gcp_auth(
*,
service_account_json: SandboxProxySecret,
scopes: Sequence[str] | None = Build a sandbox proxy rule that injects GCP OAuth bearer auth.
The sandbox proxy keeps the service account JSON outside the sandbox and
injects OAuth bearer tokens for built-in Google API host matching.
service_account_json must be supplied as a workspace_secret or
opaque value; plaintext service account JSON is intentionally not
supported.
Plaintext environment variables set for every command in the sandbox while this rule is enabled, for tools that refuse to run unless a credential variable is present even though the proxy injects the real credential on the wire.