An enterprise is establishing an automated CI/CD pipeline using Cloud Build, Artifact Registry, Artifact Analysis, and Binary Authorization to deploy containerized workloads to Google Kubernetes Engine (GKE). The security team mandates the following security gates: Container images must be scanned for vulnerabilities before pushing them to Artifact Registry. The pipeline must immediately abort if vulnerabilities classified as CRITICAL or HIGH are discovered. If the image satisfies the vulnerability threshold, the pipeline must push the image and generate an automated cryptographic attestation over the container image digest using an asymmetric Cloud KMS key. The attestation must be attached to the appropriate Binary Authorization attestor note in Artifact Analysis so GKE can validate the signature prior to admitting pods. Which workflow sequence in Cloud Build should the security team implement to satisfy these requirements?

1. Build the local image and calculate its exact digest. 2. Run `gcloud artifacts docker images scan` to perform On-Demand Scanning, and check effective severity levels with `gcloud artifacts docker images list-vulnerabilities` to fail the build if `CRITICAL` or `HIGH` findings exist. 3. Push the image to Artifact Registry using its digest. 4. Execute `gcloud beta container binauthz attestations sign-and-create` using the image digest, the target attestor, and the Cloud KMS key version to register the attestation.: What the Automated Attestation Workflow Is This workflow integrates Artifact Analysis On-Demand Scanning API, Cloud Key Management Service (Cloud KMS), and Binary Authorization directly into a Cloud Build pipeline to enforce shift-left security and cryptographic provenance across the software supply chain. How It Meets the Security Requirements Pre-Push Vulnerability Gate: The pipeline builds the container locally and triggers an on-demand scan with gcloud artifacts docker images scan. It inspects vulnerability.effectiveSeverity with gcloud artifacts docker images list-vulnerabilities, parsing findings with an exit code condition (grep -Exq 'CRITICAL|HIGH') that terminates the build before pushing unauthorized artifacts to Artifact Registry. Immutable Digest Referencing: By calculating and pinning the container's cryptographic digest (sha256), the pipeline guarantees that the attestation and the deployed artifact are immutably linked, eliminating time-of-check to time-of-use (TOCTOU) tag mutation risks. Cryptographic Attestation Generation: Using gcloud beta container binauthz attestations sign-and-create, Cloud Build invokes an asymmetric signing key in Cloud KMS to sign the image digest payload and records the signed attestation as an occurrence under the attestor's Artifact Analysis Note. Deploy-Time Enforcement: GKE's admission controller intercepts deployment manifests, checks Binary Authorization policy rules requiring the specific attestor authority, validates the Cloud KMS signature against the attestor's registered public key, and admits the pod. Key Advantages and Capabilities Fail-Closed Security: Images containing unapproved vulnerabilities are never pushed to production repositories. Tamper-Proof Verification: Signatures are anchored in hardware-backed or managed Cloud KMS keys without exposing private key material to local developers. Separation of Concerns: Cryptographic attestor identities remain distinct across pipeline stages (e.g., build verification, security scanning, QA testing). Auditability and Traceability: Detailed attestation occurrences in Artifact Analysis maintain historical records of exactly which build job signed which image digest. Why This Is Optimal This architecture establishes a strict gatekeeper mechanism inside CI/CD, preventing vulnerable or non-compliant containers from reaching deployment targets by cryptographically binding policy compliance to immutable image digests.