docs: document automatic gcloud sign-in during GCP provider setup - #442
docs: document automatic gcloud sign-in during GCP provider setup#442hongyi-chen wants to merge 2 commits into
Conversation
The GCP section only described the ADC environment variables, which do not give gcloud an active account. Oz also runs a best-effort gcloud auth login against the federated credential file. Verified against app/src/ai/agent_sdk/driver/cloud_provider/gcp.rs. Co-Authored-By: Oz <oz-agent@warp.dev>
hongyi-chen
added
the
documentation
Warp Agent Staging
|
The latest updates on your projects. Learn more about Vercel for GitHub.
|
|
I'm starting a first review of this pull request. You can view the conversation on Warp. I completed the review and no human review was requested for this pull request. Comment Powered by Oz |
![oz-for-oss[bot]](https://avatars.githubusercontent.com/in/3450139?s=60&v=4){kind=small}
There was a problem hiding this comment.
Overview
This docs-only PR adds a focused GCP subsection explaining Oz's best-effort automatic gcloud sign-in when Workload Identity Federation is configured. The added content matches the provided implementation context, fits the surrounding page structure, and does not introduce broken links or security concerns.
Concerns
- No blocking concerns found.
Verdict
Found: 0 critical, 0 important, 0 suggestions
Approve
Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).
Powered by Oz
2 participants
Summary
When a cloud agent environment has GCP Workload Identity Federation configured, Oz now also signs
gcloudin against the federated credential file, sogcloudreports an active account. The cloud providers page only described the ADC environment variables, which don't givegcloudan active account on their own.Found by the
missing_docsdrift-watch audit (changelog item #14132) and verified againstapp/src/ai/agent_sdk/driver/cloud_provider/gcp.rs.Changes
src/content/docs/platform/integrations/cloud-providers.mdxgcloudsign-in subsection to the GCP section explaining why the extragcloud auth loginstep exists on top of the ADC environment variables.gcloudbinary is skipped, and a failure or timeout is logged without failing the run, because the ADC variables still supply credentials to the Google SDKs.gcloud auth listas the way to confirm the account from inside a run.Source verification
GcpCloudProvider::setupinapp/src/ai/agent_sdk/driver/cloud_provider/gcp.rsrunsgcloud --quiet auth login --force --cred-file <path>and handles everyBestEffortOutcomevariant (Success,NonZeroExit,NotFound,SpawnFailed,Timeout) by logging and returningOk(()). The inline comment states the reason directly: the ADC env vars are enough for the SDKs, butgcloudneeds an explicitauth loginbefore it reports an active account.Verification
npm run buildpasses.Deferred findings from this audit run
None specific to this page. Run-wide deferrals are listed in the companion audit-bookkeeping PR.
Conversation: https://staging.warp.dev/conversation/53c4f3f8-39bb-46c1-a5c0-66b467db0439
Run: https://oz.staging.warp.dev/runs/019fb91e-74a0-73f4-ac72-f2d88c32fab5
This PR was generated with Oz.
Co-Authored-By: Oz oz-agent@warp.dev