Secure CI/CD from GitHub to Cloud Run via Cloud Build

PCA Last updated

Deployment and release management Designing for security.

Short answer

D Connect the repository with the Cloud Build GitHub App and create a Cloud Build trigger that builds and deploys to Cloud Run on pull request merge using IAM-based authentication.

Question

You are using a GitHub repository for your application’s source code. You want to set up an efficient and secure continuous deployment process to automatically build and deploy the application to Cloud Run whenever a pull request is merged. What should you do?

  1. Create a GitHub webhook trigger in Cloud Build. Once a pull request is merged, trigger Cloud Build to build a container image and save it in Artifact Registry. Use Config Sync to deploy the application to Cloud Run.
  2. Create a workflow using GitHub Actions to build and deploy the application to Cloud Run once a pull request is merged. The workflow will use a service account key checked in with your source code for deployment permission.
  3. Create a GitHub Enterprise trigger in Cloud Build. Once a pull request is merged, trigger Cloud Build to build and deploy the application to Cloud Run. Save the deployment credential to Secret Manager.
  4. Connect your repository using the Cloud Build GitHub app. Create a trigger in Cloud Build. Once a pull request is merged, trigger Cloud Build to build and deploy the application to Cloud Run. Correct Answer

Key Takeaways

The exam tests whether you know the Google-recommended GitHub-to-Cloud Build integration and can spot credential-handling anti-patterns; the trap is picking any option that stores a long-lived service account key in source code.

This Professional Cloud Architect question tests the recommended way to automate continuous deployment from a GitHub repository to Cloud Run when a pull request is merged. Connecting the repository with the Cloud Build GitHub App and creating a Cloud Build trigger is the secure, Google-recommended pattern, making D the correct choice.

Common mistake: Option B is the most tempting wrong answer because GitHub Actions is a familiar CI/CD tool, but it commits a service account key to the repository—a critical security failure that Google explicitly forbids. Option A is also wrong because Config Sync is a GitOps tool for Kubernetes clusters, not a Cloud Run deployment mechanism.

Expert Analysis

Why the Answer Is Correct

Option D describes the current Google-recommended integration: connect the repository with the Cloud Build GitHub App, then create a Cloud Build trigger that fires on pull request merge. Cloud Build natively authenticates to Google Cloud using its own service identity and IAM, so no long-lived user-managed key is ever stored in the repo. The trigger can build the container, push it to Artifact Registry, and deploy directly to Cloud Run in one secure, managed pipeline. This satisfies both the deployment-efficiency and the security requirements of the question.

Why the Other Options Are Wrong

Option B deploys via GitHub Actions but authenticates with a service account key checked into source control, which violates Google's guidance that service account keys should never be committed to version control and is an automatic exam failure. Option A uses a GitHub webhook trigger and then attempts deployment with Config Sync, but Config Sync is designed to reconcile Kubernetes cluster state from Git and is not the tool for deploying a containerized service to Cloud Run. Option C references a "GitHub Enterprise trigger" and a deployment credential saved in Secret Manager; storing credentials in Secret Manager is better than hard-coding them, but a Cloud Run deployment should rely on IAM-based authentication rather than a stored credential, and this is not the recommended connection pattern.

Community Comment Notes

Multiple commenters converged on D, with glb2 noting that "The Cloud Build GitHub App is the recommended, modern way to connect GitHub repositories to Google Cloud." Pime13 added that this setup "provides a secure connection without requiring you to manage webhooks or long-lived service account keys manually." Pime13 also pushed back on the single vote for B, calling "Checking in a service account key to your source code" a critical security failure and a guaranteed exam trap.

Official Reference

Exam Strategy

On deployment-pipeline questions, always reject any option that involves committing credentials, keys, or passwords to source control—Google exams treat that as an automatic fail. Then choose the fully managed, first-party integration (here, the Cloud Build GitHub App plus a Cloud Build trigger) over third-party or mismatched tooling.

Frequently Asked Questions

Why is checking a service account key into the repository wrong in option B?

Google explicitly prohibits committing service account keys to version control because anyone with repo access could reuse the credential. Cloud Build's GitHub App authenticates via IAM instead, eliminating long-lived keys.

Why can't Config Sync be used to deploy the application to Cloud Run?

Config Sync is a GitOps tool that reconciles Kubernetes cluster configuration from a Git source; Cloud Run is a serverless container platform, not a Config Sync-managed cluster. Cloud Build should deploy to Cloud Run directly.

More PCA FAQ →

Discussion 5 contributions

Compiled from public community threads and reader submissions, lightly edited for clarity. Handles and vote tallies are shown as recorded.

From public community threads 5

  1. glb2 👍 2 Answered D
    The Cloud Build GitHub App is the recommended, modern way to connect GitHub repositories to Google Cloud
  2. Pime13 👍 1 Answered D
    Cloud Build GitHub App: This is the native, Google-recommended method for integrating GitHub with Google Cloud. It provides a secure connection without requiring you to manage webhooks or long-lived service account keys manually. Native Automation: Cloud Build triggers are designed specifically for this workflow. When a pull request is merged into the specified branch (e.g., main), the trigger fires, executing a build and a gcloud run deploy command in a single, managed pipeline. Security: By using the native app integration, you leverage Google’s managed identity for the connection, reducing the risk of credential leakage associated with checked-in keys or manually managed secrets.
  3. Pime13 👍 1
    you need to study before checking options and messing with community vote. B is wrong: Checking in a service account key to your source code is a critical security failure and a guaranteed way to fail the exam. Service account keys should never be stored in version control.
  4. 0d8df8b 👍 1 Answered D
    Best Google-recommended setup: Connect GitHub using the Cloud Build GitHub app Create a Cloud Build trigger Trigger build when PR is merged Build container image Deploy to Cloud Run This is secure and managed.
  5. Gabrycloud 👍 1 Answered B
    I'll go with B.

Reader comments & corrections

No reader corrections yet — spotted an error or have a note? Share it below.

Log in to comment, report an error, or add a note about this question.

Submitted for moderation before publishing. Keep it helpful and respectful.

Optimizing Data Transfer for ETL with Cellular Connections

S-Grade

Streamlining Cloud IAM Audit Analysis with BigQuery

S-Grade

Auditing BigQuery User Query Counts

S-Grade

Practice All PCA Questions

Access 81 questions with complete answers and detailed explanations.

View Full PCA Practice Test →

← Back to PCA Study Guide