domain="googleapis.com",
+        )
 
     assert options.api_endpoint == "foo.googleapis.com"
     assert options.client_cert_source() == (b"cert", b"key")
@@ -102,10 +103,11 @@ def test_constructor_with_api_key():
 
 def test_constructor_with_both_api_key_and_credentials_file():
     with pytest.raises(ValueError):
-        client_options.ClientOptions(
-            api_key="api-key",
-            credentials_file="path/to/credentials.json",
-        )
+        with warn_deprecated_credentials_file():
+            client_options.ClientOptions(
+                api_key="api-key",
+                credentials_file="path/to/credentials.json",
+            )
 
 
 def test_from_dict():