Consider supplying a hermetic gcloud command

[alexeagle]

In https://github.com/aspect-build/rules_aws one of our first tasks was to provide a hermetic bazel run @aws command so that we don't depend on what's on the users computer. Have you considered doing something similar to get the gcloud command?

[malt3]

We have plans for giving users a better experience when it comes to credential fetching that is more Bazel native and doesn’t require the gcloud tool. Expect something in the next weeks!

[malt3]

Just to follow up on this: we now have tweag-credential-helper as a fast, hermetic way to obtain Google (and other) credentials in Bazel.
I thought about providing gcloud, but doing this wouldn't help in this context, since --credential_helper must reference a workspace relative path, an absolute path or a binary in $PATH. It can never refer to a Bazel label. A credential helper also cannot invoke Bazel itself, since it is already running under Bazel.

I do think that a hermetic gcloud is still a nice idea, it just doesn't fit well into this ruleset.