An enterprise architecture team is designing an automated, secure CI/CD pipeline for a microservices application targeted for Cloud Run. To satisfy security and operational requirements, the pipeline must incorporate automated unit testing, container registry storage, security vulnerability scanning, policy validation, and progressive deployment. What is the correct chronological sequence of pipeline steps from initial source code commit to final production release?
- 1The developer pushes application code to the version control repository, which triggers a Cloud Build workflow via a repository webhook.
- 2Cloud Build executes automated unit testing suites and compiles the application into a container image.
- 3Cloud Build pushes the generated container image to Artifact Registry, triggering Container Analysis for vulnerability scanning.
- 4The pipeline evaluates Container Analysis scan results to confirm zero critical vulnerabilities before generating a Cloud Deploy release.
- 5Cloud Deploy initiates a progressive canary release to Cloud Run and monitors health metrics before shifting complete production traffic.
Answer
The correct pipeline sequence begins with committing code to trigger Cloud Build, followed by running unit tests and compiling the container image, pushing the container to Artifact Registry to trigger Container Analysis, evaluating vulnerability scan results as a security gate, and finally deploying the release via Cloud Deploy to Cloud Run using a progressive canary strategy.
A secure, continuous delivery pipeline must follow a strict logical progression: code ingestion triggers the CI runner (Cloud Build), unit tests validate functional code before packaging, artifacts are stored in Artifact Registry to trigger Container Analysis, security scanning policy gates release creation, and finally Cloud Deploy manages progressive deployment to the runtime platform (Cloud Run).
Step-by-Step Solution
Key Concept
CI/CD Pipeline Sequencing and Security Gating in GCP
Estimated Time:1m 30s