fix(auth): honor CLOUDSDK_CONFIG when locating the ADC well-known file

[heychs]

Thank you for opening a Pull Request! Before submitting your PR, there are a few things you can do to make sure it goes smoothly:

• Make sure to open an issue as a bug/issue before writing your code! That way we can discuss the change, evaluate designs, and agree on the general idea
• Ensure the tests and linter pass
• Code coverage does not decrease (if any source code was changed)
• Appropriate docs were updated (if necessary)

Fixes #8797 🦕

What

GoogleAuth._tryGetApplicationCredentialsFromWellKnownFile() (in
core/packages/google-auth-library-nodejs) now honors the CLOUDSDK_CONFIG
environment variable when locating the Application Default Credentials
well-known file, falling back to the existing platform-specific default
($HOME/.config/gcloud / %APPDATA%\gcloud) when it is not set.

Why

gcloud stores all of its configuration — including
application_default_credentials.json written by
gcloud auth application-default login — under $CLOUDSDK_CONFIG when that
variable is set. The ADC lookup previously hard-coded the platform default and
ignored CLOUDSDK_CONFIG, so ADC could not find user credentials in common
setups (containers, CI, custom or side-by-side gcloud configurations) and fell
through to GCE detection or threw Could not load the default credentials.

This aligns the Node.js library with:

• the Cloud SDK / ADC behavior and the other language auth libraries (Python,
  Go, Java), which all honor CLOUDSDK_CONFIG for the ADC well-known file; and
• this library's own getWellKnownCertificateConfigFileLocation() in
  src/util.ts, which already resolves the config directory as
  process.env.CLOUDSDK_CONFIG || <platform default>.

How

The method now resolves the gcloud config directory first (CLOUDSDK_CONFIG
taking precedence over the platform default), then joins
application_default_credentials.json. The output for the default,
non-CLOUDSDK_CONFIG case is unchanged, so existing behavior and tests are
preserved.

Affected versions

Environment: any OS, any supported Node.js version.

Present in google-auth-library 10.9.0 and all prior releases.
_tryGetApplicationCredentialsFromWellKnownFile() has resolved the well-known
file from the hard-coded platform default (%APPDATA% / $HOME/.config) since
the method was first introduced (initial commit, Feb 2015), so CLOUDSDK_CONFIG
has never been honored in this path. The omission became an internal
inconsistency once getWellKnownCertificateConfigFileLocation() in util.ts
started resolving CLOUDSDK_CONFIG first, which this PR brings into line.

Testing

• Added a unit test asserting the well-known file is read from
  $CLOUDSDK_CONFIG (taking precedence over the platform default) in
  test/test.googleauth.ts.
• npm run compile passes.
• npx mocha build/test/test.googleauth.js — all 188 tests pass, including the
  new one.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[gemini-code-assist]

Code Review

This pull request updates the _tryGetApplicationCredentialsFromWellKnownFile method in GoogleAuth to respect the CLOUDSDK_CONFIG environment variable, allowing it to override the platform-specific default location for the Cloud SDK config directory. A corresponding unit test has been added to verify this behavior. There are no review comments, and I have no feedback to provide.

[macastelaz]

Thanks!

[heychs]

Thanks!

My pleasure! Glad I could contribute :)