Q: You run a SaaS platform and your enterprise customers require a "private build" of your software — compiled from source with their specific config, available only in their VPC, with a signed SBOM. How do you architect a multi-tenant CI/CD pipeline that produces isolated, customer-specific builds?

The architecture uses build isolation per tenant:

• Isolated build namespaces: Each tenant gets a dedicated Kubernetes namespace or AWS CodeBuild project. Builds never share storage, network, or compute with another tenant.
• Tenant config injection: A secure parameter store (AWS Secrets Manager) holds per-tenant config. The CI job assumes a tenant-specific IAM role that can only access that tenant's parameters.
• Deterministic builds: The source code commit SHA is pinned at trigger time. The same SHA produces bitwise-identical output for the same tenant config — verifiable with checksums.

• SBOM generation: After each build, syft generates a CycloneDX SBOM. This is signed with cosign using a tenant-specific private key and stored in their private S3 bucket.
• Delivery to VPC: The signed image is pushed to a customer-private ECR repository with cross-account pull access granted only to their AWS account ID.