Google Cloud Build Trigger
This page shows how to write Terraform for Cloud Build Trigger and write them securely.
google_cloudbuild_trigger (Terraform)
The Trigger in Cloud Build can be configured in Terraform with the resource name google_cloudbuild_trigger
. The following sections describe 5 examples of how to use the resource and its parameters.
Example Usage from GitHub
resource "google_cloudbuild_trigger" "cloud-pubsub" {
name = "kubernetes-engine-samples-cloud-pubsub"
filename = "cloud-pubsub/cloudbuild.yaml"
included_files = ["cloud-pubsub/**"]
description = local.trigger_description
resource "google_cloudbuild_trigger" "cloud-pubsub" {
name = "kubernetes-engine-samples-cloud-pubsub"
filename = "cloud-pubsub/cloudbuild.yaml"
included_files = ["cloud-pubsub/**"]
description = local.trigger_description
resource "google_cloudbuild_trigger" "web-socket-server" {
trigger_template {
repo_name = google_sourcerepo_repository.ipu-room.name
branch_name = "web-socket-server"
}
resource "google_cloudbuild_trigger" "trigger-dev" {
name = "Trigger-DEV"
trigger_template {
project_id = "duncan-elliot-sandbox"
resource "google_cloudbuild_trigger" "app-tag" {
project = var.project_name
description = "build with tag"
trigger_template {
tag_name = "v\\d.*"
Parameters
-
create_time
optional computed - string
Time when the trigger was created.
-
description
optional - string
Human-readable description of the trigger.
-
disabled
optional - bool
Whether the trigger is disabled or not. If true, the trigger will never result in a build.
-
filename
optional - string
Path, from the source root, to a file whose contents is used for the template. Either a filename or build template must be provided.
-
id
optional computed - string -
ignored_files
optional - list of string
ignoredFiles and includedFiles are file glob matches using https://golang.org/pkg/path/filepath/#Match extended with support for '**'. If ignoredFiles and changed files are both empty, then they are not used to determine whether or not to trigger a build. If ignoredFiles is not empty, then we ignore any files that match any of the ignored_file globs. If the change has no files that are outside of the ignoredFiles globs, then we do not trigger a build.
-
included_files
optional - list of string
ignoredFiles and includedFiles are file glob matches using https://golang.org/pkg/path/filepath/#Match extended with support for '**'. If any of the files altered in the commit pass the ignoredFiles filter and includedFiles is empty, then as far as this filter is concerned, we should trigger the build. If any of the files altered in the commit pass the ignoredFiles filter and includedFiles is not empty, then we make sure that at least one of those files matches a includedFiles glob. If not, then we do not trigger a build.
-
name
optional computed - string
Name of the trigger. Must be unique within the project.
-
project
optional computed - string -
substitutions
optional - map from string to string
Substitutions data for Build resource.
-
tags
optional - list of string
Tags for annotation of a BuildTrigger
-
trigger_id
optional computed - string
The unique identifier for the trigger.
-
build
list block-
images
optional - list of string
A list of images to be pushed upon the successful completion of all build steps. The images are pushed using the builder service account's credentials. The digests of the pushed images will be stored in the Build resource's results field. If any of the images fail to be pushed, the build status is marked FAILURE.
-
logs_bucket
optional - string
Google Cloud Storage bucket where logs should be written. Logs file names will be of the format $[logsBucket]/log-$[build_id].txt.
-
queue_ttl
optional - string
TTL in queue for this build. If provided and the build is enqueued longer than this value, the build will expire and the build status will be EXPIRED. The TTL starts ticking from createTime. A duration in seconds with up to nine fractional digits, terminated by 's'. Example: "3.5s".
-
substitutions
optional - map from string to string
Substitutions data for Build resource.
-
tags
optional - list of string
Tags for annotation of a Build. These are not docker tags.
-
timeout
optional - string
Amount of time that this build should be allowed to run, to second granularity. If this amount of time elapses, work on the build will cease and the build status will be TIMEOUT. This timeout must be equal to or greater than the sum of the timeouts for build steps within the build. The expected format is the number of seconds followed by s. Default time is ten minutes (600s).
-
artifacts
list block-
images
optional - list of string
A list of images to be pushed upon the successful completion of all build steps. The images will be pushed using the builder service account's credentials. The digests of the pushed images will be stored in the Build resource's results field. If any of the images fail to be pushed, the build is marked FAILURE.
-
objects
list block-
location
optional - string
Cloud Storage bucket and optional object path, in the form "gs://bucket/path/to/somewhere/". Files in the workspace matching any path pattern will be uploaded to Cloud Storage with this location as a prefix.
-
paths
optional - list of string
Path globs used to match files in the build's workspace.
-
timing
optional computed - list of object
Output only. Stores timing information for pushing all artifact objects.
