How to Deploy With Cloud Build From GitHub Actions

gcloud builds submit hands your source and cloudbuild.yaml to Cloud Build, which runs the steps on Google infrastructure.

Authenticate via WIF, then gcloud builds submit --config cloudbuild.yaml. Cloud Build executes each step (build, push, deploy) and streams logs back to the Action.

Steps

• Authenticate via WIF.
• Define build/push/deploy steps in cloudbuild.yaml.
• Submit with gcloud builds submit --config.

Workflow

permissions:
  id-token: write
  contents: read
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: google-github-actions/auth@v2
        with:
          workload_identity_provider: ${{ vars.WIF_PROVIDER }}
          service_account: ${{ vars.DEPLOY_SA }}
      - uses: google-github-actions/setup-gcloud@v2
      - run: |
          gcloud builds submit \
            --config cloudbuild.yaml \
            --substitutions=_TAG=${{ github.sha }}

Gotchas

• The account needs roles/cloudbuild.builds.editor and access to the staging bucket.
• Cloud Build runs as its own service account by default; grant that account the deploy roles, not just your CI account.

Related guides