--- url: "https://www.xcademia.com/news/google-cloud-strengthens-ci-cd-security-with-new-secure-source-manager-controls" title: Google Cloud Strengthens CI/CD Security With New Secure Source Manager Controls description: Google Cloud expands Secure Source Manager with granular CODEOWNERS controls and private CI/CD connectivity for stronger software supply chain security. publishedAt: "2026-09-22T08:39:07.048+00:00" updatedAt: "2026-09-22T09:43:03.204123+00:00" type: news category: cybersecurity source_name: Google Cloud Blog source_url: "https://cloud.google.com/blog/products/identity-security/strengthen-your-cicd-pipeline-with-new-secure-source-manager-capabilities" tags: - "#Cybersecurity" - "#SoftwareSupplyChain" - "#CICD" - "#DevSecOps" - "#GoogleCloud" - "#SecureSourceManager" - "#CloudSecurity" - "#CodeSecurity" --- # Google Cloud Strengthens CI/CD Security With New Secure Source Manager Controls > Google Cloud has made new Secure Source Manager capabilities generally available, adding granular CODEOWNERS controls and private CI/CD connectivity to help protect software supply chains. Source: **Google Cloud Blog** · 22 September 2026 ## Google Cloud Adds New Security Controls for CI/CD Pipelines Software supply chains have become an increasingly important security boundary as organizations rely on automated systems to move code from development to production. Google Cloud is expanding its **Secure Source Manager (SSM)** with two generally available capabilities to address different risks in the CI/CD pipeline: unauthorised access to development and delivery systems and unauthorised code changes by users with legitimate access. The capabilities add more granular controls around source code approvals while providing a private connectivity architecture for CI/CD environments. Google Cloud says the update is intended to help organizations protect source code and CI/CD systems with unified authentication and authorization mechanisms. ## Why CI/CD Security Matters CI/CD pipelines connect several stages of software delivery, including source control, build systems, artifact storage and deployment tooling. That interconnected structure also creates security dependencies. Google Cloud notes that an attacker who modifies a deployment script could potentially turn a CI/CD pipeline into a mechanism for distributing malware. The company says Secure Source Manager can now help block unauthorised access across CI/CD systems even if an organization's corporate network has already been compromised. The announcement also cites Wiz's Cloud Threat Highlights report, which found that notable supply chain attacks more than doubled in the first half of 2026 compared with the second half of 2025. That statistic comes from Wiz and is cited by Google Cloud rather than representing a Google Cloud measurement. ## CODEOWNERS Adds More Granular Approval Controls The second major capability focuses on a different problem: changes made by users who are authorized to access a repository but should not be able to approve every type of change. Google Cloud's new Code Owners system allows organizations to define pull request approvers at the **file and branch level**. Instead of applying one broad approval requirement across an entire repository, teams can specify who must review particular paths or changes. The system supports several mechanisms. #### Per-path approver sets Organizations can use glob-style path specifications to determine which users or groups must approve changes to matching files. This can be useful when different parts of a repository are maintained by different engineering or security teams. #### Branch-specific governance CODEOWNERS rules can also differ between branches. For example, an organization can define different ownership requirements for `main` and `dev` within the same CODEOWNERS configuration. Google Cloud says this approach avoids merge conflicts associated with existing CODEOWNERS implementations. #### Nested ownership Secure Source Manager also supports CODEOWNERS files within subdirectories. This means ownership does not have to be maintained in one large root-level file. Teams can define ownership closer to the directories they manage, while Google Cloud describes a "more local wins" approach in which the more local ownership rule takes precedence while the root administrator retains veto authority. #### Independent approval requirements The system can require separate approval groups for the same pull request. Google Cloud gives the example of using a section such as `[Security Team][2]` to require two members of a security team to approve a change independently of another review requirement. This creates a distinction between simply having a reviewer and requiring approval from a specific security or organizational group. ### ![info-1](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1790066041629-info-1--164-.webp) ## Securing the CI/CD Connection Code approval is only one part of the software delivery chain. Google Cloud is also highlighting its **Developer Connect integration with Secure Source Manager**, which is designed to connect CI/CD systems and runtimes securely, including environments operating across different private networks. The company's private CI/CD architecture connects: **Secure Source Manager → Private Service Connect → Cloud Build** Within the architecture, the repository, build pools and artifact storage remain in a private network. Google Cloud says **VPC Service Controls** provide an additional layer of defense by limiting access to proxy endpoints. Google Cloud documentation also confirms that Developer Connect can connect to Secure Source Manager and provide Git proxy access. The documented Developer Connect proxy supports secure Git read operations such as cloning, while `git push` operations are not supported through the proxy. ### ![info-2](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1790066056404-info-2--146-.webp) ## A Broader Software Supply Chain Security Approach The two capabilities address different points in the development workflow. The Code Owners functionality focuses on **who can approve changes to specific code**, while the private CI/CD architecture focuses on **how source code and connected delivery systems communicate within a private environment**. Together, they illustrate a broader approach to software supply chain security: protecting both the code-change process and the infrastructure that moves code toward deployment. For organizations using large repositories, multiple engineering teams or separate development and production branches, granular ownership rules can provide a more specific approval model than broad repository-level permissions. Similarly, keeping repositories, build infrastructure and artifact storage within a private network can reduce exposure of those components to public network paths, according to Google's architecture guidance. These controls do not eliminate every software supply chain risk. They instead add security boundaries around specific stages of the development and delivery process. ## Secure Source Manager Continues to Expand Google Cloud's release history shows that Secure Source Manager has been gaining additional capabilities throughout 2026. Google Cloud documentation lists Developer Connect connectivity as a February 2026 feature, while CODEOWNERS support was introduced in May. More recent updates include pull request comment webhook events in September. Secure Source Manager is also available with an MCP server in Preview, allowing AI applications and coding assistants to interact with repositories, branch protection rules, issues and pull requests. That capability is separate from the generally available CI/CD security features announced in this update. ## What Developers and Security Teams Need to Know For teams already using Secure Source Manager, the announcement provides two practical areas to consider. - **First**, organizations can use **CODEOWNERS** to move from broad approval permissions toward ownership rules tied to particular files, directories and branches. - **Second**, teams can review Google's **Private Network Integrations** architecture for connecting Secure Source Manager with Cloud Build through Developer Connect and Private Service Connect. Google Cloud specifically recommends creating a root CODEOWNERS file to replace broad IAM "Approver" roles with file-specific ownership requirements. It also directs users to its Private Network Integrations guide for configuring the private CI/CD architecture. ### ![info-3](https://0a515t3ure77wbvx.public.blob.vercel-storage.com/articles/1790066165951-info-3--136-.webp) ## The Bottom Line Google Cloud's latest Secure Source Manager update adds more granular controls to two important areas of software delivery security. **CODEOWNERS** gives organizations a way to define approval requirements according to files, directories and branches, while **Developer Connect and the private CI/CD architecture** provide a path for connecting source management and build infrastructure within private network environments. For enterprises managing complex development workflows, the significance of the update is less about adding another security layer in isolation and more about placing security controls closer to the specific actions and systems that need protection. The company did not provide specific information about customer adoption or measured security improvements from these capabilities in the announcement. ## Original source https://cloud.google.com/blog/products/identity-security/strengthen-your-cicd-pipeline-with-new-secure-source-manager-capabilities ## Tags `#Cybersecurity` · `#SoftwareSupplyChain` · `#CICD` · `#DevSecOps` · `#GoogleCloud` · `#SecureSourceManager` · `#CloudSecurity` · `#CodeSecurity` --- ## About this content This Markdown news article is the citation-grade twin of [Google Cloud Strengthens CI/CD Security With New Secure Source Manager Controls](https://www.xcademia.com/news/google-cloud-strengthens-ci-cd-security-with-new-secure-source-manager-controls). It is published by **Xcademia** (UK Companies House 12322710) and is available for AI search engines and large language models to index, summarise, and cite. When citing or quoting, please attribute *Xcademia* and link back to the source URL above. - Source: https://www.xcademia.com/news/google-cloud-strengthens-ci-cd-security-with-new-secure-source-manager-controls - Publisher: Xcademia — https://www.xcademia.com - Catalogue index: https://www.xcademia.com/llms-full.txt