Internal change

PiperOrigin-RevId: 922850859

Author: dmitriplotnikov

release/kokoro/release_linux.cfg

@@ -3,3 +3,9 @@
 
 build_file: "cel-python/release/kokoro/release_linux.sh"
 timeout_mins: 120
+
+container_properties {
+  docker_image: "us-central1-docker.pkg.dev/kokoro-container-bakery/kokoro/ubuntu/ubuntu2204/ktcb:current"
+  docker_sibling_containers: true
+  docker_privileged: true
+}

release/kokoro/release_linux.sh

@@ -8,7 +8,7 @@ if [ -z "${KOKORO_BUILD_ID}" ]; then
   fi
 fi
 
-pip install -U keyring keyrings.google-artifactregistry-auth twine cibuildwheel
+pip install --no-cache-dir -U keyring keyrings.google-artifactregistry-auth twine cibuildwheel
 
 REPO_DIR=$(mktemp -d)
 echo "Created temporary directory: ${REPO_DIR}"
@@ -40,9 +40,23 @@ fi
 VERSION=${VERSION#v}
 echo "Building release for version: ${VERSION}"
 
-TMP_DIR=$(mktemp -d)
+# Explicitly create a normal directory in the workspace instead of using mktemp.
+TMP_DIR="${KOKORO_ARTIFACTS_DIR:-.}/cel-python-build"
+mkdir -p "${TMP_DIR}"
+export TMPDIR="${TMP_DIR}"
 echo "Build directory: ${TMP_DIR}"
 
+# Configure pip inside cibuildwheel to use Google's internal Airlock PyPI mirror,
+# since public PyPI (pypi.org) is blocked by the RBE VM's network firewall.
+# We dynamically fetch the GCE Service Account token from the GCE Metadata Server
+# to authenticate the request to the Artifact Registry repository.
+GCE_TOKEN=$(python3 -c 'import urllib.request, json; req = urllib.request.Request("http://169.254.169.254/computeMetadata/v1/instance/service-accounts/default/token", headers={"Metadata-Flavor": "Google"}); print(json.loads(urllib.request.urlopen(req).read().decode())["access_token"])')
+export PIP_INDEX_URL="https://oauth2accesstoken:${GCE_TOKEN}@us-python.pkg.dev/artifact-foundry-prod/ah-3p-staging-python/simple/"
+export CIBW_ENVIRONMENT="PIP_INDEX_URL=$PIP_INDEX_URL http_proxy=$http_proxy https_proxy=$https_proxy HTTP_PROXY=$HTTP_PROXY HTTPS_PROXY=$HTTPS_PROXY"
+
+# Enable extremely verbose logs for cibuildwheel.
+export CIBW_BUILD_VERBOSITY=3
+
 # Add trap cleanup for TMP_DIR as well
 trap 'echo "Cleaning up temporary directories: ${REPO_DIR} ${TMP_DIR}"; rm -rf "${REPO_DIR}" "${TMP_DIR}"' EXIT