fix(gcp): set HOME so the CD uses the providers baked into its image

[defangdevs]

The bug

Cloud Build replaces a build step's HOME. The GCP CD image sets ENV HOME=/root and ships its Pulumi plugins in /root/.pulumi/plugins, but that env is overridden, so Pulumi looks somewhere else, finds no plugins, and downloads them at deploy time instead.

Verified against real Cloud Builds running the CD image, same image both times:

step env	pulumi plugin ls
Cloud Build default	TOTAL plugin cache size: 0 B
HOME=/root	369 MB — defang-gcp, gcp 9.34.1

The Pulumi state confirms where the provider came from instead:

urn:pulumi:beta::cdtest-cli::pulumi:providers:defang-gcp::default_github_/api.github.com/DefangLabs/pulumi-defang

That is the pluginDownloadURL the generated SDK carries (sdk/v2/go/defang-gcp/internal/pulumiUtilities.go), which resolves to the latest GitHub release.

Why it matters

• Every GCP deploy re-downloads ~370 MB of providers and depends on github.com and the Pulumi CDN being reachable, while the copy baked into the image goes unused. In a restricted customer network it fails outright.
• DEFANG_CD_IMAGE pins only the cd binary. The provider floats to whatever was released last, so a deployment pinned to an older CD image silently runs newer provider code. That is a reproducibility hole in the part of the system we tell people to pin.
• It makes a custom CD image untestable, which is how this surfaced: a CD image built from a provider branch deployed released code instead, and the only visible symptom was resources named by the old code.

The fix

Set HOME=/root in the Cloud Build step env, alongside the other CD variables.

Testing

TestRunCdCommandSetsHome captures the submitted build steps through the existing gcpDriver interface and asserts the env pins HOME. It fails on main and passes with the fix.

make lint clean for the changed files (the gosec hits in byoc/aws are pre-existing on main), go test -short ./... green.

Scope

GCP only. AWS runs its CD as a CodeBuild project and Azure as a container instance; neither goes through this path, and I have not checked whether they have an equivalent problem.

Summary by CodeRabbit

• Bug Fixes

  • Improved Google Cloud deployment commands to use the bundled provider plugins, avoiding unnecessary plugin downloads and helping deployments run more reliably.

• Tests

  • Added coverage to verify the deployment environment is configured correctly.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: 35bb518a-337d-4d34-9b5d-e0a57b1df827

📥 Commits

Reviewing files that changed from the base of the PR and between bd55787 and 31511fd.

📒 Files selected for processing (2)

• src/pkg/cli/client/byoc/gcp/byoc.go
• src/pkg/cli/client/byoc/gcp/byoc_test.go

Included review availability: 4 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 5 reviews per hour.

---

📝 Walkthrough

Walkthrough

The GCP CD command sets HOME=/root in the Cloud Build environment. A regression test captures the generated steps and verifies this setting.

Changes

GCP CD environment

Layer / File(s)	Summary
Configure and validate Cloud Build HOME src/pkg/cli/client/byoc/gcp/byoc.go, src/pkg/cli/client/byoc/gcp/byoc_test.go	The CD Cloud Build step sets HOME=/root. The test captures the submitted steps and verifies the setting.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 31511

This change sets the expected HOME directory for GCP deployments so the image-baked providers are used; no actionable merge-blocking risk remains after normal checks and review.

Suggested reviewers: lionello

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 50.00% which is insufficient. The required threshold is 80.00%. Docstring coverage is scoped to functions touched by this diff. Analyzed 2 functions across 2 files.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main GCP fix: setting HOME so the CD uses providers bundled in its image.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches 💡 1

📝 Generate docstrings 💡

• Create stacked PR
• Commit on current branch

---

_{Comment @coderabbitai help to get the list of available commands.}