CTM-655 Fix CI issues with gcloud CLI

docs/backends/GCPBatch.md

@@ -341,13 +341,14 @@ network labels, and then fall back to running on the default network.
 
 ### Custom Google Cloud SDK container
 
-Cromwell can't use Google's container registry if VPC Perimeter is used in project.
-Own repository can be used by adding `cloud-sdk-image-url` reference to used container:
+Cromwell uses `cloud-sdk:alpine` by default. If you require a static Cloud SDK version, set a custom value like `cloud-sdk:584.0.0-alpine` for `cloud-sdk-image-url`. Note that GCP [deletes tags after 1 year](https://github.com/GoogleCloudPlatform/cloud-sdk-docker#package-retention-policy), so any custom tag requires recurring updates.
+
+Cromwell can't use Google's container registry if VPC Perimeter is used in project. Work around by re-hosting within the project and setting `cloud-sdk-image-url`.
 
 ```
 google {
   ...
-  cloud-sdk-image-url = "eu.gcr.io/your-project-id/cloudsdktool/cloud-sdk:354.0.0-alpine"
+  cloud-sdk-image-url = "gcr.io/google.com/cloudsdktool/cloud-sdk:alpine"
   cloud-sdk-image-size-gb = 1
 }
 ```

supportedBackends/google/batch/src/main/scala/cromwell/backend/google/batch/runnable/CheckpointingRunnable.scala

@@ -12,7 +12,7 @@ trait CheckpointingRunnable {
           createParameters.checkpointingConfiguration.checkpointingCommand(checkpointFilename,
                                                                            RunnableCommands.multiLineBinBashCommand
           )
-        val checkpointingEnvironment = Map.empty[String, String]
+        val checkpointingEnvironment = RunnableUtils.CloudSdkEnvironment
 
         // Initial sync from cloud:
         val initialCheckpointSyncRunnable = RunnableBuilder.cloudSdkShellRunnable(

supportedBackends/google/batch/src/main/scala/cromwell/backend/google/batch/runnable/Delocalization.scala

@@ -35,6 +35,7 @@ trait Delocalization {
 
     RunnableBuilder
       .withImage(womOutputRuntimeExtractor.dockerImage.getOrElse(CloudSdkImage))
+      .withEnvironment(CloudSdkEnvironment)
       .withCommand(commands: _*)
       .withEntrypointCommand("/bin/bash")
       .withLabels(Map(Key.Tag -> Value.Delocalization))

supportedBackends/google/batch/src/main/scala/cromwell/backend/google/batch/runnable/RunnableBuilder.scala

@@ -235,7 +235,8 @@ object RunnableBuilder extends BatchUtilityConversions {
       timeout = 30.minutes
     )
 
-  def cloudSdkRunnable: Runnable.Builder = Runnable.newBuilder.setContainer(cloudSdkContainerBuilder)
+  def cloudSdkRunnable: Runnable.Builder =
+    Runnable.newBuilder.setContainer(cloudSdkContainerBuilder).withEnvironment(CloudSdkEnvironment)
 
   // Set a default timeout of 24 hours for these runnables. They are typically used for running
   // localization, delocalization, small shell commands, etc. These processes occasionally hang and
@@ -247,6 +248,7 @@ object RunnableBuilder extends BatchUtilityConversions {
   ): Runnable.Builder =
     Runnable.newBuilder
       .setContainer(cloudSdkContainerBuilder)
+      .withEnvironment(CloudSdkEnvironment)
       .withVolumes(volumes)
       .withLabels(labels)
       .withEntrypointCommand(

supportedBackends/google/batch/src/main/scala/cromwell/backend/google/batch/runnable/RunnableUtils.scala

@@ -16,7 +16,13 @@ object RunnableUtils {
     * http://gcr.io/google.com/cloudsdktool/cloud-sdk
     */
   val CloudSdkImage: String =
-    config.getOrElse("cloud-sdk-image-url", "gcr.io/google.com/cloudsdktool/cloud-sdk:461.0.0-alpine")
+    config.getOrElse("cloud-sdk-image-url", "gcr.io/google.com/cloudsdktool/cloud-sdk:alpine")
+
+  /**
+   * Batch sets a `CLOUDSDK_PYTHON` value that is incorrect for some images.
+   * Erase it so that Cloud SDK self-discovers the right Python within its image.
+   */
+  val CloudSdkEnvironment: Map[String, String] = Map("CLOUDSDK_PYTHON" -> "")
 
   /** Quotes a string such that it's compatible as a string argument in the shell. */
   def shellEscaped(any: Any): String = {