cloudbuild.yml for push-to-deploy

Cloud Build is GCP's native CI/CD. The cloudbuild.yml file lives in the repo. Push to main triggers a build that produces a container image, pushes it to Artifact Registry, and redeploys Cloud Run. No console clicks. Reproducible by git revert.

cloud_run_dbt/cloudbuild.yml
yaml
substitutions:
  _SERVICE_NAME: 'pipeline-ecommerce-bq-dbt'
  _PROJECT_ID: 'your-gcp-project-id'
  _REGION: 'us-central1'
  _AR_REPO: 'cloud-run'

steps:
  - name: 'gcr.io/cloud-builders/docker'
    args: ['build', '-t', '${_REGION}-docker.pkg.dev/$PROJECT_ID/${_AR_REPO}/${_SERVICE_NAME}:$SHORT_SHA', '.']

  - name: 'gcr.io/cloud-builders/docker'
    args: ['push', '${_REGION}-docker.pkg.dev/$PROJECT_ID/${_AR_REPO}/${_SERVICE_NAME}:$SHORT_SHA']

  - name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
    entrypoint: gcloud
    args:
      - 'run'
      - 'deploy'
      - '${_SERVICE_NAME}'
      - '--image=${_REGION}-docker.pkg.dev/$PROJECT_ID/${_AR_REPO}/${_SERVICE_NAME}:$SHORT_SHA'
      - '--region=${_REGION}'
      - '--no-allow-unauthenticated'

Three steps: ensure Artifact Registry repo, build the image, push, then deploy. Substitution variables make the config portable across environments.

Notice $SHORT_SHA in the image tag. Each build produces an image tagged with the git commit SHA. That gives you a deterministic mapping between code and deployed container. Rolling back is gcloud run services update-traffic --to-tags <previous-sha>.

Three roles. roles/artifactregistry.writer to push images. roles/run.admin to deploy services. roles/iam.serviceAccountUser on the runtime SA to attach it to the service. Scope each to the project, never grant roles/owner.

Quiz: Quiz

Loading practice…