Question

Your team uses Google Cloud Deploy with a delivery pipeline that progresses through dev, staging, and production targets. Developers frequently push releases, and automatic promotion moves them rapidly from dev to staging. Management requires that no release reaches production without explicit sign-off from a release manager, while dev-to-staging flow should stay fully automated. What is the most appropriate way to enforce this in the pipeline?

Accepted Answer

Require the production target to use a require-approval setting so promotions into it pause until an authorized user approves the rollout.

Answer

Add a Cloud Build trigger that runs only on the production branch and manually merge changes before it fires.

Answer

Grant only the release manager the clouddeploy.releaser role on the entire pipeline so no one else can create releases.

Answer

Configure a canary deployment strategy on the production target so traffic is gradually shifted after review.