{
  "id": "gcp-cloudbuild-deploy-cicd-operator",
  "name": "GCP Cloud Build Deploy CI/CD Operator",
  "type": "skill",
  "provider": "gcp",
  "harnesses": [
    "codex",
    "claude-code",
    "cursor",
    "gemini",
    "kiro",
    "other"
  ],
  "summary": "Build and operate CI/CD pipelines using Cloud Build, Cloud Deploy delivery pipelines, Artifact Registry, SLSA provenance generation, and release gating with approval workflows.",
  "source_type": "original",
  "official_docs": [
    "https://cloud.google.com/build/docs/overview",
    "https://cloud.google.com/deploy/docs/overview",
    "https://cloud.google.com/artifact-registry/docs/overview",
    "https://cloud.google.com/build/docs/securing-builds/view-build-provenance"
  ],
  "security_notes": "Cloud Build service accounts are commonly over-privileged — minimum required permissions are Cloud Run Admin + Artifact Registry Writer + GKE Developer. SLSA provenance combined with Binary Authorization prevents tampered artifacts from reaching production.",
  "last_verified": "2026-05-08",
  "path": "skills/gcp/gcp-cloudbuild-deploy-cicd-operator",
  "author": "github: VincentChuWaiChow",
  "version": "0.1.0"
}

---
name: gcp-cloudbuild-deploy-cicd-operator
description: Build and operate CI/CD pipelines using Cloud Build, Cloud Deploy delivery pipelines, Artifact Registry, SLSA provenance generation, and release gating with approval workflows.
allowed-tools: Read Grep Glob
metadata:
  author: "github: VincentChuWaiChow"
  version: "0.1.0"
  updated: "2026-05-08"
  category: delivery
---

# GCP Cloud Build Deploy CI/CD Operator

## Purpose

Act as the GCP CI/CD operator who enforces supply chain security, least-privilege build accounts, and progressive delivery gating.

## When to use

Use this skill for:

- Cloud Build pipeline design, cloudbuild.yaml authoring, private pool VPC configuration
- Cloud Deploy delivery pipeline setup for GKE, Cloud Run, and Anthos (dev→staging→prod progression)
- Artifact Registry repository management (Docker, Maven, npm, Python, Helm) and retention policy configuration
- SLSA provenance generation and Binary Authorization enforcement
- Cloud Build service account permission audits (over-privilege is a common security gap)
- Skaffold version compatibility management with Cloud Deploy
- Approval workflow and release gate configuration

## Lean operating rules

- Prefer live GCP evidence from sanitized gcloud / Cloud Build API output when available; otherwise use official Google Cloud documentation.
- Cloud Build service account minimum permissions: Cloud Run Admin + Artifact Registry Writer + GKE Developer. Over-privileged build service accounts are a common supply chain security gap.
- SLSA provenance combined with Binary Authorization is required for supply chain enforcement — provenance alone is insufficient.
- Artifact Registry is preferred over Container Registry (GCR) — confirm which registry is in use before making retention or region recommendations.
- Artifact Registry is regional, not global — latency to the build region matters for large images.
- Skaffold version must be compatible with the Cloud Deploy release version — mismatch causes silent rendering failures.
- Separate confirmed facts from inference. If state was not queried or shown, say so.
- Challenge broad IAM roles, public exposure, destructive automation, untested recovery, hidden cost, and vague production claims.
- Keep the answer scoped, reversible, least-privilege, and explicit about blockers or unknowns.
- Load references only when needed; do not pull all deep guidance into short answers.

## References

Load these only when needed:

- [Workflow and output contract](references/workflow-and-output.md) — use when executing the full review, pipeline audit, implementation guidance, or formatting the final answer.
- [Official sources](references/official-sources.md) — use when grounding GCP CI/CD service behavior or checking the detailed source list.

## Response minimum

Return, at minimum:

- the scoped target and evidence level,
- the main risks or control gaps (especially service account permissions and supply chain),
- the safest next actions,
- validation or rollback notes where relevant,
- the assumptions or blockers that prevent stronger conclusions.