Cloud Build Complete Guide: CI/CD, cloudbuild.yaml, Private Pool & GitHub Integration

Cloud Build is GCP's managed CI/CD service. You chain Docker-based Steps together to build any pipeline you need for build, test, and deploy. It integrates deeply with the rest of GCP — secure auth via Workload Identity and in-VPC builds via Private Pool are its standout features.

Core Concepts

• Build: a single pipeline execution
• Step: one stage of a build, run as a Docker image
• Trigger: the condition that kicks off a build (push / PR / Pub/Sub)
• Worker Pool: Default Pool or Private Pool
• Substitutions: build-time variables such as $PROJECT_ID and $BRANCH_NAME

cloudbuild.yaml Example

steps:
# 1. テスト
- name: 'node:20'
  entrypoint: 'npm'
  args: ['test']

# 2. Docker ビルド
- name: 'gcr.io/cloud-builders/docker'
  args: ['build', '-t', 'asia-northeast1-docker.pkg.dev/$PROJECT_ID/myrepo/app:$SHORT_SHA', '.']

# 3. Artifact Registry に push
- name: 'gcr.io/cloud-builders/docker'
  args: ['push', 'asia-northeast1-docker.pkg.dev/$PROJECT_ID/myrepo/app:$SHORT_SHA']

# 4. Cloud Run にデプロイ
- name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
  entrypoint: 'gcloud'
  args:
  - 'run'
  - 'deploy'
  - 'my-app'
  - '--image=asia-northeast1-docker.pkg.dev/$PROJECT_ID/myrepo/app:$SHORT_SHA'
  - '--region=asia-northeast1'

options:
  machineType: 'E2_HIGHCPU_8'
  logging: CLOUD_LOGGING_ONLY

timeout: '1200s'

Worker Pool Types

Pricing (Default Pool)

Security Best Practices

• Workload Identity Federation: auth between GitHub Actions and GCP without service account keys
• Binary Authorization: only signed images are allowed to deploy
• Cloud Build SLSA Level 3: build provenance and tamper detection
• Provenance: automatic build-time metadata generation
• Secret Manager integration: secure API key management
• Private Pool + VPC SC: isolation for sensitive builds

A Typical Pipeline

1. Push to GitHub
2. Cloud Build trigger fires
3. Run tests (lint / unit / integration)
4. Docker build + Cosign signing
5. Push to Artifact Registry
6. Binary Authorization verification
7. Send release to Cloud Deploy (Dev -> Staging -> Prod)
8. Approval + Canary rollout at each environment
9. SLO monitoring with Cloud Monitoring

Comparison with Other CI/CD Tools

* Google Cloud is a trademark of Google LLC. For the latest information, check the official Cloud Build documentation.