code: def test_publish_cloudrun_plugin_secrets(
      mock_call, mock_output, mock_which, tmp_path_factory
  ):
      mock_which.return_value = True
      mock_output.return_value = "myproject"
  
      runner = CliRunner()
      os.chdir(tmp_path_factory.mktemp("runner"))
      with open("test.db", "w") as fp:
          fp.write("data")
      with open("metadata.yml", "w") as fp:
          fp.write(
              textwrap.dedent(
                  """
              title: Hello from metadata YAML
              plugins:
                datasette-auth-github:
                  foo: bar
              """
              ).strip()
          )
      result = runner.invoke(
          cli.cli,
          [
              "publish",
              "cloudrun",
              "test.db",
              "--metadata",
              "metadata.yml",
              "--service",
              "datasette",
              "--plugin-secret",
              "datasette-auth-github",
              "client_id",
              "x-client-id",
              "--show-files",
              "--secret",
              "x-secret",
          ],
      )
      assert result.exit_code == 0
      dockerfile = (
          result.output.split("==== Dockerfile ====\n")[1]
          .split("\n====================\n")[0]
          .strip()
      )
      expected = textwrap.dedent(
          r"""
      FROM python:3.11.0-slim-bullseye
      COPY . /app
      WORKDIR /app
  
      ENV DATASETTE_AUTH_GITHUB_CLIENT_ID 'x-client-id'
      ENV DATASETTE_SECRET 'x-secret'
      RUN pip install -U datasette
      RUN datasette inspect test.db --inspect-file inspect-data.json
      ENV PORT 8001
      EXPOSE 8001
      CMD datasette serve --host 0.0.0.0 -i test.db --cors --inspect-file inspect-data.json --metadata metadata.json --setting force_https_urls on --port $PORT"""
      ).strip()
      assert expected == dockerfile
      metadata = (
          result.output.split("=== metadata.json ===\n")[1]
          .split("\n==== Dockerfile ====\n")[0]
          .strip()
      )
      assert {
          "title": "Hello from metadata YAML",
          "plugins": {
              "datasette-auth-github": {
                  "client_id": {
                      "$env": "DATASETTE_AUTH_GITHUB_CLIENT_ID"
                  },
                  "foo": "bar",
              },
          },
      } == json.loads(metadata)
  
file_path: datasette/tests/test_publish_cloudrun.py
imports: from click.testing import CliRunner
  from datasette import cli
  from unittest import mock
  import json
  import os
  import pytest
  import textwrap
label_desc: Use image node_id 6 for calling a global function with example usage: test_publish_cloudrun_plugin_secrets(mock_call, mock_output, mock_which, tmp_path_factory) without return types