[danielmawhirter]

Depends on #129.

Summary

Remove automatic AWS Secrets Manager credential lookup from BigQuery test setup, including direct local runs. Every selected BigQuery test now requires explicit GOOGLE_APPLICATION_CREDENTIALS; missing or invalid configuration fails before dependent resources start.

Local runs accept service-account, user, impersonated, or federated ADC. Restricted key-based tests require separate explicit credential files; other ADC types use explicit impersonation targets. GCP profiles and workload-exchange mode require federated ADC. BigQueryIdentity replaces the two legacy secret-name arguments.

All decorators now declare requirements for the same session/function fixture flow. Credentials are ready before worker startup and dependent fixtures, environment changes are restored, and input files remain unchanged. The runtime-wrapper and stored-key fallback paths are removed.

This draft depends on the credential-profile and workflow migrations. Live GCP federation remains blocked and unverified. Keep this draft unmerged until the migrated workflows pass live authentication and provider tests.

Change map

File-by-file change map.

Testing Done

• Focused BigQuery/GCS credential and fixture tests: 58 passed.
• Assembled helper, selection, launcher, and workflow suite: 135 passed independently.
• flake8 -j 1, isort --check-only, and git diff --check: passed.
• Documentation checker: 235 Markdown files checked successfully.
• Used the existing Python 3.14 environment with current-checkout package paths on PYTHONPATH; no worktree-local .venv or live provider validation.
• Parent CI reaches dedicated GCP authentication but is rejected by the provider's attribute condition. Live test acceptance remains blocked; no IAM changes were made.

Checklist

• Listed changed internal contracts: explicit ADC is mandatory; the legacy secret constants and service_account_key decorator argument are removed. Both restricted callsites use BigQueryIdentity.
• Documented direct local configuration and restricted-identity inputs.
• Added and updated regressions for credential selection, fixture ordering, restoration, missing inputs, and read-only credential files.

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

_{Comment @coderabbitai help to get the list of available commands.}

[danielmawhirter]

Change map

File	Function / scope	What changed	Why
kumo/testing/bigquery.py	BigQueryIdentity, resolve_credentials, setup_bigquery_credentials, credential fixtures, withBigQueryCredentials	Require explicit ADC; select restricted local key files or impersonation targets by typed identity; remove AWS secret lookup, temporary-key generation, legacy constants, and runtime wrappers; use prerequisite fixtures for both direct and profiled runs.	Complete the requested removal of implicit stored-key fallback after workflow migration, while ensuring credentials exist before resource setup and remain scoped through teardown.
test/connector/test_bigquery_connector.py	Restricted table-read and project-permission tests	Replace two secret-name decorator arguments with BigQueryIdentity.NO_TABLE and BigQueryIdentity.NO_JOB.	Preserve the negative permission assertions while making the requested identity independent of its former secret-store location.
test/testing/test_bigquery_credentials.py	Explicit ADC, restricted identity, lifecycle and existing connector/REST checks	Replace fallback compatibility tests with explicit-input and credential-type regressions; verify restricted key files, WIF enforcement, missing/invalid input failures, environment restoration, no secret access, and unchanged input files.	Verify the final contract and remove tests that would otherwise keep the retired fallback alive.
test/testing/test_gcs_credentials.py	Shared BigQuery/GCS prerequisite fixture tests	Update typed marker inputs and cover direct local BigQuery worker/resource ordering, restricted keys, subsequent default identity restoration, and missing-input failure before workers.	Verify that removing wrappers preserves setup and teardown ordering for real pytest fixture lifetimes, including direct local execution.
docs/development/testing.md	Explicit local BigQuery setup	Document accepted ADC types, strict federation mode, restricted-file and impersonation variables, typed decorator usage, and fixture/file lifetime.	Local developers must now supply credentials explicitly; the removed AWS and home-file fallbacks are no longer setup options.

Requested requirement: remove automatic AWS stored-key fallback from migrated BigQuery tests, including local developer runs. Previously, unprofiled tests retained secret lookup and runtime wrappers while profiled runs used prerequisite fixtures.

Smallest sufficient change: migrate the two restricted identity callsites, consolidate credential setup around explicit inputs and one fixture flow, and replace fallback tests with final-contract regressions. Other providers' local credential conventions and production connector authentication are outside this helper-specific change.

Verification: 58 focused tests passed; flake8, isort, whitespace checks, and the repository documentation checker passed. Tests used Python 3.14 with explicit current-checkout package paths. No live cloud authentication or permission checks were performed.

Stopping condition: local credential selection and fixture lifecycle checks pass with no AWS secret lookup or generated credential files in the BigQuery helper. This remains a dependent draft until workflow migration and live GCP federation/provider verification succeed; unavailable live trust must not be worked around by restoring fallback credentials.

[danielmawhirter]

Superseded by #224 and #225. The explicit ADC inputs, typed restricted BigQuery identities, removal of hidden AWS credential lookup, and scoped cleanup are consolidated in #225 without depending on the profile/launcher framework. Closing this superseded phase; its credential cleanup is retained in the replacement stack.