Cloud Build Ondemand Scanning Pubsub Alerts

What the solution is

This approach integrates shifting security left with event-driven automation. By invoking the On-Demand Scanning API within the Cloud Build pipeline, container images are scanned for vulnerabilities before they are deployed or promoted. Downstream services leverage Pub/Sub build notifications to act instantly upon build completion and vulnerability reports.

How it meets the requirements

• In-pipeline vulnerability scanning: The On-Demand Scanning API allows Cloud Build steps to extract package metadata and scan local container images for known OS and language package vulnerabilities before they are pushed or deployed.
• Real-time event-driven alerts: Cloud Build automatically publishes build status events (such as SUCCESS, FAILURE, or step metadata) to the cloud-builds Pub/Sub topic. Downstream subscribers—such as Cloud Functions, Cloud Run, or custom Cloud Build notifiers—can listen to these messages to execute immediate automated remediation.

Key advantages and capabilities

• Shift-Left Security: Detects vulnerabilities early in the build phase, preventing flawed artifacts from entering production repositories.
• Decoupled Architecture: Pub/Sub enables asynchronous, scalable delivery of build and scanning events to multiple subscribers without tightly coupling pipeline steps.
• Automated Remediation: Triggers immediate downstream webhooks, Slack alerts, or policy evaluation engines upon build status updates.
• SLSA Alignment: Keeps security scanning inside managed, isolated Cloud Build workers rather than relying on unvetted local developer environments.

Why this is optimal

Using the native On-Demand Scanning API combined with Pub/Sub event streams provides end-to-end automation, low latency, and adherence to Google Cloud supply chain security best practices.