One tooling project, not one pipeline per environment.
A dedicated project holds Cloud Build, Artifact Registry, and Cloud Deploy — environment projects hold zero pipeline machinery.
meridian-cicd (tooling)Cloud Build · Artifact Registry · Cloud Deploy
meridian-devDeploy target — broad, fast iteration
meridian-stagingDeploy target — matches prod's shape
meridian-prodDeploy target — narrowest scope, approval gate
Why it scales
Duplicating Cloud Build/Artifact Registry into every environment project means a security fix applies N times. One tooling project centralizes review to one place.
From the trenches: a pipeline SA was granted
roles/editor "temporarily" during a migration — four months later, build steps had quietly grown to depend on permissions never meant to be theirs, and nobody could safely revoke it.Fix: define the pipeline's actual required permission set before granting access, so there's a baseline to audit against.