fix(gcp): remove unsupported --include flags from gcloud storage rsync

[arniechops]

Summary

• gcloud storage rsync only supports --exclude (Python regex), not --include
• The --include flags caused model weight downloads to fail on GCP with: unrecognized arguments: --include=*.model
• Removed --include flags and kept only --exclude="optimizer.*" since all other files in the checkpoint bucket are needed

Test plan

• Deploy model-engine with this fix on GCP cluster
• Create an endpoint and verify vLLM container successfully downloads weights from GCS
• Verify optimizer files are still excluded

🤖 Generated with Claude Code

Greptile Summary

This PR fixes a GCP-specific bug where gcloud storage rsync was being called with --include flags that it doesn't support, causing model weight downloads to fail on GCP with unrecognized arguments: --include=*.model. The fix removes the unsupported --include flags and switches to --exclude-only patterns using Python regex syntax (as required by gcloud storage rsync). The trust_remote_code security boundary — which was lost in an earlier draft — has been restored here by adding --exclude=".*\.py$" when trust_remote_code=False, keeping behavior consistent with the Azure/S3 code paths.

Key changes:

• Removed all --include flags from the gcloud storage rsync invocation in load_model_weights_sub_commands_gcs
• Changed the optimizer exclusion from a glob (optimizer*) to a Python regex (optimizer.*)
• Added --exclude=".*\.py$" when trust_remote_code=False to prevent downloading Python code from untrusted checkpoints
• Added an explanatory comment clarifying why only --exclude is used

Confidence Score: 5/5

Safe to merge — fixes a clear crash-level bug with correct regex syntax and preserves the trust_remote_code security boundary

The change is minimal and targeted: it removes flags that were definitively unsupported by gcloud storage rsync, uses the correct --exclude-only approach with valid Python regex patterns, and restores the .py-file exclusion guard for untrusted checkpoints. No P1 or P0 issues found; the previous concern about trust_remote_code has been fully addressed in this revision.

No files require special attention

Important Files Changed

Filename	Overview
model-engine/model_engine_server/domain/use_cases/llm_model_endpoint_use_cases.py	Fixes unsupported --include flags in gcloud storage rsync by switching to --exclude-only patterns with correct Python regex syntax; restores trust_remote_code .py exclusion guard

Flowchart

%%{init: {'theme': 'neutral'}}%%
flowchart TD
    A[load_model_weights_sub_commands_gcs] --> B[Install gcloud CLI]
    B --> C[Build exclude filters]
    C --> D["Always: --exclude='optimizer.*'"]
    D --> E{trust_remote_code?}
    E -- False --> F["Add: --exclude='.*\\.py$'"]
    E -- True --> G[No additional excludes]
    F --> H[gcloud storage rsync -r with excludes]
    G --> H
    H --> I[Sync all other files from GCS checkpoint]

Loading

_{Reviews (2): Last reviewed commit: "fix(gcp): exclude .py files from gcloud ..." | Re-trigger Greptile}