From d38a12481881dadec009647a707f73b46a5c2e20 Mon Sep 17 00:00:00 2001
From: Sakthivel Subramanian <sakthipvmj@gmail.com>
Date: Fri, 10 Jan 2025 23:20:08 +0530
Subject: [PATCH] ci(spanner): use airlock for presubmit jobs

---
 .kokoro/presubmit/node14/system-test.cfg |  5 +++++
 .kokoro/system-test.sh                   | 17 +++++++++++++----
 .kokoro/trampoline_v2.sh                 |  3 ++-
 3 files changed, 20 insertions(+), 5 deletions(-)

diff --git a/.kokoro/presubmit/node14/system-test.cfg b/.kokoro/presubmit/node14/system-test.cfg
index f8dd221bf..cd4a38d91 100644
--- a/.kokoro/presubmit/node14/system-test.cfg
+++ b/.kokoro/presubmit/node14/system-test.cfg
@@ -9,4 +9,9 @@ env_vars: {
 env_vars: {
   key: "SECRET_MANAGER_KEYS"
   value: "long-door-651-kokoro-system-test-service-account"
+}
+
+env_vars: {
+  key: "USE_AIRLOCK",
+  value: "true"
 }
\ No newline at end of file
diff --git a/.kokoro/system-test.sh b/.kokoro/system-test.sh
index a90d5cfec..a122c604b 100755
--- a/.kokoro/system-test.sh
+++ b/.kokoro/system-test.sh
@@ -18,10 +18,6 @@ set -eo pipefail
 
 export NPM_CONFIG_PREFIX=${HOME}/.npm-global
 
-# Setup service account credentials.
-export GOOGLE_APPLICATION_CREDENTIALS=${KOKORO_GFILE_DIR}/secret_manager/long-door-651-kokoro-system-test-service-account
-export GCLOUD_PROJECT=long-door-651
-
 cd $(dirname $0)/..
 
 # Run a pre-test hook, if a pre-system-test.sh is in the project
@@ -31,8 +27,21 @@ if [ -f .kokoro/pre-system-test.sh ]; then
     set -x
 fi
 
+# Enable airlock
+if [[ $USE_AIRLOCK = 'true' ]]; then
+  cat > .npmrc <<EOL
+registry=https://us-npm.pkg.dev/artifact-foundry-prod/npm-3p-trusted/
+//us-npm.pkg.dev/artifact-foundry-prod/npm-3p-trusted/:always-auth=true
+EOL
+  npm_config_registry=https://registry.npmjs.org npx google-artifactregistry-auth
+fi
+
 npm install
 
+# Setup service account credentials.
+export GOOGLE_APPLICATION_CREDENTIALS=${KOKORO_GFILE_DIR}/secret_manager/long-door-651-kokoro-system-test-service-account
+export GCLOUD_PROJECT=long-door-651
+
 # If tests are running against main branch, configure flakybot
 # to open issues on failures:
 if [[ $KOKORO_BUILD_ARTIFACTS_SUBDIR = *"continuous"* ]] || [[ $KOKORO_BUILD_ARTIFACTS_SUBDIR = *"nightly"* ]]; then
diff --git a/.kokoro/trampoline_v2.sh b/.kokoro/trampoline_v2.sh
index 5d6cfcca5..89d897d52 100755
--- a/.kokoro/trampoline_v2.sh
+++ b/.kokoro/trampoline_v2.sh
@@ -164,7 +164,8 @@ if [[ -n "${KOKORO_BUILD_ID:-}" ]]; then
 	"KOKORO_GITHUB_PULL_REQUEST_COMMIT"
 	# For flakybot
 	"KOKORO_GITHUB_COMMIT_URL"
-	"KOKORO_GITHUB_PULL_REQUEST_URL"
+	"KOKORO_GITHUB_PULL_REQUEST_URL",
+	"USE_AIRLOCK"
     )
 elif [[ "${TRAVIS:-}" == "true" ]]; then
     RUNNING_IN_CI="true"