Upload from GitHub Actions: unblock workflow: materialize gcloud creds on runner; lazy-init translate client

The nightly workflow has been silently failing since at least Dec 2025
because the eval pipeline depends on gcloud_credentials.json for the
Google Translate baseline but the file is gitignored and there was no
GHA secret/step to materialize it on the runner. Also, evals/models.py
called translate.Client() at module import time, so any import of the
module (including backend.py, smoke tests, any contributor without GCP
locally) blew up with DefaultCredentialsError.

.github/workflows/nightly-evals.yml
- Add a "Write Google Cloud credentials" step that decodes the
GCLOUD_CREDENTIALS_JSON secret into gcloud_credentials.json at
the repo root + validates the file parses as JSON (fail-fast).
- Set GOOGLE_APPLICATION_CREDENTIALS=gcloud_credentials.json in
the "Run evaluations" env so the google-auth lookup finds it.

evals/models.py
- Replace module-level `translate_client = translate.Client()` with
a lazy factory `_get_translate_client()` that defers instantiation
until first real translation call. Import-time is now tolerant of
missing creds; only the eval task that actually calls Google
Translate will trip the credentials check.

.github/workflows/nightly-evals.yml

@@ -23,11 +23,20 @@ jobs:
           curl -LsSf https://astral.sh/uv/install.sh | sh
           # Use the `dev` dependency group defined in pyproject.toml
           uv sync --frozen --group dev
-          
+
+      - name: Write Google Cloud credentials
+        env:
+          GCLOUD_CREDENTIALS_JSON: ${{ secrets.GCLOUD_CREDENTIALS_JSON }}
+        run: |
+          printf '%s' "$GCLOUD_CREDENTIALS_JSON" > gcloud_credentials.json
+          # Fail fast if the secret was empty/malformed.
+          python -c "import json; json.load(open('gcloud_credentials.json'))"
+
       - name: Run evaluations
         env:
           OPENROUTER_API_KEY: ${{ secrets.OPENROUTER_API_KEY }}
           HUGGINGFACE_ACCESS_TOKEN: ${{ secrets.HUGGINGFACE_ACCESS_TOKEN }}
+          GOOGLE_APPLICATION_CREDENTIALS: gcloud_credentials.json
           N_SENTENCES: 10
           # Keep these aligned with defaults in evals/main.py for comparability
           N_LANGUAGES: 1000

evals/models.py

@@ -306,17 +306,28 @@ async def complete(**kwargs) -> str | None:
     return response.choices[0].message.content.strip()
 
 
-translate_client = translate.Client()
+# Lazy-init: building translate.Client() at import time tries to read
+# GOOGLE_APPLICATION_CREDENTIALS and crashes the whole module if creds are
+# missing — even for callers that never translate (backend, smoke tests).
+# Defer until first use so import works without GCP creds.
+_translate_client = None
+
+
+def _get_translate_client():
+    global _translate_client
+    if _translate_client is None:
+        _translate_client = translate.Client()
+    return _translate_client
 
 
 def get_google_supported_languages():
-    return [l["language"] for l in translate_client.get_languages()]
+    return [l["language"] for l in _get_translate_client().get_languages()]
 
 
 @cache
 async def translate_google(text, source_language, target_language):
     async with google_rate_limit:
-        response = translate_client.translate(
+        response = _get_translate_client().translate(
             text, source_language=source_language, target_language=target_language
         )
     return response["translatedText"]