Your Cloud Build pipeline must produce the same output when rerun a year from now, and auditors need to know exactly which compiler image each build used. How should the build steps reference that image?
Show answer and explanation
Answer: B
A tag can be re-pointed to a different image, so two builds that use the same tag may run different tools. A digest identifies one exact image by its SHA256 hash, so pinning to it makes the step reproducible and gives auditors a precise record. Digests should be updated deliberately through a reviewed change so that upgrades remain traceable.
Why the other options are wrong
- A. Mutable tags change silently when the image is rebuilt, so a rerun could compile with different tooling. Any tag that can be moved undermines reproducibility.
- C. Installing tools at runtime fetches whatever version the remote source serves that day. The result is non-reproducible and adds a supply-chain risk.
- D. A hand-maintained VM drifts over time and cannot be audited step by step. It is the opposite of a reproducible, declarative pipeline.