Cloud Build Artifact Analysis Ondemand Scan

What On-Demand Scanning with Cloud Build is

Artifact Analysis On-Demand Scanning is a Google Cloud capability that allows developers and security pipelines to perform vulnerability assessments on container images locally or in a build workspace before pushing them to an artifact repository. By combining the gcloud artifacts docker images scan and gcloud artifacts docker images list-vulnerabilities commands within a Cloud Build configuration (cloudbuild.yaml), organizations can automate vulnerability gatekeeping in CI/CD pipelines.

How it meets the requirements

• Build with Dockerfile: The initial pipeline step uses standard Docker tooling (docker build) to assemble the hardened container layers inside the Cloud Build workspace.
• Pre-push vulnerability inspection: gcloud artifacts docker images scan submits the locally tagged image to the On-Demand Scanning API, returning a unique scan ID without requiring the image to exist in a public or production registry.
• Automated threshold enforcement: gcloud artifacts docker images list-vulnerabilities retrieves the scan occurrences. A conditional shell filter inspects vulnerability.effectiveSeverity against the configured regular expression (CRITICAL|HIGH). If any match occurs, the script executes exit 1, immediately failing the Cloud Build job.
• Preventing untrusted image publication: Because docker push is placed as a downstream step in cloudbuild.yaml, the push step will never execute if the severity check step fails, preventing vulnerable images from ever entering the Artifact Registry repository.

Key advantages and capabilities

• True shift-left security: Catches vulnerabilities during the build phase before artifacts are stored, distributed, or deployed.
• Granular severity gating: Allows security teams to customize blocking criteria based on CVE severity levels or exploit availability.
• Layer-level visibility: Identifies specific dependencies and Dockerfile instructions responsible for introducing known CVEs.
• Native CLI integration: Executes seamlessly using standard gcr.io/google.com/cloudsdktool/cloud-sdk builder images without requiring external third-party vulnerability scanners.

Why this is optimal

This approach stops vulnerable artifacts at the pipeline gate before they enter the repository, avoiding complex post-push quarantine workflows or accidental consumption by deployment pipelines.