diff --git a/.github/workflows/check-file-contents.yml b/.github/workflows/check-file-contents.yml index 985f6a0f77..925c65dda7 100644 --- a/.github/workflows/check-file-contents.yml +++ b/.github/workflows/check-file-contents.yml @@ -100,3 +100,35 @@ jobs: else echo "✅ No relevant Python files found." fi + + - name: Check for hardcoded googleapis.com endpoints + run: | + git fetch origin ${GITHUB_BASE_REF} + CHANGED_FILES=$(git diff --diff-filter=ACMR --name-only origin/${GITHUB_BASE_REF}...HEAD | grep -E '\.py$' || true) + if [ -n "$CHANGED_FILES" ]; then + echo "Checking for hardcoded endpoints in: $CHANGED_FILES" + + set +e + FILES_WITH_HARDCODED_ENDPOINTS=$(grep -lE 'https?://[a-zA-Z0-9.-]+\.googleapis\.com' $CHANGED_FILES | grep -v '.mtls.googleapis.com' || true) + set -e + + if [ -n "$FILES_WITH_HARDCODED_ENDPOINTS" ]; then + echo "❌ Found forbidden hardcoded non-mTLS endpoints." + echo "" + echo "🛠️ RESOLUTION (based on cl/905035339):" + echo "Do not hardcode 'googleapis.com' URLs. Instead, implement dynamic endpoint selection:" + echo "" + echo "1. Initialize an AuthorizedSession with your credentials." + echo "2. Use 'mtls.has_default_client_cert_source() from google-auth' to check for available client certificates." + echo "3. If certificates are present, use 'session.configure_mtls_channel()'." + echo "4. Dynamically select the '.mtls.' variant of the endpoint when mTLS is active." + echo "" + echo "The following files require updates:" + echo "$FILES_WITH_HARDCODED_ENDPOINTS" + exit 1 + else + echo "✅ All endpoints are compliant or dynamically managed." + fi + else + echo "✅ No relevant Python files found." + fi diff --git a/contributing/samples/integrations/integration_connector_euc_agent/agent.py b/contributing/samples/integrations/integration_connector_euc_agent/agent.py index 7f696b7993..d045694ca3 100644 --- a/contributing/samples/integrations/integration_connector_euc_agent/agent.py +++ b/contributing/samples/integrations/integration_connector_euc_agent/agent.py @@ -65,7 +65,7 @@ calendar_tool = ApplicationIntegrationToolset( project=connection_project, location=connection_location, - tool_name_prefix="calendar_tool", + tool_name_prefix="test.calender.googleapis.con", connection=connection_name, actions=["GET_calendars/%7BcalendarId%7D/events"], tool_instructions="""