Authenticate with service account in CI

.github/workflows/tests-coverage.yml

@@ -21,13 +21,9 @@ jobs:
       run: |
         python -m pip install --upgrade pip
         pip install hatch
-    - name: Set up Earth Engine
-      env:
-        EE_TOKEN: ${{ secrets.EE_TOKEN }}
-      run: |
-        mkdir -p /home/runner/.config/earthengine
-        echo "$EE_TOKEN" > /home/runner/.config/earthengine/credentials
     - name: Test with pytest
+      env:
+        EE_SERVICE_ACCOUNT: ${{ secrets.EE_SERVICE_ACCOUNT }}
       run: |
         hatch run test:coverage --cov-report=xml
     - name: Upload to Codecov

.github/workflows/tests.yml

@@ -24,12 +24,8 @@ jobs:
       run: |
         python -m pip install --upgrade pip
         pip install hatch
-    - name: Set up Earth Engine
-      env:
-        EE_TOKEN: ${{ secrets.EE_TOKEN }}
-      run: |
-        mkdir -p /home/runner/.config/earthengine
-        echo "$EE_TOKEN" > /home/runner/.config/earthengine/credentials
     - name: Test with pytest
+      env:
+        EE_SERVICE_ACCOUNT: ${{ secrets.EE_SERVICE_ACCOUNT }}
       run: |
         hatch run test:all

test/conftest.py

@@ -1,4 +1,7 @@
-import wxee
+import os
+import json
+
+import ee
 
 
 def pytest_sessionstart(session):
@@ -7,7 +10,7 @@ def pytest_sessionstart(session):
     """
     if not is_ee_excluded(session):
         try:
-            wxee.Initialize()
+            _init_ee_for_tests()
         except Exception:
             raise ValueError(
                 'Earth Engine could not be initialized. Use `pytest . -m "not ee"` to skip Earth Engine tests.'
@@ -18,3 +21,18 @@ def is_ee_excluded(session):
     """Check if a marker filter was passed to the session to exclude tests marked `ee`."""
     markers = session.config.getoption("-m")
     return "not ee" in markers
+
+
+def _init_ee_for_tests():
+    # Use the Github Service Account for CI tests
+    if os.environ.get("GITHUB_ACTIONS"):
+        key_data = os.environ.get("EE_SERVICE_ACCOUNT")
+        project_id = json.loads(key_data).get("project_id")
+        credentials = ee.ServiceAccountCredentials(None, key_data=key_data)
+    # Use stored persistent credentials for local tests
+    else:
+        # Project should be parsed from credentials
+        project_id = None
+        credentials = "persistent"
+
+    ee.Initialize(credentials, project=project_id)