Most CI/CD pipelines prove that code compiles. A secure delivery pipeline proves more: dependencies are known, container images are scanned, artifacts are signed and deployment requires passing gates.
On GCP, the pipeline can be built with Cloud Build, Artifact Registry, Cloud KMS and Binary Authorization.
Pipeline stages
| Stage | Tooling | Gate |
|---|---|---|
| SAST | Semgrep | Fail on high-confidence critical findings |
| SCA | osv-scanner | Fail on critical direct dependency CVEs |
| Image scan | Artifact Registry scanning | Block deploy on critical image findings |
| Signing | Cloud KMS, attestor | Only signed artifacts may deploy |
| DAST | OWASP ZAP baseline | Report and triage runtime exposure |
Pull request checks
Pull requests should run fast checks: static analysis, dependency scanning and unit tests. The goal is to catch risky changes before they merge, not after staging deploy.
steps:
- name: returntocorp/semgrep
args: ["semgrep", "ci", "--config", "p/owasp-top-ten"]
- name: ghcr.io/google/osv-scanner
args: ["osv-scanner", "--recursive", "."]
Main branch delivery
After merge, the pipeline builds a container image, pushes it to Artifact Registry, waits for vulnerability results and signs the image only if policy passes.
The important detail is the signature. Without it, later deployment systems cannot distinguish a verified artifact from a random image with the right tag.
Binary Authorization
Binary Authorization moves policy from "the pipeline should do this" to "the platform will refuse anything else." That distinction matters during incidents, manual releases and emergency patches.
DAST is useful but not enough
OWASP ZAP baseline scans are valuable for staging environments, especially for headers, obvious exposure and known patterns. They should not replace code review, SAST or threat modeling.
Final check
A secure pipeline should answer one question clearly: why is this artifact allowed to run? If the answer is "because the pipeline probably built it," the gate is too weak. If the answer is "because this digest passed policy and was signed by an approved attestor," the platform has a defensible control.