From 31eb7a8eae7b40c9d9a130a463591eb8bbb11f27 Mon Sep 17 00:00:00 2001
From: Sakthivel Subramanian <sakthivelmani@google.com>
Date: Thu, 22 Oct 2026 09:16:49 +0000
Subject: [PATCH 1/4] chore(kokoro): Fetch latest enabled secret instead of
 disabled latest version

The latest alias in Secret Manager points to the most recently created version even if it is disabled or destroyed. This caused the populate-secrets.sh script to fail silently with FAILED_PRECONDITION when attempting to download version 38 of java-it-service-account, which was corrupted and disabled, leading to a missing credential file in the Kokoro environment. This commit changes the script to explicitly query and download the latest enabled version, making the CI robust against disabled or destroyed secrets.
---
 .kokoro/populate-secrets.sh | 17 ++++++++++++++++-
 1 file changed, 16 insertions(+), 1 deletion(-)

diff --git a/.kokoro/populate-secrets.sh b/.kokoro/populate-secrets.sh
index 0fa3af706c14..251821f7e964 100755
--- a/.kokoro/populate-secrets.sh
+++ b/.kokoro/populate-secrets.sh
@@ -28,10 +28,25 @@ mkdir -p ${SECRET_LOCATION}
 for key in $(echo ${SECRET_MANAGER_KEYS} | sed "s/,/ /g")
 do
   msg "Retrieving secret ${key}"
+  VERSION=$(docker run --entrypoint=gcloud \
+    --volume=${KOKORO_GFILE_DIR}:${KOKORO_GFILE_DIR} \
+    gcr.io/google.com/cloudsdktool/cloud-sdk \
+    secrets versions list ${key} \
+    --project cloud-devrel-kokoro-resources \
+    --filter="state=enabled" \
+    --sort-by="~createTime" \
+    --limit=1 \
+    --format="value(name)")
+  
+  if [ -z "${VERSION}" ]; then
+    msg "Error retrieving enabled version for secret ${key}"
+    exit 1
+  fi
+
   docker run --entrypoint=gcloud \
     --volume=${KOKORO_GFILE_DIR}:${KOKORO_GFILE_DIR} \
     gcr.io/google.com/cloudsdktool/cloud-sdk \
-    secrets versions access latest \
+    secrets versions access ${VERSION} \
     --project cloud-devrel-kokoro-resources \
     --secret ${key} > \
     "${SECRET_LOCATION}/${key}"

From 5438aad6c10c64f582428837fd4a83601e3071ac Mon Sep 17 00:00:00 2001
From: Sakthivel Subramanian <sakthivelmani@google.com>
Date: Thu, 22 Oct 2026 09:27:58 +0000
Subject: [PATCH 2/4] Addressed comments

---
 .kokoro/populate-secrets.sh | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.kokoro/populate-secrets.sh b/.kokoro/populate-secrets.sh
index 251821f7e964..0b01ffb19f05 100755
--- a/.kokoro/populate-secrets.sh
+++ b/.kokoro/populate-secrets.sh
@@ -36,7 +36,7 @@ do
     --filter="state=enabled" \
     --sort-by="~createTime" \
     --limit=1 \
-    --format="value(name)")
+    --format="value(name.basename())")
   
   if [ -z "${VERSION}" ]; then
     msg "Error retrieving enabled version for secret ${key}"

From 7164a48f2d56544cd51d1c894e94cac228abf81c Mon Sep 17 00:00:00 2001
From: Sakthivel Subramanian <sakthivelmani@google.com>
Date: Thu, 22 Oct 2026 09:39:06 +0000
Subject: [PATCH 3/4] Addressed comments

---
 .kokoro/populate-secrets.sh | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.kokoro/populate-secrets.sh b/.kokoro/populate-secrets.sh
index 0b01ffb19f05..c844140a089d 100755
--- a/.kokoro/populate-secrets.sh
+++ b/.kokoro/populate-secrets.sh
@@ -28,7 +28,7 @@ mkdir -p ${SECRET_LOCATION}
 for key in $(echo ${SECRET_MANAGER_KEYS} | sed "s/,/ /g")
 do
   msg "Retrieving secret ${key}"
-  VERSION=$(docker run --entrypoint=gcloud \
+  VERSION=$(docker run --rm --entrypoint=gcloud \
     --volume=${KOKORO_GFILE_DIR}:${KOKORO_GFILE_DIR} \
     gcr.io/google.com/cloudsdktool/cloud-sdk \
     secrets versions list ${key} \
@@ -36,14 +36,14 @@ do
     --filter="state=enabled" \
     --sort-by="~createTime" \
     --limit=1 \
-    --format="value(name.basename())")
+    --format="value(name.basename())") || VERSION=""
   
   if [ -z "${VERSION}" ]; then
     msg "Error retrieving enabled version for secret ${key}"
     exit 1
   fi
 
-  docker run --entrypoint=gcloud \
+  docker run --rm --entrypoint=gcloud \
     --volume=${KOKORO_GFILE_DIR}:${KOKORO_GFILE_DIR} \
     gcr.io/google.com/cloudsdktool/cloud-sdk \
     secrets versions access ${VERSION} \

From af0f7d945a006b4653c41d89baa0445781c57383 Mon Sep 17 00:00:00 2001
From: Sakthivel Subramanian <sakthivelmani@google.com>
Date: Thu, 22 Oct 2026 09:50:11 +0000
Subject: [PATCH 4/4] Addressed comments

---
 .kokoro/populate-secrets.sh | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/.kokoro/populate-secrets.sh b/.kokoro/populate-secrets.sh
index c844140a089d..93349df2028d 100755
--- a/.kokoro/populate-secrets.sh
+++ b/.kokoro/populate-secrets.sh
@@ -29,9 +29,9 @@ for key in $(echo ${SECRET_MANAGER_KEYS} | sed "s/,/ /g")
 do
   msg "Retrieving secret ${key}"
   VERSION=$(docker run --rm --entrypoint=gcloud \
-    --volume=${KOKORO_GFILE_DIR}:${KOKORO_GFILE_DIR} \
+    --volume="${KOKORO_GFILE_DIR}:${KOKORO_GFILE_DIR}" \
     gcr.io/google.com/cloudsdktool/cloud-sdk \
-    secrets versions list ${key} \
+    secrets versions list "${key}" \
     --project cloud-devrel-kokoro-resources \
     --filter="state=enabled" \
     --sort-by="~createTime" \
@@ -44,11 +44,11 @@ do
   fi
 
   docker run --rm --entrypoint=gcloud \
-    --volume=${KOKORO_GFILE_DIR}:${KOKORO_GFILE_DIR} \
+    --volume="${KOKORO_GFILE_DIR}:${KOKORO_GFILE_DIR}" \
     gcr.io/google.com/cloudsdktool/cloud-sdk \
-    secrets versions access ${VERSION} \
+    secrets versions access "${VERSION}" \
     --project cloud-devrel-kokoro-resources \
-    --secret ${key} > \
+    --secret "${key}" > \
     "${SECRET_LOCATION}/${key}"
   if [[ $? == 0 ]]; then
     msg "Secret written to ${SECRET_LOCATION}/${key}"