Question

Your platform team is designing a CI/CD architecture for a company with separate Google Cloud projects for dev, staging, and production. The security team mandates that a container image which is deployed to production must be the exact same artifact that was tested in staging, and that no image should be rebuilt between environments. You are using Cloud Build and Artifact Registry. Which approach best satisfies these requirements?

Accepted Answer

Build the image once, tag it with the immutable digest, and promote the same image by digest through dev, staging, and production Artifact Registry repositories using a controlled pipeline with Binary Authorization attestations.

Answer

Configure a separate Cloud Build trigger in each environment's project that rebuilds the image from the same Git commit before deploying to that environment.

Answer

Store a single mutable 'latest' tag in one shared Artifact Registry repository and have every environment pull the 'latest' tag at deploy time.

Answer

Build the image in dev, then export the container filesystem as a tarball and re-import it into staging and production registries to guarantee consistency.