And as for authentication: We basically rely on the developer having gcloud installed and having the right IAM permissions to do whatever he has to do. In CI we also use gcloud via a service account that we activate via

gcloud auth activate-service-account --project <project_of_service_account> --key-file=-