fix(build): bundle google-auth so Vertex AI works in release binaries

[itzzdev09]

Fixes the Vertex half of #1256. The Bedrock half is #1049 (see Overlap below).

Root cause

The report installs with both curl … | bash and pipx install "strix-agent[vertex]". The vertex extra is declared correctly (google-auth>=2.0.0), so the pipx install has the module — but the curl-installed binary in ~/.strix/bin wins on PATH, and the binary can never run Vertex, for two compounding reasons:

1. strix.spec lists google.auth and google.oauth2 in PyInstaller's excludes.
2. The release build runs plain uv sync --frozen, so google-auth isn't installed in the build environment either.

litellm's Gemini path needs exactly those modules. Every import of them under litellm/llms/vertex_ai/ is on the credential path in vertex_llm_base.py:

vertex_llm_base.py:35   from google.auth.credentials import Credentials
vertex_llm_base.py:238  import google.oauth2.credentials
vertex_llm_base.py:246  import google.oauth2.service_account
vertex_llm_base.py:254  import google.auth as google_auth
vertex_llm_base.py:346  from google.auth.transport.requests import (

So vertex_ai/gemini-* fails on every binary install with No module named 'google'.

Change

• strix.spec: stop excluding google.auth and google.oauth2.
• build-release.yml: uv sync --frozen --extra vertex, so the build actually installs google-auth.

The other google.* / grpc excludes are kept on purpose. litellm only imports google.cloud and google.protobuf inside a try: in vertex_ai_non_gemini.py, for legacy PaLM and Model Garden models that need google-cloud-aiplatform. None of protobuf, grpcio, googleapis-common-protos or google-cloud-aiplatform are in uv.lock, so those excludes remove nothing today and there's no reason to widen the bundle.

google-auth's own runtime dependencies (cryptography, pyasn1-modules) aren't excluded, and requests — which google.auth.transport.requests needs — is already in hiddenimports.

Tests

Two regression tests in tests/test_optional_deps.py, alongside the existing extras tests:

• test_binary_keeps_the_google_auth_modules_vertex_needs — parses strix.spec with ast (executing it imports PyInstaller) and asserts none of the credential modules litellm imports are excluded, honouring PyInstaller's rule that excluding a parent package drops its children.
• test_release_build_installs_the_vertex_extra — asserts every uv sync in the release workflow selects --extra vertex, since keeping the modules in the bundle only helps if the build installs them.

Both fail against main and pass here. Each was checked separately, swapping in main's file:

main's strix.spec     -> FAILED test_binary_keeps_the_google_auth_modules_vertex_needs
main's workflow       -> AssertionError: ['uv sync --frozen']

ruff check and ruff format clean; the workflow YAML parses.

What I could not verify

I don't have PyInstaller in my environment, so this is not build-verified — I haven't run a release build and started a Vertex scan against the resulting binary. The evidence is static: the spec excludes, the lockfile contents, and the imports litellm actually makes. PyInstaller's module graph traces the lazy imports in the collected litellm submodules, so dropping the excludes should be sufficient, but a release smoke test (#1261) would be the real confirmation.

Overlap with #1049

#1049 changes the same line to uv sync --frozen --extra bedrock. The two compose cleanly — whichever lands second should resolve to:

uv sync --frozen --extra bedrock --extra vertex

Both PRs also add tests to tests/test_optional_deps.py. My test only asserts --extra vertex is present, so it doesn't conflict with a --extra bedrock assertion.

🤖 Generated with Claude Code

[greptile-apps]

Confidence Score: 4/5

The PR appears safe to merge; the only finding is a non-blocking robustness weakness in the new workflow regression test.

Findings

1.  Commented commands pass validation ▶

Fix with agent prompt

### Issue 1
tests/test_optional_deps.py:76-78
This raw text check treats shell comments as executable commands. If the current command is later commented out and replaced with `uv sync --frozen`, the commented `--extra vertex` text will still satisfy the assertion even though the release build no longer installs Google Auth. Filtering out commented lines prevents this false-positive regression result.

```suggestion
    sync_lines = [
        line.strip()
        for line in workflow.splitlines()
        if "uv sync" in line and not line.lstrip().startswith("#")
    ]
    assert sync_lines, "the release workflow no longer runs uv sync"
    assert all("--extra vertex" in line for line in sync_lines), sync_lines
```

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

Summary

• Adds --extra vertex to the release environment synchronization.
• Removes google.auth and google.oauth2 from PyInstaller exclusions while retaining unrelated Google Cloud SDK exclusions.
• Adds static regression checks for the PyInstaller exclusions and release workflow.
• The implementation appears sound, with one non-blocking robustness issue in the workflow regression test.

_{Reviews (1) · Last reviewed commit: "fix(build): bundle google-auth so Vertex..."}

[greptile-apps]

Commented commands pass validation

This raw text check treats shell comments as executable commands. If the current command is later commented out and replaced with uv sync --frozen, the commented --extra vertex text will still satisfy the assertion even though the release build no longer installs Google Auth. Filtering out commented lines prevents this false-positive regression result.

Suggested change

	sync_lines = [line.strip() for line in workflow.splitlines() if "uv sync" in line]
	assert sync_lines, "the release workflow no longer runs uv sync"
	assert all("--extra vertex" in line for line in sync_lines), sync_lines
	sync_lines = [
	line.strip()
	for line in workflow.splitlines()
	if "uv sync" in line and not line.lstrip().startswith("#")
	]
	assert sync_lines, "the release workflow no longer runs uv sync"
	assert all("--extra vertex" in line for line in sync_lines), sync_lines

Prompt To Fix With AI

This is a comment left during a code review.
Path: tests/test_optional_deps.py
Line: 76-78

Comment:
**Commented commands pass validation**

This raw text check treats shell comments as executable commands. If the current command is later commented out and replaced with `uv sync --frozen`, the commented `--extra vertex` text will still satisfy the assertion even though the release build no longer installs Google Auth. Filtering out commented lines prevents this false-positive regression result.

```suggestion
    sync_lines = [
        line.strip()
        for line in workflow.splitlines()
        if "uv sync" in line and not line.lstrip().startswith("#")
    ]
    assert sync_lines, "the release workflow no longer runs uv sync"
    assert all("--extra vertex" in line for line in sync_lines), sync_lines
```

---

For each issue above, determine whether it is valid and should be fixed. If so, fix it directly.

[itzzdev09]

Valid — fixed in fd603a7 using your suggestion: the workflow check now reads only uncommented uv sync lines, so a commented-out --extra vertex can't mask a build that stopped installing the extra. I added a test that feeds it a commented uv sync --frozen --extra vertex above a real uv sync --frozen and asserts the check sees only the real command. tests/test_optional_deps.py: 5 passed; pinned ruff check and format clean.