You are creating a CI/CD pipeline in Cloud Build to build an application container image. The application code is stored in GitHub. Your company requires that production image builds are only run agai

A trigger on 'Pull request' builds changes *before* they are merged into the `main` branch, which is for pre-merge validation, not for building production images *from* the `main` branch after approval.

Adding an OWNERS file to the trigger's included files filter is not the mechanism for enforcing branch approval or triggering production builds.

A Cloud Build trigger configured for 'Push to a branch' specifically targeting the `main` branch ensures that production image builds are automatically initiated only when new code is successfully committed to the designated production branch.

Configuring a branch protection rule for the `main` branch on the GitHub repository enforces that all pushes (typically via pull request merges) must be reviewed and approved by the change control team before they are integrated into `main`, thus satisfying the approval requirement.

While Cloud Build triggers can have an approval option, the primary mechanism for enforcing approvals *for pushes to the main branch itself* is via repository branch protection rules in GitHub; adding a Cloud Build approval after a push might add an unnecessary manual step if the `main` branch is already protected.