fix(acs-ci): enable gsutil metadata credentials

[robbycochran]

The ACS CI nightly task configures the OpenShell google-cloud provider, which exposes the GCP service-account token through the GCE metadata path.

The Boto file previously configured only the OpenShell CA bundle, so standalone gsutil never enabled its metadata credential lookup and reported no configured credentials. Add [GoogleCompute] service_account=default to both the preflight and main workflows.

Validation:

• YAML parses for preflight, harness, and policy
• git diff --check

Summary by CodeRabbit

• New Features

  • CI workflows now support gsutil authentication through Google Compute metadata credentials.
  • Workflows use the default Google service account and OpenShell’s gateway-managed metadata path without placing credentials in the sandbox.

• Documentation

  • Updated OpenShell workflow documentation to describe the metadata-based Boto configuration.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 58caf4be-d26a-4c20-8c09-fababffacd46

📥 Commits

Reviewing files that changed from the base of the PR and between a5f7e1e and 550d146.

📒 Files selected for processing (3)

• tasks/acs-ci-nightly/openshell/README.md
• tasks/acs-ci-nightly/workflow/harness.yaml
• tasks/acs-ci-nightly/workflow/preflight.yaml

Included review availability: Your plan provides up to 12 included reviews per hour; 7 remain after this review.

---

Walkthrough

The preflight and harness Boto configurations now select the default Google Compute service account. The README documents metadata credential lookup through the gateway-managed path without storing credentials in the sandbox.

Changes

Boto metadata credentials

Layer / File(s)	Summary
Configure Boto metadata credentials tasks/acs-ci-nightly/workflow/preflight.yaml, tasks/acs-ci-nightly/workflow/harness.yaml, tasks/acs-ci-nightly/openshell/README.md	Both workflow configurations add [GoogleCompute] with service_account set to default. The README documents the metadata credential lookup path.

Priority: ⬇️ Low

Estimated code review effort: 1 (Trivial) | ~5 minutes

Change: Bug fix

Merge Risk: ⚪ Minimal · up to 550d1

The workflows consistently configure metadata credential lookup for gsutil, with no identified merge-blocking risk.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main change: enabling gsutil metadata credentials in the ACS CI workflows.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 0…
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Commit to this branch
• Create a new PR

---

_{Comment @coderabbitai help to get the list of available commands.}

[stackrox-openshell-workflow]

Using a fixed path in /tmp can be risky if the runner environment ever shares /tmp between concurrent executions. Consider writing this configuration to a path inside the working directory (e.g., /sandbox/boto.cfg) to ensure isolation.

[stackrox-openshell-workflow]

Using a fixed path in /tmp can be risky if the runner environment ever shares /tmp between concurrent executions. Consider writing this configuration to a path inside the working directory (e.g., /sandbox/boto.cfg) to ensure isolation.