[lgyStoic]

Problem

When authenticating with --auth=adc using end-user credentials minted via gcloud auth application-default login (without a pinned quota_project_id), google.auth._default._get_gcloud_sdk_credentials() sees project_id is None and calls google.auth._cloud_sdk.get_project_id(), which spawns a gcloud config get-value project subprocess on every single CLI invocation.

However, _get_adc_credentials() in src/colab_cli/auth.py immediately discards the returned project_id:

creds, _ = google.auth.default(scopes=list(PUBLIC_SCOPES))

On developer laptops (macOS/Linux), spawning gcloud config get-value project adds 2s to 13s of latency to every colab --auth=adc ... command (colab status, colab ls, colab exec, etc.) solely to compute a project_id that is never used.

Benchmark (macOS, Python 3.12, google-auth 2.49+)

• Before (google.auth.default() spawning gcloud config get-value project): 13,217.77 ms (~13.2s)
• After (stubbing _cloud_sdk.get_project_id during google.auth.default()): 48.21 ms (~0.05s)

Changes

• Stub google.auth._cloud_sdk.get_project_id around google.auth.default(scopes=list(PUBLIC_SCOPES)) in _get_adc_credentials() so google-auth does not spawn gcloud config get-value project when user ADC credentials lack a quota_project_id, while preserving the full ADC credential discovery chain (GOOGLE_APPLICATION_CREDENTIALS, Cloud SDK ADC, App Engine, GCE/GKE metadata server) and avoiding injecting any X-Goog-User-Project header onto the credentials.
• Add test_get_credentials_adc_skips_gcloud_project_subprocess in tests/test_auth_adc.py.
• Add dated design log entry in docs/04_automation_and_utility.md.

Verification

• uv run pytest tests/test_auth_adc.py tests/test_auth.py — 33 passed.
• uv run ruff check src/colab_cli/auth.py tests/test_auth_adc.py — clean.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.