Real-world integration test: GCP Secret Manager

[smiggleworth]

Why

Every test for internal/gcp runs against a hand-written fake (fakeSecretManagerAPI) implementing a subset of *secretmanager.Client's method set. Nothing in this package has ever talked to real GCP Secret Manager. This is also the one provider with a documented correctness gap (no compare-and-swap on write) that's never been observed under real concurrent load.

What to verify against a real GCP project

Write path (SecretManager.WriteMany)

• Merge-and-add-version behavior against a real multi-key secret with existing sibling fields.
• First-write-to-a-missing-secret creates the secret with Replication_Automatic correctly, and confirm that's actually the right default replication policy to ship (vs. requiring the caller to configure regions) — this was a design choice made without a real GCP account to sanity-check it against.
• Deliberately reproduce the documented no-CAS race: two concurrent writers to the same secret, confirm the "later AddSecretVersion wins outright, silently drops the earlier writer's sibling keys" behavior described in the code comment actually happens as described (rather than, say, GCP enforcing some ordering guarantee that would make the caveat moot).
• Confirm the AlreadyExists-on-CreateSecret create-race fallback (re-read then merge) actually resolves correctly when two processes both try to create the same new secret simultaneously.

Rollback (SecretManager.Rollback)

• Fetch version N-1, AddSecretVersion it forward — confirm this actually behaves as documented against real secret version history, and that "latest" always resolves to the highest version number (the code assumes this; GCP's docs are the only source consulted so far).
• Correct InvalidState failure when only one version exists.

Error classification

• Confirm real gRPC status codes returned by Secret Manager for not-found / permission-denied / unauthenticated / failed-precondition actually map the way remoteError assumes (codes.NotFound, codes.PermissionDenied, codes.Unauthenticated, codes.FailedPrecondition) — written from API documentation, not observed responses.

Auth

• Application Default Credentials resolution (secretmanager.NewClient(ctx) with no explicit options) against a real service account key file, workload identity, and the gcloud auth application-default login flow.

Scope

Needs a real (disposable) GCP project with Secret Manager API enabled and a service account with roles/secretmanager.admin or equivalent.