Continuous delivery with Cloud Build

This chapter follows Google Cloud Storage. Cloud Build executes steps—each step runs in a container with your source workspace mounted. It fits the broader CI/CD picture: compile, test, image, deploy on every merge.

The series uses the file-api-deployer service account from IAM in Google Cloud.

How Cloud Build runs a build

Cloud Build reads cloudbuild.yaml (or inline config), pulls builder images (gcr.io/cloud-builders/docker, gcloud, custom), and runs steps sequentially unless you define waitFor.

Each build gets a build service account (default Compute Engine SA or a custom SA). That identity must push to Artifact Registry and deploy Cloud Run.

Grant the deployer account to act as Cloud Build’s runtime (project-level):

1
PROJECT_NUMBER=$(gcloud projects describe YOUR_PROJECT_ID --format='value(projectNumber)')
2
CLOUD_BUILD_SA="${PROJECT_NUMBER}@cloudbuild.gserviceaccount.com"
3

4
gcloud projects add-iam-policy-binding YOUR_PROJECT_ID \
5
  --member="serviceAccount:${CLOUD_BUILD_SA}" \
6
  --role="roles/artifactregistry.writer"
7

8
gcloud projects add-iam-policy-binding YOUR_PROJECT_ID \
9
  --member="serviceAccount:${CLOUD_BUILD_SA}" \
10
  --role="roles/run.admin"
11

12
gcloud projects add-iam-policy-binding YOUR_PROJECT_ID \
13
  --member="serviceAccount:${CLOUD_BUILD_SA}" \
14
  --role="roles/iam.serviceAccountUser"

Alternatively set serviceAccount on the build to file-api-deployer@... and grant that account the same roles.

cloudbuild.yaml for the series

1
substitutions:
2
  _REGION: europe-west1
3
  _REPOSITORY: file-api
4
  _SERVICE: file-api
5
  _RUNTIME_SA: file-api-runtime@YOUR_PROJECT_ID.iam.gserviceaccount.com
6

7
steps:
8
  - name: gcr.io/cloud-builders/docker
9
    args:
10
      - build
11
      - -t
12
      - ${_REGION}-docker.pkg.dev/$PROJECT_ID/${_REPOSITORY}/app:$SHORT_SHA
13
      - .
14

15
  - name: gcr.io/cloud-builders/docker
16
    args:
17
      - push
18
      - ${_REGION}-docker.pkg.dev/$PROJECT_ID/${_REPOSITORY}/app:$SHORT_SHA
19

20
  - name: gcr.io/google.com/cloudsdktool/cloud-sdk
21
    entrypoint: gcloud
22
    args:
23
      - run
24
      - deploy
25
      - ${_SERVICE}
26
      - --image=${_REGION}-docker.pkg.dev/$PROJECT_ID/${_REPOSITORY}/app:$SHORT_SHA
27
      - --region=${_REGION}
28
      - --service-account=${_RUNTIME_SA}
29
      - --platform=managed
30
      - --quiet
31

32
images:
33
  - ${_REGION}-docker.pkg.dev/$PROJECT_ID/${_REPOSITORY}/app:$SHORT_SHA
34

35
options:
36
  logging: CLOUD_LOGGING_ONLY

Run manually from the repo root:

1
gcloud builds submit --config=cloudbuild.yaml .

$PROJECT_ID and $SHORT_SHA are built-in substitutions.

Substitutions and secrets

User-defined substitutions start with _ (for example _REGION). Override at submit time:

1
gcloud builds submit --config=cloudbuild.yaml \
2
  --substitutions=_REGION=europe-west1 .

Store sensitive values in Secret Manager and expose them to steps with availableSecrets—never commit API keys to cloudbuild.yaml.

Triggers and GitHub

Connect a repository in the Console (Cloud Build → Triggers) or with gcloud beta builds triggers create github. A push to main runs the same config as gcloud builds submit.

Use Workload Identity Federation for GitHub Actions instead of JSON keys when you outgrow native triggers—the IAM chapter outlines the pattern.

Logs, approvals, and failures

Build logs stream to Cloud Logging (logging: CLOUD_LOGGING_ONLY). Failed docker or gcloud steps exit non-zero and mark the build failed; fix IAM or image URLs first when push or deploy steps break.

Pin builder digests in regulated environments so builds do not pull moving tags unexpectedly.

Next: VPC networks in Google Cloud adds private networking and egress controls around Cloud Run.