CodeGuru Build Break

0

Hi,

It is possible to configure a "Build Break" in AWS CI pipeline when CodeGuru detects issues/vulnerabilities?

2 Respuestas
1

Hi, a simple way to achieve what you what is to use the CodeGuru CLI 'aws codeguru-reviewer describe-code-review" in the ad hoc step of your pipeline : https://docs.aws.amazon.com/cli/latest/reference/codeguru-reviewer/describe-code-review.html

The fornat of its output is at https://docs.aws.amazon.com/codeguru/latest/reviewer-api/API_DescribeCodeReview.html

You will loop on this command until "Status" is "Complete" and then use the value "FindingsCount" to decide if your shell script returns code 0 or not depending on findings. If your return error, the pipeline stage will fail and build will break

Best Didier

profile pictureAWS
EXPERTO
respondido hace 10 meses
  • Nicely done, Didier! Having a command line method of generating the output is exactly what is needed and will be an excellent way to stop the pipeline.

1

Very Interesting Idea! This doesn't seem to be very straightforward.

I read that CodeGuru could be kicked off from the command line https://docs.aws.amazon.com/codeguru/latest/profiler-ug/enabling-the-agent-with-command-line.html

Once the profiler executes, it would generate an event for the recommendations state change which would have full details, including severity of the issue. https://docs.aws.amazon.com/codeguru/latest/profiler-ug/working-with-eventbridge.html

The most challenging part would be developing a Lambda to react to this event and then issue a CodePipeline stop from SDK: https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_StopPipelineExecution.html

Happy coding! If this helps, please accept this answer.

profile picture
respondido hace 10 meses

No has iniciado sesión. Iniciar sesión para publicar una respuesta.

Una buena respuesta responde claramente a la pregunta, proporciona comentarios constructivos y fomenta el crecimiento profesional en la persona que hace la pregunta.

Pautas para responder preguntas