Is there a valid technical reason for Google to work like this?

Have you asked them to provide more standard authentication?

I have no idea what the technical reasons are for Google's implementation to be like this. I don't have a support contract with them (they start at US$200 a month), so I have no way of asking for them to do something different. The options for setting up a repository in their system looks like this:

Normally what they ask you to do is to install the Cloud SDK, which installs a credential helper in Git that presumably manages all of this for you. They also support mirroring from GitHub or BitBucket, but they do this with OAuth so it's specifically cloning from only these services.

That said, I'm pretty sure they're doing this so they don't have to implement SSH credential or HTTP basic authentication management for Git in their application, neither of which exist right now. And given that almost anyone interacting with their services has the Cloud SDK already installed, the way they're doing it probably works for 99% of their customers already.

The way that I tried was by changing the dropdown under "Push code from a local Git repository to your Cloud repository" to "Manually generated credentials", then I clicked on "Generate and store your Git credentials":

I hoped this would provide me with an SSH key, but instead after going through Google OAuth, I got this page:

which is where I got stuck since I can't configure a HTTP cookie file for Phabricator's mirroring.

I want to avoid implementing things in Phabricator just because there's a low barrier to entry to ask us and we're responsive -- over time, this tends to punish us for being responsive by cluttering our codebase with cruft to work around weird decisions that other companies are making in their products.

Generally, I think if a user is making a decision to use a particular product or technology like Google Cloud, it's on them to bear the costs of that technology selection. In this case, the cost of Google support was foreseeable when you selected that technology. I really don't want to position Phabricator as "Google Support (Free Version)".

There isn't really an alternative technology choice here however - not only does AWS not have an equivalent service integration of this functionality, but using AWS for this would require using EC2 for compute, which would drastically increase (e.g. double costs) elsewhere. Azure is a pile of junk in my experience, which is why I'm avoiding that service as well.

My only option here would be to mirror the repository to GitHub and then configure Google Cloud to mirror from that. But that involves pushing repositories that have sensitive credentials in them to a completely unnecessary third-party, and I really don't want to do that for obvious reasons.