Merge branch 'main' into fix/4768-mcp-traceparent

Author: rohityan

.github/workflows/release-cherry-pick.yml

@@ -18,7 +18,7 @@ jobs:
   cherry-pick:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: release/candidate
           fetch-depth: 0

.github/workflows/release-cut.yml

@@ -18,7 +18,7 @@ jobs:
   cut-release:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         with:
           ref: ${{ inputs.commit_sha || 'main' }}
 

.github/workflows/release-finalize.yml

@@ -29,7 +29,7 @@ jobs:
             echo "is_release_pr=false" >> $GITHUB_OUTPUT
           fi
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         if: steps.check.outputs.is_release_pr == 'true'
         with:
           ref: release/candidate

.github/workflows/release-please.yml

@@ -27,7 +27,7 @@ jobs:
             echo "exists=false" >> $GITHUB_OUTPUT
           fi
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
         if: steps.check.outputs.exists == 'true'
         with:
           ref: release/candidate

.github/workflows/release-publish.yml

@@ -28,7 +28,7 @@ jobs:
           echo "version=$VERSION" >> $GITHUB_OUTPUT
           echo "Publishing version: $VERSION"
 
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v6
 
       - name: Install uv
         uses: astral-sh/setup-uv@v4

contributing/samples/gepa/OWNERS

@@ -58,10 +58,9 @@ restore_venv() {
         deactivate
     fi
 
-    if [[ -d ".unittest_venv" ]]; then
-        echo "Cleaning up .unittest_venv..."
-        rm -rf .unittest_venv
-    fi
+    echo "Cleaning up temporary directories..."
+    [[ -n "${VENV_DIR:-}" ]] && rm -rf "$VENV_DIR"
+    [[ -n "${UV_CACHE_DIR:-}" ]] && rm -rf "$UV_CACHE_DIR"
 
     if [[ -n "$ORIGINAL_VENV" ]]; then
         echo "Reactivating pre-existing venv: $ORIGINAL_VENV"
@@ -72,6 +71,15 @@ restore_venv() {
 # Ensure the environment is restored when the script exits.
 trap restore_venv EXIT
 
+# Temporary directory for the virtual environment.
+VENV_DIR=$(mktemp -d "${TMPDIR:-/tmp}/unittest_venv.XXXXXX")
+
+# Move uv cache to temp to prevent workspace bloat and IDE performance issues.
+export UV_CACHE_DIR=$(mktemp -d "${TMPDIR:-/tmp}/uv_cache.XXXXXX")
+
+# Force 'copy' mode; hardlinks (uv default) fail on many virtual filesystems.
+export UV_LINK_MODE=copy
+
 # 1. deactivate the current venv
 if [[ -n "${VIRTUAL_ENV:-}" ]]; then
     echo "Deactivating current venv: $VIRTUAL_ENV"
@@ -88,12 +96,12 @@ for version in "${versions_to_run[@]}"; do
     echo "=================================================="
 
     # 2. create a unittest_venv just for unit tests
-    echo "Creating/Using unittest_venv for python${version} in .unittest_venv..."
-    uv venv --python "${version}" .unittest_venv --clear
-    source .unittest_venv/bin/activate
+    echo "Creating/Using unittest_venv for python${version} in $VENV_DIR..."
+    uv venv --python "${version}" "$VENV_DIR" --clear
+    source "$VENV_DIR/bin/activate"
 
     # 3. perform the unit tests
-    echo "Setting up test environment in .unittest_venv..."
+    echo "Setting up test environment in $VENV_DIR..."
     uv sync --extra test --active
 
     echo "Running unit tests..."

scripts/unittests.sh

@@ -20,3 +20,4 @@
 from .auth_schemes import AuthSchemeType
 from .auth_schemes import OpenIdConnectWithConfig
 from .auth_tool import AuthConfig
+from .base_auth_provider import BaseAuthProvider

src/google/adk/auth/__init__.py

@@ -0,0 +1,54 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+"""Auth provider registry."""
+
+from __future__ import annotations
+
+from ..features import experimental
+from ..features import FeatureName
+from .auth_schemes import AuthScheme
+from .base_auth_provider import BaseAuthProvider
+
+
+@experimental(FeatureName.PLUGGABLE_AUTH)
+class AuthProviderRegistry:
+  """Registry for auth provider instances."""
+
+  def __init__(self):
+    self._providers: dict[type[AuthScheme], BaseAuthProvider] = {}
+
+  def register(
+      self,
+      auth_scheme_type: type[AuthScheme],
+      provider_instance: BaseAuthProvider,
+  ) -> None:
+    """Register a provider instance for an auth scheme type.
+
+    Args:
+        auth_scheme_type: The auth scheme type to register for.
+        provider_instance: The provider instance to register.
+    """
+    self._providers[auth_scheme_type] = provider_instance
+
+  def get_provider(self, auth_scheme: AuthScheme) -> BaseAuthProvider | None:
+    """Get the provider instance for an auth scheme.
+
+    Args:
+        auth_scheme: The auth scheme to get provider for.
+
+    Returns:
+        The provider instance if registered, None otherwise.
+    """
+    return self._providers.get(type(auth_scheme))

src/google/adk/auth/auth_provider_registry.py

@@ -0,0 +1,43 @@
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+from __future__ import annotations
+
+from abc import ABC
+from abc import abstractmethod
+
+from ..agents.callback_context import CallbackContext
+from ..features import experimental
+from ..features import FeatureName
+from .auth_credential import AuthCredential
+from .auth_tool import AuthConfig
+
+
+@experimental(FeatureName.PLUGGABLE_AUTH)
+class BaseAuthProvider(ABC):
+  """Abstract base class for custom authentication providers."""
+
+  @abstractmethod
+  async def get_auth_credential(
+      self, auth_config: AuthConfig, context: CallbackContext
+  ) -> AuthCredential | None:
+    """Provide an AuthCredential asynchronously.
+
+    Args:
+       auth_config: The current authentication configuration.
+       context: The current callback context.
+
+    Returns:
+       The retrieved AuthCredential, or None if unavailable.
+    """