[danielmawhirter]

Depends on #127.

Summary

GCP tests currently share collection, credential setup, and worker environments with unrelated tests, allowing authentication to happen during collection or after dependent fixtures have started. Add an explicit profile registry, launcher, and pytest selection plugin so the registered GCP tests run with declared credentials and prepare their identities before dependent resources start.

The GCP-only profile uses local artifacts; the GCP+AWS profile retains S3 for the BigQuery training test that needs it. Provider-only modules are excluded before import, mixed parameters are partitioned before fixture setup, and incompatible explicit targets fail early. Manifests make the selected node sets reviewable. Existing unprofiled commands retain their behavior; workflow routing follows in a dependent PR.

Change map

File-by-file change map.

Testing Done

• Collection audit: 154 baseline nodes partition into 88 general, 65 GCP, and 1 GCP+AWS node, with no omissions or overlap.
• 117 focused regression tests pass: 54 credential helper, 26 pytest selection, and 37 launcher tests.
• Changed Python files pass flake8 and isort checks; repository documentation validation passes (235 files).
• Live cloud authentication and permissions have not been verified.

General and Snowflake launcher profiles permit collection only. Their runtime credential contracts remain transitional: Azure and Databricks credentials have not yet been provisioned or narrowed. Direct local GCS setup temporarily retains encoded/home credential support; the transitional BigQuery wrapper is removed in a later dependent change. Exact credential isolation of the entire hosted suite remains follow-up work.

Checklist

• Described behavior changes and transitional limits.
• Updated developer instructions for profiles and credential inputs.
• Added selection, credential lifetime, ordering, and isolation regressions.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[danielmawhirter]

Change map

File	Function / scope	What changed	Why
tools/ci_test_profiles.py	TestProfile registry, owns_node, permits_target, runtime_environment, run_profile	Define explicit GCP ownership and capability sets; isolate child environments, support manifests and inner-process coverage.	Provide one ownership source and prevent unrelated provider credentials from entering GCP runtime.
tools/pytest_test_profiles.py	Early collection hooks and profile validation	Reject excluded explicit targets and skip unrelated modules before imports; select marked parameters and emit manifests.	Avoid collection-time credential side effects and detect gaps instead of silently dropping tests.
test/scripts/test_ci_test_profiles.py	Launcher and registry regressions	Check ownership, allowlisted environments, argument rejection, runtime guards, deploy configuration, and actual child coverage output.	Verify the execution boundary and preserve measured coverage after workflow migration.
test/scripts/test_pytest_test_profiles.py	Pytest subprocess regressions	Exercise pre-import exclusions, mixed parameter selection, outside-root rejection, capability mismatch, and manifests.	Verify actual collection behavior without contacting live services.
kumo/testing/bigquery.py	Profile credential fixtures and identity switching	Validate explicit profile ADC before resource setup and scope identity/environment selection to fixture lifetime.	Ensure dependent resources receive the selected identity before initialization.
kumo/testing/gcs.py	Credential decorators and session fixture	Defer credential mutation from import to fixture setup and preserve explicit ADC for worker lifetime.	Keep unrelated collection credential-free and avoid premature credential cleanup.
test/testing/test_bigquery_credentials.py	Profile credential regressions	Add explicit-input, identity selection, fixture ordering, and restoration checks.	Protect the profile setup contract while preserving the preceding helper repair.
test/testing/test_gcs_credentials.py	Collection and session lifetime regressions	Verify import purity, worker inheritance, session setup, and cleanup ordering.	Ensure live resource initialization uses the intended session credentials.
test/conftest.py	Root credential fixtures and provider defaults	Register profile markers and fixtures; avoid installing AWS defaults for no-AWS profiles.	Establish credentials before session resources and avoid ambient AWS coupling.
test/rest/integ/conftest.py	Diskgraph deploy fixture dependencies	Require profile credentials and local GloVe artifacts before integration worker startup.	Make worker inheritance deterministic and keep GCP-only storage configuration local.
test/io_utils/fsutil/test_all.py	Existing root_gcs parameter	Attach the GCP capability mark without changing parameter IDs.	Route only the GCS cases out of the mixed filesystem contract suite.
test/rest/test_tables.py	test_validate_size	Mark the live GCP test.	Separate its credential needs from other REST table tests.
docs/development/testing.md	Profile execution and collection guidance	Document commands, manifest comparison, explicit credentials, and transitional runtime limitations.	Make supported execution paths and remaining Azure/Databricks work clear.

Observed failure: mixed test modules performed credential work during collection, while decorator authentication could run after dependent resource fixtures. Broad environment inheritance coupled unrelated providers.

Smallest sufficient change: introduce one shared profile registry, early selection plugin, isolated GCP launcher, and fixture-owned credential lifetime. Existing workflows are deliberately outside this PR; the dependent routing PR activates these contracts.

Verification: 117 focused tests passed (37 launcher, 26 plugin, 54 credential helpers), including real child coverage output. Collection audit: 154 baseline nodes = 88 general + 65 GCP + one GCP/AWS, with no omissions or overlaps. Python lint/isort passed. Live authentication remains unverified.

Stopping condition: exact disjoint GCP ownership is demonstrable, unrelated modules are excluded before import, credentials exist before dependent fixtures, and child execution receives only declared inputs. General/Snowflake isolated runtime refuses execution pending Azure/Databricks classification; their collection mode remains available. Removal of the direct local BigQuery compatibility wrapper and remaining local GCS legacy inputs are separate follow-ups.

[danielmawhirter]

Superseded by #224 and #225, which retain collection-safe fixture setup, credential ordering, and scoped lifecycle cleanup without the generic profile registry, launcher, and selection plugin. Worth revisiting separately: provider-specific process environments and audited test ownership, especially Azure/Databricks. Start with explicit jobs and ordinary fixtures; the full profile framework is not required to unblock GCP CI.