Tesla2000
diff --git a/‎.gitignore‎
Lines changed: 0 additions & 3 deletions b/‎.gitignore‎
Lines changed: 0 additions & 3 deletions
diff --git a/‎.kokoro/system.sh‎
Lines changed: 3 additions & 20 deletions b/‎.kokoro/system.sh‎
Lines changed: 3 additions & 20 deletions
diff --git a/‎packages/google-auth/noxfile.py‎
Lines changed: 31 additions & 0 deletions b/‎packages/google-auth/noxfile.py‎
Lines changed: 31 additions & 0 deletions
diff --git a/‎packages/google-auth/system_tests/secrets.tar.enc‎
-10.1 KB b/‎packages/google-auth/system_tests/secrets.tar.enc‎
-10.1 KB
diff --git a/‎packages/google-auth/system_tests/system_tests_sync/.gitignore‎
Lines changed: 0 additions & 2 deletions b/‎packages/google-auth/system_tests/system_tests_sync/.gitignore‎
Lines changed: 0 additions & 2 deletions
diff --git a/‎packages/google-auth/system_tests/system_tests_sync/secrets.tar.enc‎
-10.1 KB b/‎packages/google-auth/system_tests/system_tests_sync/secrets.tar.enc‎
-10.1 KB
@@ -65,6 +65,3 @@ pylintrc.test
 
 # Ruff cache
 .ruff_cache
-
-# google-auth system test credentials
-system_tests/data
@@ -55,35 +55,18 @@ run_package_test() {
       GOOGLE_APPLICATION_CREDENTIALS="${KOKORO_GFILE_DIR}/google-auth-service-account.json"
       NOX_FILE="system_tests/noxfile.py"
       NOX_SESSION=""
-
-      # Activate gcloud for this specific package
-      gcloud auth activate-service-account --key-file="$GOOGLE_APPLICATION_CREDENTIALS"
-      gcloud config set project "$PROJECT_ID"
-
-      # Decrypt secrets
-      gcloud kms decrypt \
-        --location=global --keyring=ci --key=kokoro-secrets \
-        --ciphertext-file="${package_path}/system_tests/secrets.tar.enc" \
-        --plaintext-file="${package_path}/system_tests/secrets.tar"
-      mkdir -p "${package_path}/system_tests/data"
-      # Extract from the package root.
-      # The tar already contains the 'system_tests/data/' path.
-      tar xvf "${package_path}/system_tests/secrets.tar" -C "${package_path}/"
-
-      rm "${package_path}/system_tests/secrets.tar"
       ;;
     *)
       PROJECT_ID=$(cat "${KOKORO_GFILE_DIR}/project-id.json")
       GOOGLE_APPLICATION_CREDENTIALS="${KOKORO_GFILE_DIR}/service-account.json"
       NOX_FILE="noxfile.py"
       NOX_SESSION="system-3.12"
-
-      # Activate gcloud for this specific package
-      gcloud auth activate-service-account --key-file="$GOOGLE_APPLICATION_CREDENTIALS"
-      gcloud config set project "$PROJECT_ID"
       ;;
   esac
 
+  gcloud auth activate-service-account --key-file="$GOOGLE_APPLICATION_CREDENTIALS"
+  gcloud config set project "$PROJECT_ID"
+
   # Export variables for the duration of this function's sub-processes
   export PROJECT_ID GOOGLE_APPLICATION_CREDENTIALS NOX_FILE NOX_SESSION
 
 
@@ -15,6 +15,7 @@
 import os
 import pathlib
 import shutil
+import subprocess
 
 import nox
 
@@ -57,6 +58,36 @@
 ]
 
 
+def _provision_kokoro_secrets():
+    """Downloads CI secrets directly from GCS and formats them for the tests."""
+    if not os.environ.get("KOKORO_GFILE_DIR"):
+        return
+
+    dest_dir = pathlib.Path(__file__).parent / "data"
+    dest_dir.mkdir(parents=True, exist_ok=True)
+
+    # Map GCS filenames to the local filenames expected by tests
+    secrets_map = {
+        "google-auth-service-account.json": "service_account.json",
+        "google-auth-authorized-user.json": "authorized_user.json",
+        "google-auth-impersonated-service-account.json": "impersonated_service_account.json",
+    }
+
+    gcs_base = "gs://cloud-devrel-kokoro-resources/google-cloud-python"
+
+    for src_name, dest_name in secrets_map.items():
+        subprocess.run(
+            ["google", "storage", "cp", f"{gcs_base}/{src_name}", str(dest_dir)],
+            check=True,
+            capture_output=True,
+        )
+        # Rename to use underscores as per test conventions
+        (dest_dir / src_name).replace(dest_dir / dest_name)
+
+
+_provision_kokoro_secrets()
+
+
 @nox.session(python=DEFAULT_PYTHON_VERSION)
 def lint(session):
     session.install(