Add Terraform and GCP tooling to the agent-dev image (APP-4957)

[warp-agent-staging]

Summary

Extends docker/agent-dev/Dockerfile so the development image supports SSH/network diagnostics, the Google Cloud CLI and GKE auth plugin, and Terraform managed by tfenv. Mirrors the already-merged warp-agent-docker PR #173.

Changes to docker/agent-dev/Dockerfile:

• Add openssh-client, netcat-openbsd, and lsof to the existing apt-get install block (the gnupg2 and unzip prerequisites are retained).
• Add the Google Cloud SDK apt source with a dearmored keyring (signed-by=/usr/share/keyrings/cloud.google.gpg); install google-cloud-cli and google-cloud-cli-gke-gcloud-auth-plugin; clean apt lists and run gke-gcloud-auth-plugin --version during the build.
• Set TFENV_ROOT=/usr/local/tfenv and add /usr/local/tfenv/bin to PATH; clone tfenv at tag v3.2.2, install and select Terraform 1.15.5, and run terraform version.
• Update the package-set comment so it no longer claims gcloud is omitted.

The committed spec is at .agents/specs/APP-4957-terraform-tooling-packages.md.

Verification

Testing-exempt category: config-only / infrastructure-as-code (Dockerfile) change with no testable application logic, so no Rust regression test is required (per the spec's criterion 6).

Checks run in this environment:

• Shell-syntax validation (sh -n and bash -n) on all three changed RUN blocks (apt, Google Cloud SDK, tfenv) — all pass.
• Content sanity check confirming each new package appears exactly once, gnupg2/unzip retained, the signed-by keyring, both GCP packages, rm -rf /var/lib/apt/lists/*, the gke-gcloud-auth-plugin --version and terraform version build-time checks, TFENV_ROOT=/usr/local/tfenv, /usr/local/tfenv/bin on PATH, tfenv pinned to v3.2.2, and Terraform 1.15.5.

Not run here (toolchain unavailable in this sandbox): the full docker build -f docker/agent-dev/Dockerfile -t warp-agent-dev:app-4957 . (spec criterion 4) and the runtime container command/version checks for ssh, nc, lsof, gcloud, gke-gcloud-auth-plugin, tfenv, and terraform (spec criterion 5) — docker and hadolint are not installed in this environment. These remain outstanding for a human to run where Docker is available; the change is otherwise unverified beyond the shell-syntax and content checks above.

Originating thread: https://warpdotdev.slack.com/archives/C0BDQDW8V5E/p1784725281506999
Co-Authored-By: Oz oz-agent@warp.dev

Conversation: https://staging.warp.dev/conversation/2df78ef6-b464-49fb-ace3-f5f9462f05c7
Run: https://oz.staging.warp.dev/runs/019f942e-86ad-77f1-9cff-17419f5295cf

This PR was generated with Oz.

[oz-for-oss]

@warp-dev-github-integration[bot]

I'm starting a first review of this pull request.

You can view the conversation on Warp.

I completed the review and no human review was requested for this pull request.

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz

[oz-for-oss]

Overview

This PR extends docker/agent-dev/Dockerfile with SSH/network diagnostics, Google Cloud/GKE tooling, and Terraform via tfenv, plus a checked-in validation spec for the image change.

Concerns

• The new spec says the Docker build and runtime command/version checks must pass before merge, but the PR description says those checks were not run. Because these are the only end-to-end validation for the new external apt repository, GCP packages, and tfenv/Terraform install path, they should be completed before merging.

Verdict

Found: 0 critical, 1 important, 0 suggestions

Request changes

Comment /oz-review on this pull request to retrigger a review (up to 3 times on the same pull request).

Powered by Oz

[oz-for-oss]

⚠️ [IMPORTANT] The PR description says the Docker build and runtime command checks were not run. Since these are listed as must-pass criteria and are the only end-to-end coverage for the new apt source, GCP packages, and tfenv/Terraform install, run them before merge or move them out of the must-pass list.

[warp-agent-staging]

Overview

Extends docker/agent-dev/Dockerfile with openssh-client/netcat-openbsd/lsof, the Google Cloud SDK apt repo plus google-cloud-cli and the GKE auth plugin, and Terraform managed by tfenv (pinned to v3.2.2 / Terraform 1.15.5), mirroring the already-merged warp-agent-docker PR #173. The change is correct, idiomatic, and secure (signed-by keyring, pinned versions, apt-list cleanup, build-time version checks), and is correctly a headless/config-only, testing-exempt change — no Rust regression test or visual proof is required.

Concerns

• Docker build not run (outstanding from prior review, toolchain unavailable). The spec lists the docker build (criterion 4) and runtime terraform/gcloud version checks (criterion 5) as must-pass before merge, and the PR description confirms neither was run. There is no Docker build CI job on this PR, and Docker/podman/hadolint are unavailable in this review sandbox too, so I could not run them either. The code-level checks I could perform all pass: shell syntax of the changed RUN blocks, the secure signed-by keyring pattern, apt-list cleanup, prerequisite packages (curl/git/unzip/gnupg2) already present, and the pinned upstream artifacts all exist (Terraform 1.15.5 and tfenv v3.2.2 releases resolve, Google apt-key.gpg URL reachable). Because the docker build is the only end-to-end coverage for the new external apt source and install path and cannot be exercised here, it must be run where Docker is available before merge. This is a human-owned pre-merge gate, not a rework item for implementation — the toolchain is equally unavailable to the implementation path — so it does not block this review's verdict.

Verdict

Prior concerns still outstanding: docker build + runtime version checks (criterion 4-5) not run — carried forward, disclosed as a pre-merge gate.

Found: 0 critical, 0 important, 1 suggestion

Approve

Review run

https://oz.staging.warp.dev/runs/019f9438-4ca9-73f4-ac07-e110d716adfa

[warp-agent-staging]

🧹 [NIT] This comment talks about "the version pinned in our repo," but there is no .terraform-version file in this repo — the version is hardcoded on line 106 (tfenv install 1.15.5). Tighten the wording so the maintenance guidance matches reality; tfenv will honor a .terraform-version pin if one is added later.

Suggested change

	# Install Terraform via tfenv. We preinstall the currently-pinned version, but
	# if the version pinned in our repo changes, it will get reinstalled on demand.
	# We should keep this up-to-date to avoid unnecessary reinstalls.
	#
	# tfenv itself is pinned to release tag v3.2.2 for build reproducibility.
	# Install Terraform via tfenv. The version is hardcoded below (no
	# `.terraform-version` pin exists in this repo today); tfenv will honor
	# such a pin if one is added later and reinstall on demand. Keep the
	# hardcoded version in sync with any future pin to avoid reinstalls.
	#
	# tfenv itself is pinned to release tag v3.2.2 for build reproducibility.