This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new 49c1e07e3f7 Honor impersonation_chain in deferred Cloud Build tasks
(#71644)
49c1e07e3f7 is described below
commit 49c1e07e3f7613c492aae166629edde78cd2cb15
Author: Sepuri Sai Krishna <[email protected]>
AuthorDate: Thu Aug 27 16:48:06 2026 +0530
Honor impersonation_chain in deferred Cloud Build tasks (#71644)
The trigger accepted, stored and serialized the impersonation chain but
built
its hook without it, so a task that deferred authenticated as the
connection's
service account instead of the impersonated one. The synchronous path was
unaffected, which made the divergence hard to spot.
---
.../providers/google/cloud/triggers/cloud_build.py | 5 ++++-
.../unit/google/cloud/triggers/test_cloud_build.py | 19 +++++++++++++++++++
2 files changed, 23 insertions(+), 1 deletion(-)
diff --git
a/providers/google/src/airflow/providers/google/cloud/triggers/cloud_build.py
b/providers/google/src/airflow/providers/google/cloud/triggers/cloud_build.py
index f97a3db33e2..d36ad06db53 100644
---
a/providers/google/src/airflow/providers/google/cloud/triggers/cloud_build.py
+++
b/providers/google/src/airflow/providers/google/cloud/triggers/cloud_build.py
@@ -125,4 +125,7 @@ class CloudBuildCreateBuildTrigger(BaseTrigger):
yield TriggerEvent({"status": "error", "message": str(e)})
def _get_async_hook(self) -> CloudBuildAsyncHook:
- return CloudBuildAsyncHook(gcp_conn_id=self.gcp_conn_id)
+ return CloudBuildAsyncHook(
+ gcp_conn_id=self.gcp_conn_id,
+ impersonation_chain=self.impersonation_chain,
+ )
diff --git
a/providers/google/tests/unit/google/cloud/triggers/test_cloud_build.py
b/providers/google/tests/unit/google/cloud/triggers/test_cloud_build.py
index ff966e510e3..b31258de43e 100644
--- a/providers/google/tests/unit/google/cloud/triggers/test_cloud_build.py
+++ b/providers/google/tests/unit/google/cloud/triggers/test_cloud_build.py
@@ -45,6 +45,7 @@ TEST_BUILD_WORKING = {
TEST_CONN_ID = "google_cloud_default"
TEST_POLL_INTERVAL = 4.0
TEST_LOCATION = "global"
+TEST_IMPERSONATION_CHAIN = "[email protected]"
TEST_BUILD_INSTANCE = dict(
id="test-build-id-9832662",
status=3,
@@ -119,6 +120,24 @@ class TestCloudBuildCreateBuildTrigger:
"location": TEST_LOCATION,
}
+ @mock.patch(CLOUD_BUILD_PATH.format("CloudBuildAsyncHook"), autospec=True)
+ def test_get_async_hook_builds_hook_with_impersonation_chain(self,
mock_hook):
+ trigger = CloudBuildCreateBuildTrigger(
+ id_=TEST_BUILD_ID,
+ project_id=TEST_PROJECT_ID,
+ gcp_conn_id=TEST_CONN_ID,
+ impersonation_chain=TEST_IMPERSONATION_CHAIN,
+ poll_interval=TEST_POLL_INTERVAL,
+ location=TEST_LOCATION,
+ )
+
+ trigger._get_async_hook()
+
+ mock_hook.assert_called_once_with(
+ gcp_conn_id=TEST_CONN_ID,
+ impersonation_chain=TEST_IMPERSONATION_CHAIN,
+ )
+
@pytest.mark.asyncio
@mock.patch(CLOUD_BUILD_PATH.format("CloudBuildAsyncHook"))
async def test_trigger_on_success_yield_successfully(self, mock_hook,
trigger):
