Question

Your team maintains a Cloud Build pipeline that builds and pushes container images to Artifact Registry. Currently a single trigger fires on every push to any branch and always tags images as 'latest'. The release manager wants a separate, repeatable release flow: when a semantic version Git tag (e.g., v1.4.2) is pushed, the pipeline should build an image tagged with that exact version string and push it to a 'release' repository, without changing the existing branch-based development builds. What is the most appropriate way to implement this?

Accepted Answer

Create a second Cloud Build trigger with a tag filter matching the semantic version pattern, and reference the built-in TAG_NAME substitution variable in the build steps to tag the image.

Answer

Modify the existing branch trigger to add a conditional shell step that inspects Git refs at runtime and manually parses the tag name from the repository.

Answer

Configure Binary Authorization to only admit images whose tag matches a semantic version, so that untagged builds are automatically rejected during deployment.

Answer

Add a manual approval gate to the existing trigger and have the release manager type the version number into a user-defined substitution before each build.