Cloud Build release notes

For GitLab Enterprise and Bitbucket Data Center connections, Cloud Build now checks permissions on the calling principal.

When you create or update repository connections, Cloud Build uses Secret Manager secrets to authenticate to third-party Git providers. Previously, these referenced secrets were retrieved by the Cloud Build service agent (P4SA) on your behalf, checking permissions only against the P4SA's credentials rather than those of the calling principal. To adhere to the security principle of least privilege, Cloud Build now checks permissions on both the calling principal (using end-user credentials) and the P4SA, to ensure both have the secretmanager.versions.access IAM permission on the referenced secrets.

This check only affects GitLab Enterprise (GLE) and Bitbucket Data Center (BBDC) connections.

For instructions and more details, see the Cloud Build security bulletin.

You can now configure the results field in build config files. This field allows a build step to store data and then attach that data in an attestation within the build results after the build has completed. For more information, see results.

Cloud Build now supports uploading generic artifacts to generic repositories, and also downloading generic repositories as build dependencies. For more information, see genericArtifacts and Specify a generic artifact as a dependency.

Cloud Build now supports uploading OCI images to Artifact Registry during a build process. OCI artifacts for a build are shown in the following locations:

• The Artifacts column of Build history page
• The Execution details tab of the Build details page
• The Build artifacts tab of the Build details page

For more information, see Store an OCI image in Artifact Registry after your build completes and the Cloud Build configuration file schema definition for oci.

The authorization vulnerability CVE-2026-3136 was fixed.

Cloud Build is now available in the asia-southeast3 region.

For more information, see Cloud Build locations.

In build config files, the mavenArtifacts field now supports the deployFolder field. You can use the deployFolder field to upload all Maven files in a folder to a specific Artifact Registry repository. For more information, see Upload all Maven files in a folder to an Artifact Registry repository.

The Service Account User role has been removed from the Cloud Build Permissions page in the Google Cloud Console. Instead, when you enable certain roles on your Cloud Build service account, you can configure your Cloud Build Service account to impersonate the service account of the managed services related to those roles. This configuration lets you deploy builds using managed services while maintaining minimal permissions. For more information, see Configure Cloud Build service account impersonation for managed services.

In addition, the Cloud Build Permissions page in the Google Cloud Console will only show the legacy Cloud Build service account if your organization's policy allows it.

Developer Connect build triggers are now generally available.

You can now create build triggers that build from repositories connected to Developer Connect using the Google Cloud Console, gcloud, the Cloud Build API, and Terraform.

Dark theme is now available for Cloud Build. To enable the dark theme, in the Google Cloud console, click Settings and utilities > Preferences. In the navigation menu, click Appearance, and then select your color theme and click Save.

C3 and N2D machine families are now generally available in private pools. For a complete list of supported machines, see the machineType entry in the private pool configuration file schema.

In addition, the Create private pool and Edit private pool pages now show a monthly estimate based on the pool's machine type configuration. For more information, see View private pool price estimates.

You can now create build triggers that build from repositories connected to Developer Connect.

You can now specify build dependencies in your build configuration file. For more information, see Manage build dependencies.

In the filtering toolbar of the Build history page, you can now filter builds by region. The region drop-down has been removed. For more information, see View build results.

You can now specify, in your build config file, a custom Pub/Sub topic for build notifications. For more information, see Pub/Sub topics for build notifications.

In the filtering toolbar of the Triggers page, you can now filter by trigger repository and region. The region drop-down has been removed. For more information, see Create and manage build triggers.

Cloud Build is now available in the northamerica-south1 region.

For more information, see Cloud Build locations.

You can now map specific build log fields to log entry fields when the build log is sent to Cloud Logging. For more information, see Map build log fields to log entry fields.

You can now use Cloud Build to push Go modules to Artifact Registry. For more information, see Build and test Go applications.

Cloud Build is now available in the africa-south1 region.

For more information, see Cloud Build locations.

Cloud Build support for custom organization policies is now generally available.

