Cloud Build's whole job: source in, tested artifact out.
It never deploys anything — that's Cloud Deploy's job, four slides from now.
1
Push→
2
Trigger→
3
Install / test→
4
Build image→
5
Scan→
6
Push to Artifact RegistryEvery step is a container sharing one workspace, in order — the built binary a later step packages is exactly the file an earlier step's tests just verified. That's what makes "what was tested is what ships" an actual guarantee.