-
end_time
- string -
start_time
- string
-
-
-
options
list block-
disk_size_gb
optional - number
Requested disk size for the VM that runs the build. Note that this is NOT "disk free"; some of the space will be used by the operating system and build utilities. Also note that this is the minimum disk size that will be allocated for the build -- the build may run with a larger disk than requested. At present, the maximum disk size is 1000GB; builds that request more than the maximum are rejected with an error.
-
dynamic_substitutions
optional - bool
Option to specify whether or not to apply bash style string operations to the substitutions. NOTE this is always enabled for triggered builds and cannot be overridden in the build configuration file.
-
env
optional - list of string
A list of global environment variable definitions that will exist for all build steps in this build. If a variable is defined in both globally and in a build step, the variable will use the build step value. The elements are of the form "KEY=VALUE" for the environment variable "KEY" being given the value "VALUE".
-
log_streaming_option
optional - string
Option to define build log streaming behavior to Google Cloud Storage. Possible values: ["STREAM_DEFAULT", "STREAM_ON", "STREAM_OFF"]
-
logging
optional - string
Option to specify the logging mode, which determines if and where build logs are stored. Possible values: ["LOGGING_UNSPECIFIED", "LEGACY", "GCS_ONLY", "STACKDRIVER_ONLY", "NONE"]
-
machine_type
optional - string
Compute Engine machine type on which to run the build. Possible values: ["UNSPECIFIED", "N1_HIGHCPU_8", "N1_HIGHCPU_32", "E2_HIGHCPU_8", "E2_HIGHCPU_32"]
-
requested_verify_option
optional - string
Requested verifiability options. Possible values: ["NOT_VERIFIED", "VERIFIED"]
-
secret_env
optional - list of string
A list of global environment variables, which are encrypted using a Cloud Key Management Service crypto key. These values must be specified in the build's Secret. These variables will be available to all build steps in this build.
-
source_provenance_hash
optional - list of string
Requested hash for SourceProvenance. Possible values: ["NONE", "SHA256", "MD5"]
-
substitution_option
optional - string
Option to specify behavior when there is an error in the substitution checks. NOTE this is always set to ALLOW_LOOSE for triggered builds and cannot be overridden in the build configuration file. Possible values: ["MUST_MATCH", "ALLOW_LOOSE"]
-
worker_pool
optional - string
Option to specify a WorkerPool for the build. Format projects/[project]/workerPools/[workerPool] This field is experimental.
-
volumes
list block-
name
optional - string
Name of the volume to mount. Volume names must be unique per build step and must be valid names for Docker volumes. Each named volume must be used by at least two build steps.
-
path
optional - string
Path at which to mount the volume. Paths must be absolute and cannot conflict with other volume paths on the same build step or with certain reserved volume paths.
-
-
-
secret
list block-
kms_key_name
required - string
Cloud KMS key name to use to decrypt these envs.
-
secret_env
optional - map from string to string
Map of environment variable name to its encrypted value. Secret environment variables must be unique across all of a build's secrets, and must be used by at least one build step. Values can be at most 64 KB in size. There can be at most 100 secret values across all of a build's secrets.
-
-
source
list block-
repo_source
list block-
branch_name
optional - string
Regex matching branches to build. Exactly one a of branch name, tag, or commit SHA must be provided. The syntax of the regular expressions accepted is the syntax accepted by RE2 and described at https://github.com/google/re2/wiki/Syntax
-
commit_sha
optional - string
Explicit commit SHA to build. Exactly one a of branch name, tag, or commit SHA must be provided.
-
dir
optional - string
Directory, relative to the source root, in which to run the build. This must be a relative path. If a step's dir is specified and is an absolute path, this value is ignored for that step's execution.
-
invert_regex
optional - bool
Only trigger a build if the revision regex does NOT match the revision regex.
-
project_id
optional - string
ID of the project that owns the Cloud Source Repository. If omitted, the project ID requesting the build is assumed.
-
repo_name
required - string
Name of the Cloud Source Repository.
-
substitutions
optional - map from string to string
Substitutions to use in a triggered build. Should only be used with triggers.run
-
tag_name
optional - string
Regex matching tags to build. Exactly one a of branch name, tag, or commit SHA must be provided. The syntax of the regular expressions accepted is the syntax accepted by RE2 and described at https://github.com/google/re2/wiki/Syntax
-
-
storage_source
list block-
bucket
required - string
Google Cloud Storage bucket containing the source.
-
generation
optional - string
Google Cloud Storage generation for the object. If the generation is omitted, the latest generation will be used
-
object
required - string
Google Cloud Storage object containing the source. This object must be a gzipped archive file (.tar.gz) containing source to build.
-
-
-
step
list block-
args
optional - list of string
A list of arguments that will be presented to the step when it is started. If the image used to run the step's container has an entrypoint, the args are used as arguments to that entrypoint. If the image does not define an entrypoint, the first element in args is used as the entrypoint, and the remainder will be used as arguments.
