metaflow/plugins/pypi/conda_environment.py

@@ -282,6 +282,15 @@ def get_environment(self, step):
             # Match PyPI and Conda python versions with the resolved environment Python.
             environment["pypi"]["python"] = environment["conda"]["python"] = env_python
 
+            # When using `Application Default Credentials` for private GCP
+            # PyPI registries, the usage of environment variable `GOOGLE_APPLICATION_CREDENTIALS`
+            # demands that `keyrings.google-artifactregistry-auth` has to be installed
+            # and available in the underlying python environment.
+            if os.getenv("GOOGLE_APPLICATION_CREDENTIALS"):
+                environment["conda"]["packages"][
+                    "keyrings.google-artifactregistry-auth"
+                ] = ">=1.1.1"
+
         # Z combinator for a recursive lambda
         deep_sort = (lambda f: f(f))(
             lambda f: lambda obj: (

metaflow/plugins/pypi/pip.py

@@ -92,7 +92,14 @@ def _format(dl_info):
                 # so using @branch as a version acts as expected.
                 vcs_info = dl_info.get("vcs_info")
                 if vcs_info:
-                    res["url"] = "{vcs}+{url}@{commit_id}".format(**vcs_info, **res)
+                    subdirectory = dl_info.get("subdirectory")
+                    res["url"] = "{vcs}+{url}@{commit_id}{subdir_str}".format(
+                        **vcs_info,
+                        **res,
+                        subdir_str="#subdirectory=%s" % subdirectory
+                        if subdirectory
+                        else ""
+                    )
                     # used to deduplicate the storage location in case wheel does not
                     # build with enough unique identifiers.
                     res["hash"] = vcs_info["commit_id"]
@@ -270,9 +277,17 @@ def _call(self, prefix, args, env=None, isolated=True):
                         prefix,
                         "pip3",
                         "--disable-pip-version-check",
-                        "--no-input",
                         "--no-color",
                     ]
+                    # credentials are being determined from the JSON file referenced by
+                    # the GOOGLE_APPLICATION_CREDENTIALS environment variable and are
+                    # probably injected dynamically via `keyrings.google-artifactregistry-auth`
+                    # Thus, we avoid passing `--no-input` in this case.
+                    + (
+                        ["--no-input"]
+                        if os.getenv("GOOGLE_APPLICATION_CREDENTIALS") is None
+                        else []
+                    )
                     + (["--isolated"] if isolated else [])
                     + args,
                     stderr=subprocess.PIPE,

metaflow/version.py

@@ -1 +1 @@
-metaflow_version = "2.11.7"
+metaflow_version = "2.11.8"