In https://github.com/aspect-build/rules_aws one of our first tasks was to provide a hermetic bazel run @aws command so that we don't depend on what's on the users computer. Have you considered doing something similar to get the gcloud command?
We have plans for giving users a better experience when it comes to credential fetching that is more Bazel native and doesn’t require the gcloud tool. Expect something in the next weeks!
In https://github.com/aspect-build/rules_aws one of our first tasks was to provide a hermetic
bazel run @aws
command so that we don't depend on what's on the users computer. Have you considered doing something similar to get thegcloud
command?