-
dir
optional - string
Working directory to use when running this step's container. If this value is a relative path, it is relative to the build's working directory. If this value is absolute, it may be outside the build's working directory, in which case the contents of the path may not be persisted across build step executions, unless a 'volume' for that path is specified. If the build specifies a 'RepoSource' with 'dir' and a step with a 'dir', which specifies an absolute path, the 'RepoSource' 'dir' is ignored for the step's execution.
-
entrypoint
optional - string
Entrypoint to be used instead of the build step image's default entrypoint. If unset, the image's default entrypoint is used
-
env
optional - list of string
A list of environment variable definitions to be used when running a step. The elements are of the form "KEY=VALUE" for the environment variable "KEY" being given the value "VALUE".
-
id
optional - string
Unique identifier for this build step, used in 'wait_for' to reference this build step as a dependency.
-
name
required - string
The name of the container image that will run this particular build step. If the image is available in the host's Docker daemon's cache, it will be run directly. If not, the host will attempt to pull the image first, using the builder service account's credentials if necessary. The Docker daemon's cache will already have the latest versions of all of the officially supported build steps (see https://github.com/GoogleCloudPlatform/cloud-builders for images and examples). The Docker daemon will also have cached many of the layers for some popular images, like "ubuntu", "debian", but they will be refreshed at the time you attempt to use them. If you built an image in a previous build step, it will be stored in the host's Docker daemon's cache and is available to use as the name for a later build step.
-
secret_env
optional - list of string
A list of environment variables which are encrypted using a Cloud Key Management Service crypto key. These values must be specified in the build's 'Secret'.
-
timeout
optional - string
Time limit for executing this build step. If not defined, the step has no time limit and will be allowed to continue to run until either it completes or the build itself times out.
-
timing
optional - string
Output only. Stores timing information for executing this build step.
-
wait_for
optional - list of string
The ID(s) of the step(s) that this build step depends on. This build step will not start until all the build steps in 'wait_for' have completed successfully. If 'wait_for' is empty, this build step will start when all previous build steps in the 'Build.Steps' list have completed successfully.
-
volumes
list block-
name
required - string
Name of the volume to mount. Volume names must be unique per build step and must be valid names for Docker volumes. Each named volume must be used by at least two build steps.
-
path
required - string
Path at which to mount the volume. Paths must be absolute and cannot conflict with other volume paths on the same build step or with certain reserved volume paths.
-
-
-
-
github
list block-
name
optional - string
Name of the repository. For example: The name for https://github.com/googlecloudplatform/cloud-builders is "cloud-builders".
-
owner
optional - string
Owner of the repository. For example: The owner for https://github.com/googlecloudplatform/cloud-builders is "googlecloudplatform".
-
pull_request
list block-
branch
required - string
Regex of branches to match.
-
comment_control
optional - string
Whether to block builds on a "/gcbrun" comment from a repository owner or collaborator. Possible values: ["COMMENTS_DISABLED", "COMMENTS_ENABLED", "COMMENTS_ENABLED_FOR_EXTERNAL_CONTRIBUTORS_ONLY"]
-
invert_regex
optional - bool
If true, branches that do NOT match the git_ref will trigger a build.
-
-
push
list block-
branch
optional - string
Regex of branches to match. Specify only one of branch or tag.
-
invert_regex
optional - bool
When true, only trigger a build if the revision regex does NOT match the git_ref regex.
-
tag
optional - string
Regex of tags to match. Specify only one of branch or tag.
-
-
-
timeouts
single block -
trigger_template
list block-
branch_name
optional - string
Name of the branch to build. Exactly one a of branch name, tag, or commit SHA must be provided. This field is a regular expression.
-
commit_sha
optional - string
Explicit commit SHA to build. Exactly one of a branch name, tag, or commit SHA must be provided.
-
dir
optional - string
Directory, relative to the source root, in which to run the build. This must be a relative path. If a step's dir is specified and is an absolute path, this value is ignored for that step's execution.
-
invert_regex
optional - bool
Only trigger a build if the revision regex does NOT match the revision regex.
-
project_id
optional computed - string
ID of the project that owns the Cloud Source Repository. If omitted, the project ID requesting the build is assumed.
-
repo_name
optional - string
Name of the Cloud Source Repository. If omitted, the name "default" is assumed.
-
tag_name
optional - string
Name of the tag to build. Exactly one of a branch name, tag, or commit SHA must be provided. This field is a regular expression.
-
Explanation in Terraform Registry
Configuration for an automated build in response to source repository changes. To get more information about Trigger, see:
- API documentation
- How-to Guides
- Automating builds using build triggers
Note: You can retrieve the email of the Cloud Build Service Account used in jobs by using the
google_project_service_identity
resource.
Frequently asked questions
What is Google Cloud Build Trigger?
Google Cloud Build Trigger is a resource for Cloud Build of Google Cloud Platform. Settings can be wrote in Terraform.
Where can I find the example code for the Google Cloud Build Trigger?
For Terraform, the etmereu/eriks_version, manjeetaaryan/hello_app and i-pu/ipu-room source code examples are useful. See the Terraform Example section for further details.