[26.1] Qualify GCP Batch network and subnet names with the project ID

[ksuderman]

The GCP Batch runner builds network interface paths as global/networks/{name} and regions/{region}/subnetworks/{name}. These relative paths resolve against the project the Batch VMs are provisioned in, which is not necessarily the project that owns the VPC (e.g. Terra pet projects). When the two differ, job submission fails with a 404 on the network resource.

The Fix

Bare network and subnet names are now qualified as projects/{project_id}/global/networks/{name} and projects/{project_id}/regions/{region}/subnetworks/{name} using the runner's project_id parameter. Values that already contain a / (full or relative resource paths) are passed through unchanged, so existing configurations keep working. The debug log now reports the fully qualified paths actually sent to the Batch API.

Testing

• All 144 existing runner unit tests pass: ./run_tests.sh -unit test/unit/app/jobs/test_gcp_batch_runner.py
• To verify manually: configure the runner with bare network/subnet names and a project_id whose VPC lives in a different project than the Batch VMs, submit a job, and confirm the network resolves instead of returning a 404.

How to test the changes?

(Select all options that apply)

• I've included appropriate automated tests.
• This is a refactoring of components with existing test coverage.
• Instructions for manual testing are as follows:
  1. [add testing steps and prerequisites here if you didn't write automated tests covering all your changes]

License

• I agree to license these and all my past contributions to the core galaxy codebase under the MIT license.

[jmchilton]

Claude-identified-codex-verified Codex comment: -John

This change looks mostly correct, and allowing already project-qualified network/subnet paths to pass through appears to address the cross-project/Shared VPC case.

Could you update the PR description and the comment above this code to clarify the mechanism? request.parent already creates the Batch job under params["project_id"], so changing a bare global/networks/X path to projects/{project_id}/global/networks/X selects the same project and is effectively a normalization. The behavior that enables a VPC owned by another project is passing through a configured path such as projects/{host_project}/global/networks/X.

Suggested code comment:

# Preserve project-qualified paths so jobs can use a network or subnet
# owned by another project, such as a Shared VPC host project. Normalize
# bare names against the Batch job's project.

I don’t think the implementation needs a larger redesign here, but correcting the explanation before merge would prevent the current rationale from becoming misleading documentation.