Cloud Build Artifact Analysis Ondemand Scanning Gate

What On-Demand Scanning is

Artifact Analysis On-Demand Scanning is a feature that allows developers and CI/CD systems to initiate vulnerability scans on container images locally or during build time before pushing them to a central repository like Artifact Registry.

How it meets the requirements

• Scans before pushing: Running gcloud artifacts docker images scan analyzes the local container image built in the pipeline workspace prior to executing a docker push step.
• Analyzes effective severity: The command gcloud artifacts docker images list-vulnerabilities queries the scan ID and outputs metadata including the vulnerability.effectiveSeverity level.
• Fails the build gate: A shell conditional step checks whether the severity output contains CRITICAL or HIGH. If found, it outputs a failure message and exits with a non-zero exit code (exit 1), halting the Cloud Build pipeline immediately and blocking subsequent steps (such as docker push).

Key advantages and capabilities

• Shifts security left: Catches vulnerable dependencies in operating systems and language packages before they ever enter the registry.
• Customizable gate logic: Enables granular severity filtering using regular expressions (e.g., 'CRITICAL|HIGH').
• Protects the artifact repository: Keeps vulnerable or non-compliant container images out of production and staging repositories.
• Automated orchestration: Integrates directly into native Cloud Build pipeline steps using the standard Cloud SDK builder.

Why this is optimal

On-Demand Scanning allows proactive evaluation of artifact compliance directly within the CI execution runner. Waiting until after the image is stored in the registry or deployed to a cluster increases the attack surface and requires reactive mitigation instead of preventative enforcement.