commit 78b4656222a742c4fd11a5af093412b63cdae55d
author Drew Roen <102626803+drewroengoogle@users.noreply.github.com> Fri Jan 13 13:48:59 2023 -0600
committer GitHub <noreply@github.com> Fri Jan 13 19:48:59 2023 +0000
tree 99e021337586625c0f604287e32f93ee29329265
parent 0ddef3a9ab761bf40b64ca831f1a1253ab31d1cd

Add verification of build provenance. If build provenance does not exist for the image, then it will not be deployed (#2390)

app_dart/cloudbuild_app_dart_docker.yaml

diff --git a/app_dart/cloudbuild_app_dart_docker.yaml b/app_dart/cloudbuild_app_dart_docker.yaml
index e99ed92..1c6f582 100644
--- a/app_dart/cloudbuild_app_dart_docker.yaml
+++ b/app_dart/cloudbuild_app_dart_docker.yaml
@@ -10,7 +10,6 @@
     entrypoint: '/bin/bash'
     args: ['cloud_build/dashboard_build.sh']
 
-
   # Build docker image
   - name: 'us-docker.pkg.dev/cloud-builders/ga/v1/docker'
     args: ['build', '-t', 'us-docker.pkg.dev/$PROJECT_ID/appengine/default.version-$SHORT_SHA', 'app_dart']
@@ -18,3 +17,7 @@
 timeout: 1200s
 
 images: ['us-docker.pkg.dev/$PROJECT_ID/appengine/default.version-$SHORT_SHA']
+
+# If build provenance is not generated, the docker deployment will fail.
+options:
+  requestedVerifyOption: VERIFIED

auto_submit/cloudbuild_auto_submit_docker.yaml

diff --git a/auto_submit/cloudbuild_auto_submit_docker.yaml b/auto_submit/cloudbuild_auto_submit_docker.yaml
index aef8582..475000e 100644
--- a/auto_submit/cloudbuild_auto_submit_docker.yaml
+++ b/auto_submit/cloudbuild_auto_submit_docker.yaml
@@ -9,3 +9,7 @@
 timeout: 1200s
 
 images: ['us-docker.pkg.dev/$PROJECT_ID/appengine/auto-submit.version-$SHORT_SHA']
+
+# If build provenance is not generated, the docker deployment will fail.
+options:
+  requestedVerifyOption: VERIFIED