| name | gcp-cicd-patterns |
| description | Cloud-native CI/CD patterns for GCP using Cloud Build, Cloud Deploy, and GitOps. Use for pipeline design, deployment strategies (canary, blue-green), artifact management, or automating deployments to Cloud Run and GKE. |
| allowed-tools | Read, Grep, Glob |
| kb-sources | ["wiki/software-engineering/gcp-cicd-patterns"] |
| updated | "2026-05-21T00:00:00.000Z" |
GCP CI/CD Patterns
Cloud-native continuous integration and delivery patterns for Google Cloud Platform, emphasizing GitOps methodology and managed services.
Core Services
| Service | Purpose | Use When |
|---|
| Cloud Build | Serverless CI | Building, testing, scanning artifacts |
| Cloud Deploy | Managed CD | Progressive rollouts to Cloud Run/GKE |
| Artifact Registry | Container storage | Storing and promoting images |
| Cloud Run | Serverless compute | Stateless HTTP workloads |
Note: Cloud Deployment Manager deprecated March 2026. Use Terraform or Infrastructure Manager.
GitOps Methodology
Two-Repository Pattern
app-repo/ # Application code
├── src/
├── Dockerfile
└── cloudbuild.yaml # CI: build, test, push image
env-repo/ # Environment configuration
├── staging/
│ └── deployment.yaml
├── production/
│ └── deployment.yaml
└── cloudbuild.yaml # CD: apply manifests
Flow: Code push → Build image → Push to registry → Update env-repo → Deploy to target
Key Principles
- Environments-as-code - All deployments described declaratively in Git
- Build once, deploy many - Same artifact promoted through environments
- Git is source of truth - Rollback = revert commit
- Automated reconciliation - Drift detection and correction
Deployment Strategies
| Strategy | Risk | Use Case |
|---|
| Rolling | Medium | Standard updates, gradual replacement |
| Canary | Low | Production validation with real traffic |
| Blue-Green | Low | Near-zero downtime, instant rollback |
Pipeline Stages
Recommended CI/CD pipeline structure:
- Source - Trigger on push/PR
- Build - Compile, create artifacts
- Unit Test - Fast feedback
- Static Analysis - Security scanning (Trivy, tfsec)
- Publish - Push to Artifact Registry
- Deploy Staging - Automatic
- Integration Test - Validate in staging
- Deploy Production - Manual approval or canary
Critical Rules
- Promote the same image from staging to production - rebuilding for prod re-introduces toolchain drift the staging tests already caught
- Scan before deploy - deploying an unscanned image lets critical CVEs reach production silently
- Tag immutably - SHA-based tags;
latest makes rollback ambiguous and image-promotion non-auditable
- Secrets in Secret Manager - secrets pasted into
cloudbuild.yaml end up in the build log and the repo history
- Approval gates - automated production deploys remove the last human check on a bad image
- Match SA keys to permissions - See Service Account section below
GitHub Actions Service Account Configuration
Secret names like GCP_SA_KEY don't indicate which SA they contain — assuming the wrong identity burns hours on phantom permission errors. Debug first:
- name: Debug GCP Service Account
run: echo "${{ secrets.GCP_SA_KEY }}" | jq -r '.client_email'
Each workflow needs the SA scoped for its job (Terraform, Liquibase, and Cloud Build each require different roles). See reference.md § GitHub Actions Service Account Configuration for the permission table, anti-pattern YAML, and "Could Not Find Default Credentials" checklist.
GitHub Actions Patterns
Three common CI integration patterns — see reference.md § GitHub Actions Patterns for full YAML and trade-off detail:
- PR Comment Workflows: use
pull-requests: write, invoke skills directly rather than embedding prompt text, avoid path filters that miss Dockerfiles.
- Batch Database Jobs: Cloud SQL Proxy sidecar on
ubuntu-latest is simpler than Cloud Run Jobs for scheduled nightly/weekly work.
- EAS Builds (Expo/React Native): push-only trigger, pin
eas-cli, use --no-wait; see examples.md for the workflow YAML.
Angular CI: Budget Enforcement Gap
Angular style budgets are enforced only in production builds — ng serve silently ignores them. Run ng build --configuration=production in CI; use two-tier thresholds (warning 4 kB, error 6 kB). See reference.md § Angular CI for the budget config snippet.
See reference.md for detailed configurations and examples.md for Cloud Build templates.
