fix: handle read-only .git files in deploy cleanup on Windows

On Windows, files inside `.git/objects/` are marked read-only by default. When `adk deploy` cleans up the temporary directory in its `finally` block, `shutil.rmtree()` raises `PermissionError: [WinError 5] Access denied` on these files, causing the CLI to crash even after a successful deployment.

This PR introduces a `_robust_rmtree()` helper that passes an error handler to `shutil.rmtree`. On Windows, the handler clears the read-only bit (`os.chmod(path, stat.S_IWRITE)`) and retries the deletion. On non-Windows platforms, `shutil.rmtree` is called without any handler. The fix uses `onexc` for Python >= 3.12 and `onerror` for Python < 3.12 to avoid deprecation warnings.

All six `shutil.rmtree()` call sites in `cli_deploy.py` (`to_cloud_run`, `to_agent_engine`, `to_gke`) are updated.

Fixes #4635

Merge #4719

PiperOrigin-RevId: 964392331

Author: weiguangli-io

src/google/adk/cli/cli_deploy.py

@@ -18,6 +18,7 @@
 import json
 import os
 import shutil
+import stat
 import subprocess
 import sys
 import traceback
@@ -42,6 +43,23 @@
 )
 
 
+def _on_rm_error(func: Callable[..., Any], path: str, exc_info: Any) -> None:
+  """Error handler for shutil.rmtree to handle read-only files on Windows."""
+  os.chmod(path, stat.S_IWRITE)
+  func(path)
+
+
+def _robust_rmtree(path: str) -> None:
+  """Remove a directory tree, handling read-only files on Windows."""
+  if _IS_WINDOWS:
+    if sys.version_info >= (3, 12):
+      shutil.rmtree(path, onexc=lambda fn, p, exc: _on_rm_error(fn, p, None))
+    else:
+      shutil.rmtree(path, onerror=_on_rm_error)
+  else:
+    shutil.rmtree(path)
+
+
 def _ensure_agent_engine_dependency(requirements_txt_path: str) -> None:
   """Ensures staged requirements include Agent Platform dependencies."""
   if not os.path.exists(requirements_txt_path):
@@ -717,7 +735,7 @@ def to_cloud_run(
   # remove temp_folder if exists
   if os.path.exists(temp_folder):
     click.echo('Removing existing files')
-    shutil.rmtree(temp_folder)
+    _robust_rmtree(temp_folder)
 
   try:
     # copy agent source code
@@ -839,7 +857,7 @@ def to_cloud_run(
     subprocess.run(gcloud_cmd, check=True)
   finally:
     click.echo(f'Cleaning up the temp folder: {temp_folder}')
-    shutil.rmtree(temp_folder)
+    _robust_rmtree(temp_folder)
 
 
 def _print_agent_engine_url(resource_name: str) -> None:
@@ -997,7 +1015,7 @@ def to_agent_engine(
   temp_folder_path = os.path.join(parent_folder, temp_folder)
   if os.path.exists(temp_folder_path):
     click.echo('Removing existing files')
-    shutil.rmtree(temp_folder_path)
+    _robust_rmtree(temp_folder_path)
 
   try:
     ignore_func = _get_ignore_patterns_func(agent_folder)
@@ -1308,7 +1326,7 @@ def create_dockerfile_for_agent_engine(resource_name: str) -> None:
     temp_folder_path = os.path.join(parent_folder, temp_folder)
     click.echo(f'Cleaning up the temp folder: {temp_folder_path}')
     os.chdir(original_cwd)
-    shutil.rmtree(temp_folder_path)
+    _robust_rmtree(temp_folder_path)
 
 
 def to_gke(
@@ -1387,7 +1405,7 @@ def to_gke(
   # remove temp_folder if exists
   if os.path.exists(temp_folder):
     click.echo('  - Removing existing temporary directory...')
-    shutil.rmtree(temp_folder)
+    _robust_rmtree(temp_folder)
 
   try:
     # copy agent source code
@@ -1558,7 +1576,7 @@ def to_gke(
   finally:
     click.secho('\nSTEP 5: Cleaning up...', bold=True)
     click.echo(f'  - Removing temporary directory: {temp_folder}')
-    shutil.rmtree(temp_folder)
+    _robust_rmtree(temp_folder)
   click.secho(
       '\n🎉 Deployment to GKE finished successfully!', fg='cyan', bold=True
   )

tests/unittests/cli/utils/test_cli_deploy.py

@@ -1164,3 +1164,45 @@ def test_to_agent_engine_extra_packages_requirements_txt_is_not_clobbered(
   assert (tmp_dir / "requirements.txt").read_text() == (
       "some-unrelated-package\n"
   )
+
+
+# _robust_rmtree / _on_rm_error tests
+
+
+class TestRobustRmtree:
+  """Tests for the _robust_rmtree helper."""
+
+  def test_removes_directory_tree(self, tmp_path: Path) -> None:
+    """It should remove a normal directory tree."""
+    d = tmp_path / "subdir"
+    d.mkdir()
+    (d / "file.txt").write_text("hello")
+    cli_deploy._robust_rmtree(str(d))
+    assert not d.exists()
+
+  def test_removes_readonly_files(self, tmp_path: Path) -> None:
+    """It should remove a tree containing read-only files."""
+    import os
+    import stat
+
+    d = tmp_path / "ro_dir"
+    d.mkdir()
+    ro_file = d / "readonly.txt"
+    ro_file.write_text("locked")
+    ro_file.chmod(stat.S_IREAD)
+    cli_deploy._robust_rmtree(str(d))
+    assert not d.exists()
+
+  def test_on_rm_error_clears_readonly_and_retries(
+      self, tmp_path: Path
+  ) -> None:
+    """_on_rm_error should chmod the file and call the removal function."""
+    import os
+    import stat
+
+    ro_file = tmp_path / "locked.txt"
+    ro_file.write_text("data")
+    ro_file.chmod(stat.S_IREAD)
+
+    cli_deploy._on_rm_error(os.remove, str(ro_file), None)
+    assert not ro_file.exists()