feat(secretmanager): guard _observability import and update interceptor assertions

Author: chalmerlowe

packages/google-cloud-secret-manager/google/cloud/secretmanager_v1/services/secret_manager_service/client.py

@@ -35,15 +35,21 @@
 )
 
 import google.protobuf
-from google.api_core import _observability, gapic_v1
 from google.api_core import client_options as client_options_lib
 from google.api_core import exceptions as core_exceptions
+from google.api_core import gapic_v1
 from google.api_core import retry as retries
 from google.auth import credentials as ga_credentials  # type: ignore
 from google.auth.exceptions import MutualTLSChannelError  # type: ignore
 from google.auth.transport import mtls  # type: ignore
 from google.oauth2 import service_account  # type: ignore
 
+try:
+    # mypy: _observability was added in google-api-core 2.35.0; guard for older versions
+    from google.api_core import _observability  # type: ignore[attr-defined]
+except ImportError:
+    _observability = None  # type: ignore[assignment]
+
 from google.cloud.secretmanager_v1 import gapic_version as package_version
 from google.cloud.secretmanager_v1._compat import (
     get_api_endpoint,
@@ -622,12 +628,18 @@ def __init__(
 
             # When OpenTelemetry tracing is enabled, obtain the channel interceptor
             # and pass it to the transport.
-            if transport_init is SecretManagerServiceGrpcTransport:
+            if (
+                transport_init is SecretManagerServiceGrpcTransport
+                and _observability is not None
+            ):
                 otel_interceptor = _observability.get_otel_interceptor(
                     self._client_options
                 )
                 if otel_interceptor is not None:
-                    transport_kwargs["interceptors"] = [otel_interceptor]
+                    interceptors = transport_kwargs.get("interceptors", [])
+                    transport_kwargs["interceptors"] = [otel_interceptor] + list(
+                        interceptors
+                    )
 
             self._transport = transport_init(**transport_kwargs)
 

packages/google-cloud-secret-manager/google/cloud/secretmanager_v1/services/secret_manager_service/transports/grpc.py

@@ -27,7 +27,12 @@
 import grpc  # type: ignore
 import proto  # type: ignore
 from google.api_core import gapic_v1, grpc_helpers
-from google.api_core.grpc_helpers import ClientInterceptor
+
+try:
+    # mypy: ClientInterceptor was added in google-api-core 2.35.0; guard for older versions
+    from google.api_core.grpc_helpers import ClientInterceptor  # type: ignore[attr-defined]
+except ImportError:
+    ClientInterceptor = grpc.ClientInterceptor  # type: ignore[misc,assignment]
 from google.auth import credentials as ga_credentials  # type: ignore
 from google.auth.transport.grpc import SslCredentials  # type: ignore
 from google.cloud.location import locations_pb2  # type: ignore
@@ -286,9 +291,9 @@ def __init__(
                 ],
             )
 
-        self._grpc_channel = grpc_helpers.apply_channel_interceptors(
-            self._grpc_channel, interceptors
-        )
+        apply_interceptors = getattr(grpc_helpers, "apply_channel_interceptors", None)
+        if apply_interceptors is not None:
+            self._grpc_channel = apply_interceptors(self._grpc_channel, interceptors)
 
         self._interceptor = _LoggingClientInterceptor()
         self._logged_channel = grpc.intercept_channel(

packages/google-cloud-secret-manager/noxfile.py

@@ -71,9 +71,7 @@
     "pytest-asyncio",
 ]
 UNIT_TEST_EXTERNAL_DEPENDENCIES: List[str] = []
-UNIT_TEST_LOCAL_DEPENDENCIES: List[str] = [
-    "../google-api-core[tracing,testing]",
-]
+UNIT_TEST_LOCAL_DEPENDENCIES: List[str] = []
 UNIT_TEST_DEPENDENCIES: List[str] = []
 UNIT_TEST_EXTRAS: List[str] = []
 UNIT_TEST_EXTRAS_BY_PYTHON: Dict[str, List[str]] = {}

packages/google-cloud-secret-manager/setup.py

@@ -44,7 +44,7 @@
     release_status = "Development Status :: 5 - Production/Stable"
 
 dependencies = [
-    "google-api-core[grpc] >= 2.35.0, <3.0.0",
+    "google-api-core[grpc] >= 2.28.0, <3.0.0",
     # Exclude incompatible versions of `google-auth`
     # See https://github.com/googleapis/google-cloud-python/issues/12364
     "google-auth >= 2.14.1, <3.0.0,!=2.24.0,!=2.25.0",

packages/google-cloud-secret-manager/testing/constraints-3.10.txt

@@ -4,7 +4,7 @@
 # pinning their versions to their lower bounds.
 # For example, if setup.py has "google-cloud-foo >= 1.14.0, < 2.0.0",
 # then this file should have google-cloud-foo==1.14.0
-google-api-core==2.35.0
+google-api-core==2.28.0
 google-auth==2.14.1
 grpcio==1.59.0
 proto-plus==1.26.1

packages/google-cloud-secret-manager/tests/unit/gapic/secretmanager_v1/test_secret_manager_service.py

@@ -507,7 +507,7 @@ def test_secret_manager_service_client_otel_channel_injection_disabled():
     """Proves that when OpenTelemetry tracing is disabled:
 
     1. SecretManagerServiceClient checks for an OTel interceptor and receives None.
-    2. No 'interceptors' argument is passed to the transport constructor.
+    2. No OTel interceptor is added to the transport constructor kwargs.
     """
     with (
         mock.patch(
@@ -522,7 +522,26 @@ def test_secret_manager_service_client_otel_channel_injection_disabled():
 
         mock_get_interceptor.assert_called_once_with(client._client_options)
         called_kwargs = patched_transport_init.call_args.kwargs
-        assert "interceptors" not in called_kwargs
+        interceptors = called_kwargs.get("interceptors", [])
+        assert not interceptors
+
+
+def test_secret_manager_service_client_observability_import_error():
+    """Proves that when _observability cannot be imported (older google-api-core),
+    SecretManagerServiceClient instantiates gracefully without error.
+    """
+    with (
+        mock.patch(
+            "google.cloud.secretmanager_v1.services.secret_manager_service.client._observability",
+            None,
+        ),
+        mock.patch.object(
+            transports.SecretManagerServiceGrpcTransport, "__init__", return_value=None
+        ) as patched_transport_init,
+    ):
+        SecretManagerServiceClient(transport="grpc")
+        called_kwargs = patched_transport_init.call_args.kwargs
+        assert not called_kwargs.get("interceptors", [])
 
 
 def test_secret_manager_service_grpc_transport_interceptors():