TopolearnA managed build that pushes to Artifact Registry and deploys to Cloud Run without any CI servers to run.
Cloud Build runs a sequence of steps, each a container image with arguments, in a shared /workspace holding your source. A step can be any image: gcr.io/cloud-builders/docker, the Cloud SDK image, node, python, your own test image.
The config file (cloudbuild.yaml) lists steps, plus options:
- Substitutions: built-ins like
$PROJECT_ID,$BUILD_ID, and for Git-triggered builds$COMMIT_SHA,$SHORT_SHA,$BRANCH_NAME. Your own must start with an underscore (_REGION). waitForto run steps in parallel;timeout;machineTypefor bigger workers.imageslists images to push and record in the build's provenance.
Start builds manually with gcloud builds submit (uploads the current directory), or create triggers that run on pushes or pull requests from GitHub, GitLab or Bitbucket via a repository connection.
Builds run as a service account; specify a dedicated one rather than relying on defaults. Grant it exactly what the pipeline needs: Artifact Registry Writer, Cloud Run Developer, and Service Account User on the runtime service account it deploys. With a custom service account you must also set a logs destination, e.g. options.logging: CLOUD_LOGGING_ONLY.
For private networks, private pools run builds on workers peered into your VPC.
Example
# cloudbuild.yaml (run by a trigger on pushes to main)
steps:
- id: test
name: python:3.13-slim
entrypoint: bash
args: ['-c', 'pip install -r requirements.txt && python -m pytest -q']
- id: build
name: gcr.io/cloud-builders/docker
args: ['build', '-t', '${_REPO}/orders-api:$SHORT_SHA', '.']
- id: push
name: gcr.io/cloud-builders/docker
args: ['push', '${_REPO}/orders-api:$SHORT_SHA']
- id: deploy
name: gcr.io/google.com/cloudsdktool/cloud-sdk:slim
entrypoint: gcloud
args: ['run', 'deploy', 'orders-api', '--image=${_REPO}/orders-api:$SHORT_SHA', '--region=europe-west1']
substitutions:
_REPO: europe-west1-docker.pkg.dev/shop-dev-4821/apps
options:
logging: CLOUD_LOGGING_ONLYRemember
- A build is a list of container steps sharing /workspace
- User substitutions start with _; commit variables come from triggers
- Run builds as a dedicated, least-privilege service account
Watch out for
- Giving the build service account Owner so deploys 'just work'; anyone who can edit the pipeline then owns the project.