Custom organization policies let you define constraints for programmatic, fine-grained control over your organization's resources. You can set these policies at the organization, folder, or project level.

To learn more, see Manage Cloud Build resources with custom constraints.

Cloud Build users can connect to Bitbucket Cloud and Bitbucket Data Center hosts and add repositories with the Terraform provider for Google Cloud.

To learn more, see Connect to a Bitbucket Cloud host and Connect to a Bitbucket Data Center host.

Cloud Build is introducing new organization policy constraints.

The default behavior for how Cloud Build uses service accounts in new projects was changed to improve the security posture of our customers going forward. Organizations can opt out of these changes using new organization policy boolean constraints.

To learn more about these changes, see Cloud Build Service Account Change.

Cloud Build support for Supply-chain Levels for Software Artifacts (SLSA) version 1.0 compliant provenance is now generally available to help you safeguard your automated build pipelines.

Build provenance is verifiable metadata that you can use to audit builds. Cloud Build can generate provenance aligned with the SLSA v1.0 spec when you use the option requestedVerifyOption with triggered builds.

Learn how to use build provenance in Cloud Build.

Cloud Build repositories (2nd gen) now supports integration with Bitbucket Cloud and Bitbucket Data Center. These features are generally available.

Cloud Build is now available in the following regions:

• europe-west10
• europe-west12
• me-central1
• me-central2

For more information, see Cloud Build locations.

Cloud Build is introducing a new organization policy constraint.

On April 29, 2024, we are introducing changes to Cloud Build's default behavior and use of service accounts in new projects. Organizations can opt out of these changes using a new organization policy boolean constraint.

Cloud Build is now available in the following regions:

• europe-southwest1
• europe-west8
• europe-west9
• me-west1
• us-east5
• us-south1

For more information, see Cloud Build locations.

Users can now set an IP range size and starting IP address for private connections in Bitbucket Data Center using the peeredNetworkIpRange. This feature is generally available. To learn more, see Build repositories in Bitbucket Data Center in a private network.

Users can now use manual triggers, webhook triggers, and Pub/Sub triggers to build Bitbucket Server and Bitbucket Data Center repositories through Cloud Build repositories (1st gen). This feature is generally available. To learn more, see Build repositories from Bitbucket Server and Build repositories from Bitbucket Data Center.

Cloud Build's free tier now offers the e2-standard-2 machine type as the new default machine type. The free tier now offers 2,500 build-minutes per month to provide you with more flexibility to use free build-minutes however you want throughout the month instead of being limited to a daily allocation. Changes to the Cloud Build free tier are effective as of September 1, 2023. To learn more, see Cloud Build pricing.

You can now configure Cloud Build to generate Google-signed identity tokens for user-specified service accounts during a build. Leveraging identity tokens with Cloud Build, you can:

• Authorize service-to-service access from Cloud Build
• Sign your builds

Identity tokens that you generate with Cloud Build conform to the OpenID Connect (OIDC) specification.

This feature is generally available.

Cloud Build now generates provenance attestations that meet Supply-chain Levels for Software Artifacts (SLSA) v1.0 specifications. Build provenance is a verifiable collection of metadata that you can use to audit builds and safeguard deployments.

This feature is in Preview. Builds triggered by repository events such as pushes or pull requests will generate the v1.0 provenance.

Learn how to use build provenance in Cloud Build.

The e2-medium machine type is now supported as a custom machine type that you can specify in your cloudbuild.yaml build configuration file. For more information, see machineType.

Cloud Build repositories (2nd gen) is now generally available. Cloud Build repositories (2nd gen) integrates directly with GitHub, GitHub Enterprise, GitLab, and GitLab Enterprise Edition and comes with end-to-end Terraform support. To learn more, see the Repositories overview page.

The Cloud Build Security insights panel that displays security metrics such as Supply-chain Levels for Software Artifacts (SLSA) level for built artifacts, vulnerabilities, and build details is now generally available.