Question

Your team hosts application source in GitHub and uses a Cloud Build trigger connected via the Cloud Build GitHub App. Developers open pull requests against the main branch. Leadership mandates that no code can be merged into main unless an automated build-and-test run has succeeded, and the merge must be blocked in the GitHub UI until that check passes. What is the correct way to enforce this?

Accepted Answer

Create a pull request Cloud Build trigger and configure a GitHub branch protection rule on main that requires the Cloud Build status check to pass before merging.

Answer

Create a push trigger on the main branch so the tests run automatically after each merge, and roll back with a revert commit if tests fail.

Answer

Add a Binary Authorization policy requiring an attestation, so unverified merges are rejected by GitHub.

Answer

Configure a Cloud Deploy pipeline with a manual approval gate that developers must satisfy before merging the pull request.