Building IoT platformPrimustech, 2026 · Case study
A pipeline where failed merges never deploy
I own the Cloud Build delivery pipeline: build once, promote by digest, approve before release.
- of my pull requests merged on the platform so far
- 169
- image digest per release: built once, then promoted
- 1
- red merges that reached production
- 0
A small working model of the real system. Press the buttons.
- PR checks
- Build image
- CVE scan
- Integration tests
- Approval
- Promote digest
- Deploy to GKE
A simulation of the real release gates.
The problem
Builds and deploys were coupled, so what reached production was not always the image that had been tested, and infrastructure drifted from Terraform.
What I did
- 1
Split build from deploy so a release promotes the exact image digest that passed its checks.
- 2
Added pull-request, post-merge and Terraform drift gates, a CRITICAL-CVE image gate and weekly base-image rebuilds.
- 3
Made releases and Terraform applies approval-gated and serialised per component, then moved the repository from Bitbucket to GitHub with full history.
169 of my pull requests merged so far. A red merge never reaches production.
Stack
- Cloud Build
- Artifact Registry
- Artifact Analysis
- GitHub
- Terraform