test: stabilize flaky TestCtxUsage

[flaky-claw]

What problem does this PR solve?

Issue Number: close #70211

Problem Summary:
Flaky test TestCtxUsage in pkg/objstore intermittently fails, so this PR stabilizes that path.

What changed and how does it work?

Root Cause

TestCtxUsage accidentally depended on real Google STS timing while asserting an invalid_request credential error.

Fix

Local token_url preserves the same external-account credential exchange but makes the expected invalid_request deterministic.

Verification

Spec:

• target: pkg/objstore :: TestCtxUsage
• strategy: tidb.go_flaky.default
• plan mode: BASELINE_ONLY
• requirements: required case must execute; no skip; repeat count = 1
• execution surface: GO_TEST_WITH_TAGS
• build tags: intest, deadlock
• baseline gates: required_flaky_gate, build_safety_gate, intent_guard_gate
• feedback surface source: baseline_only

Observed result:

• status: failed
• required case executed: no
• submission decision: ALLOWED
• note: Required flaky case was not skipped.

Gate checklist:

• diagnostic_timing_repro: FAIL
• target_flaky_acceptance: BLOCKED
• package_failpoint_surface: BLOCKED
• raw_package_command_mismatch: SKIPPED
• build: BLOCKED
• lint: BLOCKED

Commands:

• HTTPS_PROXY=<local CONNECT proxy that stalls TLS after CONNECT> NO_PROXY=127.0.0.1,localhost go test -json -tags=intest,deadlock ./pkg/objstore -run '^TestCtxUsage$' -count=1

Check List

Tests

• Unit test
• Integration test
• Manual test (add detailed scripts or steps below)
• No need to test

  • I checked and no code files have been changed.

Side effects

• Performance regression: Consumes more CPU
• Performance regression: Consumes more Memory
• Breaking backward compatibility

Documentation

• Affects user behaviors
• Contains syntax changes
• Contains variable changes
• Contains experimental features
• Changes MySQL compatibility

Release note

Please refer to Release Notes Language Style Guide to write a quality release note.

None

Fixes #70211

Summary by CodeRabbit

• Bug Fixes
  • Improved handling and test coverage for failed Google Cloud token requests.
  • Ensured token endpoint errors clearly indicate when required credentials are missing.

[ti-chi-bot]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by:
Once this PR has been reviewed and has the lgtm label, please assign yujuncen for approval. For more information see the Code Review Process.
Please ensure that each of them provides their approval before proceeding.

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• pkg/objstore/OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[coderabbitai]

📝 Walkthrough

Walkthrough

TestCtxUsage now configures a token endpoint URL and simulates a GCP token request failure with an HTTP 400 response describing a missing subject token.

Changes

GCS test token flow

Layer / File(s)	Summary
Configure token endpoint failure pkg/objstore/gcs_test.go	The test HTTP server returns an invalid_request response for /token, while the embedded credentials include the token endpoint and consistently formatted credential source URL.

Estimated code review effort: 1 (Trivial) | ~5 minutes

Suggested reviewers: joechenrh

Poem

A bunny tests the token gate,
With carrots queued and errors straight.
The endpoint says, “Please try again,”
No flaky hops, no puzzled pen.
The GCS path now rests serene.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly and concisely summarizes the main change: stabilizing flaky TestCtxUsage.
Description check	✅ Passed	The description includes the issue number, problem summary, change details, verification, checklist, and release note.
Linked Issues check	✅ Passed	The change addresses #70211 by making TestCtxUsage deterministic and stabilizing the flaky objstore test.
Out of Scope Changes check	✅ Passed	The edits are limited to the targeted TestCtxUsage test fixture and support the stated flaky-test fix.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

Warning

There were issues while running some tools. Please review the errors and either fix the tool's configuration or disable the tool if it's a critical failure.

🔧 golangci-lint (2.12.2)

level=error msg="Running error: context loading failed: failed to load packages: failed to load packages: failed to load with go/packages: context deadline exceeded"
level=error msg="Timeout exceeded: try increasing it by passing --timeout option"

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.7952%. Comparing base (93f713c) to head (e7a504d).

Additional details and impacted files

@@               Coverage Diff                @@
##             master     #70214        +/-   ##
================================================
- Coverage   76.3237%   73.7952%   -2.5286%     
================================================
  Files          2041       2060        +19     
  Lines        559257     580082     +20825     
================================================
+ Hits         426846     428073      +1227     
- Misses       131511     151610     +20099     
+ Partials        900        399       -501     

Flag	Coverage Δ
integration	40.8845% <ø> (+1.2266%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
dumpling	59.8807% <ø> (ø)
parser	∅ <ø> (∅)
br	46.6707% <ø> (-16.0218%)	⬇️

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[coderabbitai]

🧹 Nitpick comments (1)

pkg/objstore/gcs_test.go (1)

638-643: 🎯 Functional Correctness | 🔵 Trivial | ⚡ Quick win

Declare the token error response as JSON.

Line 641 writes a JSON body, but the handler leaves the response as the default text/plain. Set Content-Type: application/json before Line 640 so the mock accurately exercises the OAuth error contract rather than relying on parser permissiveness.

Suggested fix

 		if r.URL.Path == "/token" {
+			w.Header().Set("Content-Type", "application/json")
 			w.WriteHeader(http.StatusBadRequest)

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In `@pkg/objstore/gcs_test.go` around lines 638 - 643, Update the HTTP handler in
the httptest.NewServer setup to set the response Content-Type header to
application/json before writing the token error body in the /token branch.
Preserve the existing 400 status and JSON payload.

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In `@pkg/objstore/gcs_test.go`:
- Around line 638-643: Update the HTTP handler in the httptest.NewServer setup
to set the response Content-Type header to application/json before writing the
token error body in the /token branch. Preserve the existing 400 status and JSON
payload.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Repository UI

Review profile: CHILL

Plan: Pro Plus

Run ID: cb471b3b-db6c-48b5-8868-d2a101fbac26

📥 Commits

Reviewing files that changed from the base of the PR and between 93f713c and e7a504d.

📒 Files selected for processing (1)

• pkg/objstore/gcs_test.go