Connect to Cloud Build

This page details how to invoke builds automatically from Secure Source Manager using Cloud Build configuration files and a triggers YAML file in your Secure Source Manager repository.

By default, Secure Source Manager uses a Google-managed service agent to interact with Cloud Build and other resources. To isolate team permissions, we recommend you configure a per-repository identity by associating a user-managed service account with your repository. Secure Source Manager uses the user-managed service account associated with the repository to trigger builds.

Unlike the default service agent, you can configure a user-managed service account with the iam.serviceAccounts.actAs permission on custom Cloud Build service accounts. This lets you run builds using custom service accounts while keeping build permissions restricted to that repository.

Before you begin

1. Create a Secure Source Manager instance.
2. Create a Secure Source Manager repository.

3. Configure a Cloud Build user-specified service account. To let Cloud Build read from your Secure Source Manager repository, grant the Cloud Build service account (either the default service account or a user-managed service account) the following roles:

   • Secure Source Manager Instance Accessor (roles/securesourcemanager.instanceAccessor) on the Secure Source Manager instance.
   • Secure Source Manager Repository Reader on the repository.

   Depending on your use case, the Cloud Build service account might need additional roles, for example:

   • To store build logs in Cloud Logging, grant the Logs Writer role (roles/logging.logWriter) to the Cloud Build service account.
   • To access secrets in Secret Manager, grant the Secret Manager Secret Accessor (roles/secretmanager.secretAccessor) role to the Cloud Build service account.

   For information about build logs, see Setting up build logs.

4. If your builds run in worker pools, grant the repository's user-managed service account the Cloud Build WorkerPool User role (roles/cloudbuild.workerPoolUser) on the project where the builds run.

Required roles

To get the permissions that you need to connect a Secure Source Manager repository to Cloud Build, ask your administrator to grant you the following IAM roles:

• Secure Source Manager Repository Writer (roles/securesourcemanager.repoWriter) on your repository
• Secure Source Manager Instance Accessor (roles/securesourcemanager.instanceAccessor) on the Secure Source Manager instance

For more information about granting roles, see Manage access to projects, folders, and organizations.

You might also be able to get the required permissions through custom roles or other predefined roles.

For information on granting Secure Source Manager roles, see Access control with IAM and Grant users instance access.

Required service account roles

To connect Secure Source Manager to Cloud Build, you must configure IAM permissions for a per-repository identity.

Per-repository identity setup

To use a per-repository identity, you must configure permissions.

1. User: The user who configures the repository service account needs the Service Account User role (roles/iam.serviceAccountUser) on the user-managed service account. This permission is checked during repository creation or update.

2. Secure Source Manager Service Agent: Grant the Secure Source Manager Service Agent for the repository project the Service Account Token Creator role (roles/iam.serviceAccountTokenCreator) on the user-managed service account.

   The Secure Source Manager Service Agent email has the format service-REPOSITORY_PROJECT_NUMBER@gcp-sa-sourcemanager.iam.gserviceaccount.com, where REPOSITORY_PROJECT_NUMBER is the project number of the project hosting the repository.

3. User-managed service account:

   • Grant the user-managed service account the Service Account User role (roles/iam.serviceAccountUser) on the custom Cloud Build service account (in the repository project).
   • Grant the user-managed service account the Cloud Build Editor role (roles/cloudbuild.builds.editor) and the Service Usage Consumer role (roles/serviceusage.serviceUsageConsumer) on the project where builds run.

For information about how to grant IAM roles, see Grant or revoke a single role.

Create a build configuration file

A build configuration file defines the fields that are needed for Cloud Build to perform your build tasks. You can write the build configuration file using the YAML syntax.

You can create build configuration files in the branch or branches that you want to build from.

To create a build configuration file, do the following:

1. In the Secure Source Manager web interface, select the repository you want to connect to Cloud Build.
2. Select the branch you want to build from using Cloud Build.

3. Create a build configuration file. For information about how to create build configuration files, follow the instructions in create a build configuration file.

4. Commit your changes to the branch.

Create a triggers file

The triggers configuration file must be created in the default branch of your repository.

To create a triggers configuration file:

1. In your local repository or the Secure Source Manager web interface, switch to the default branch.

2. Create a file named .cloudbuild/triggers.yaml.

3. Configure your trigger in the .cloudbuild/triggers.yaml file:

   triggers:
   - name: TRIGGER_NAME
     project: