feat: Add support for new GCP and Azure features [COMP-1463, COMP-1464]

[cristianrcv]

Summary GCP

Closes COMP-1463 — Make new platform features available via CLI.

• WIF credentials: --mode=workload-identity with --service-account-email, --workload-identity-provider, --token-audience options for Google credentials (PR #10346)
• Network tags: --network-tags (comma-separated) with --network / --subnetwork options and GCP format validation (PR #10416)
• Machine types: --head-job-machine-type (single) and --compute-jobs-machine-type (comma-separated, wildcard support), mutually exclusive with instance templates (PRs #10488, #10532)
• Boot disk image: --boot-disk-image with format validation for project paths, family paths, and batch short names (PR #10484)
• Fusion Snapshots: --fusion-snapshots toggle requiring --fusion-v2 (PR #10751)

All features include CLI-side validation matching backend/frontend rules.

Summary Azure

• Add Azure Entra (service principal) credentials support (tw credentials add azure-entra)
• Add managed identity options for head/pool client IDs and resource IDs in Forge and Manual Azure Batch CEs
• Add VNet/subnet support (--subnet-id) for private network isolation
• Add dual pool mode (--dual-pool) with separate head and worker pool configuration for Forge, and --worker-pool for Manual mode
• Add job max wall clock time (--job-max-wall-clock-time)
• Replace JobCleanupPolicy enum with 3 boolean toggles: --delete-jobs-on-completion, --delete-tasks-on-completion, --terminate-jobs-on-completion

Note: Requires tower-java-sdk bump to >= 1.133.0 for new model fields. Code will not compile until the SDK is updated.

Platform PRs implemented

• #10519 — Entra credentials for Azure Batch Forge and Fusion v2
• #10577 — Separate Azure managed identities for head and compute jobs
• #10541 — Private VNet/subnet support for Azure Batch CEs
• #10636 — Separate head and worker pools for Azure Batch
• #10708 — jobMaxWallClockTime for Azure Batch CEs
• #10681 — Replace JobCleanupPolicy enum with boolean toggles

[jonmarti]

GCP QA Test Results (2026-04-15)

Target: api.cloud.dev-seqera.io (24.2.0-auth0-RC1) | Workspace: unified-compute / new-ce-forms | CLI: 0.25.0 (branch feat/COMP-1464-add-support-for-new-gcp-and-azure-features)

WIF Credentials

#	Test	Expected	Result	Error Message
1	Create WIF credential (basic)	Success	PASS	—
2	Create WIF credential (with --token-audience)	Success	PASS	—
3	WIF missing --service-account-email	Fail	PASS	Option '--service-account-email' is required when using '--mode=workload-identity'.
4	WIF missing --workload-identity-provider	Fail	PASS	Option '--workload-identity-provider' is required when using '--mode=workload-identity'.
5	WIF invalid email format	Fail	PASS	Invalid service account email format. Expected format: <name>@<project>.iam.gserviceaccount.com
6	WIF invalid provider format	Fail	PASS	Invalid Workload Identity Provider format. Expected: projects/{PROJECT_NUMBER}/locations/global/workloadIdentityPools/{POOL}/providers/{PROVIDER}
7	WIF mode with --key (mutually exclusive)	Fail	PASS	Option '--key' cannot be used with '--mode=workload-identity'. Workload Identity mode uses federated authentication without a key file.
8	SA key mode with WIF options	Fail	PASS	Options '--service-account-email', '--workload-identity-provider', and '--token-audience' can only be used with '--mode=workload-identity'.
9	Invalid --mode value	Fail	PASS	Invalid Google credential mode 'invalid-mode'. Allowed values: 'service-account-key', 'workload-identity'.
10	Default SA key mode without --key	Fail	PASS	Option '--key' is required when using service account key mode.

Google Batch Compute Environment

#	Test	Expected	Result	Error Message
11	Network tags without --network	Fail	PASS	Network tags require VPC configuration: set the '--network' option to use network tags.
12	Invalid network tag (uppercase)	Fail	PASS	Invalid network tag 'InvalidTag': must start with a lowercase letter, end with a letter or number, and contain only lowercase letters, numbers, and hyphens.
13	Invalid network tag (trailing hyphen)	Fail	PASS	Invalid network tag 'bad-tag-': must start with a lowercase letter, end with a letter or number, and contain only lowercase letters, numbers, and hyphens.
14	Wildcard on head job machine type	Fail	PASS	Wildcard machine type families are not supported for the head job -- select a specific machine type instead.
15	Head machine type + template (mutually exclusive)	Fail	PASS	Head job machine type and head job instance template are mutually exclusive -- specify only one.
16	Compute machine type + template (mutually exclusive)	Fail	PASS	Compute jobs machine type and compute jobs instance template are mutually exclusive -- specify only one.
17	Invalid boot disk image format	Fail	PASS	Invalid boot disk image format. Use projects/{PROJECT}/global/images/{IMAGE}, projects/{PROJECT}/global/images/family/{FAMILY}, or a Batch image name (e.g., batch-debian).
18	Fusion snapshots without --fusion-v2	Fail	PASS	Fusion Snapshots requires Fusion v2 to be enabled (--fusion-v2).
19	Full CE: network + machine types + boot image	Success	PASS	—
20	Full CE: fusion-v2 + snapshots + wave	Success	PASS	—

Bug Fix

During QA, validation errors were printing full Java stack traces instead of clean error messages. Fixed in 6b4db1f by replacing IllegalArgumentException with TowerRuntimeException in GoogleProvider, GoogleBatchPlatform,
and AwsProvider. Tests 3-5 were re-run to confirm clean output.