hosting-cli(gcp): add --service-account flag

[Kastier1]

Summary

• Adds --service-account to reflex deploy --gcp. When set, the value is forwarded as CLOUD_RUN_SERVICE_ACCOUNT env var to the deploy script, which appends --service-account=<value> to gcloud run deploy.
• Today, Cloud Run services deployed via this command run as the project's default compute SA (broad permissions; security antipattern for prod). This lets users pin a least-privilege per-service SA.
• When --service-account is omitted, the env var is not included in env_overrides and the deploy script falls back to the existing default-compute-SA behavior — fully backwards compatible.
• --help calls out that the deploying principal needs roles/iam.serviceAccountUser on the target SA, since the gcloud 403 otherwise is cryptic.

Requires the matching backend change so the deploy script honors CLOUD_RUN_SERVICE_ACCOUNT: reflex-dev/flexgen#3746

Test plan

• `pytest tests/units/reflex_cli/v2/test_gcp.py` — 25 passed (2 new tests: `test_gcp_deploy_forwards_service_account`, `test_gcp_deploy_omits_service_account_when_unset`)
• After the flexgen PR merges, smoke-test `reflex deploy --gcp --service-account my-sa@my-project.iam.gserviceaccount.com ...` and confirm the deployed service runs as the specified SA in the Cloud Run console.

🤖 Generated with Claude Code

[greptile-apps]

Greptile Summary

This PR adds a --service-account flag to reflex deploy --gcp, forwarding the value as CLOUD_RUN_SERVICE_ACCOUNT to the deploy script so Cloud Run services can run as a least-privilege per-service SA instead of the project's default compute SA. The change is backwards-compatible — omitting the flag preserves existing behaviour.

• New ENV_SERVICE_ACCOUNT constant, click option, and parameter wired into deploy_env with a conditional guard; the backend script change to consume CLOUD_RUN_SERVICE_ACCOUNT is tracked separately.
• Two new unit tests cover the forwarding path and the key-absent path; both follow the established fixture pattern in the test file.

Confidence Score: 4/5

Safe to merge on the CLI side; the only behavioral edge case is silent no-op for an empty-string argument, which would confuse users but cause no data loss.

The implementation is small, additive, and well-tested. The single concern is that if service_account: silently ignores --service-account "" rather than warning the user, which could produce confusing behaviour in the field.

packages/reflex-hosting-cli/src/reflex_cli/v2/gcp.py — specifically the conditional guard around service_account injection

Important Files Changed

Filename	Overview
packages/reflex-hosting-cli/src/reflex_cli/v2/gcp.py	Adds --service-account flag: new ENV_SERVICE_ACCOUNT constant, click option, function parameter, and conditional env injection. The if service_account: check silently drops an empty-string argument instead of warning the user.
tests/units/reflex_cli/v2/test_gcp.py	Adds two well-scoped tests: one verifying the SA is forwarded in env_overrides when provided, one verifying the key is absent when omitted. Both follow the established test pattern.

_{Reviews (1): Last reviewed commit: "hosting-cli(gcp): add --service-account ..." | Re-trigger Greptile}

[greptile-apps]

If a user passes --service-account "" (an explicit empty string), the falsy check silently skips the injection and falls back to the default compute SA with no warning. The user gets no indication their flag was ignored. Using is not None is more precise here — it fires only for the truly-absent case and preserves the semantics of an explicit (even if invalid) user input triggering either a forward or an early error.

Suggested change

	if service_account:
	deploy_env[ENV_SERVICE_ACCOUNT] = service_account
	if service_account is not None:
	if not service_account:
	console.error("--service-account cannot be an empty string.")
	raise click.exceptions.Exit(2)
	deploy_env[ENV_SERVICE_ACCOUNT] = service_account

[masenf]

for this one, i agree. a common case would be passing --service-account "$MY_SERVICE_ACCOUNT" in some CI job, and not realizing that the CI environment isn't defining MY_SERVICE_ACCOUNT`, so it's getting passed as empty string and resolving to the original behavior, despite user intent.

[codspeed-hq]

Merging this PR will not alter performance

✅ 24 untouched benchmarks

---

_{Comparing simon/gcp-cloud-run-service-account (2fe82e0) with main (d611a5d)}