CodeGuru Build Break

0

Hi,

It is possible to configure a "Build Break" in AWS CI pipeline when CodeGuru detects issues/vulnerabilities?

2 Risposte
1

Hi, a simple way to achieve what you what is to use the CodeGuru CLI 'aws codeguru-reviewer describe-code-review" in the ad hoc step of your pipeline : https://docs.aws.amazon.com/cli/latest/reference/codeguru-reviewer/describe-code-review.html

The fornat of its output is at https://docs.aws.amazon.com/codeguru/latest/reviewer-api/API_DescribeCodeReview.html

You will loop on this command until "Status" is "Complete" and then use the value "FindingsCount" to decide if your shell script returns code 0 or not depending on findings. If your return error, the pipeline stage will fail and build will break

Best Didier

profile pictureAWS
ESPERTO
con risposta 10 mesi fa
  • Nicely done, Didier! Having a command line method of generating the output is exactly what is needed and will be an excellent way to stop the pipeline.

1

Very Interesting Idea! This doesn't seem to be very straightforward.

I read that CodeGuru could be kicked off from the command line https://docs.aws.amazon.com/codeguru/latest/profiler-ug/enabling-the-agent-with-command-line.html

Once the profiler executes, it would generate an event for the recommendations state change which would have full details, including severity of the issue. https://docs.aws.amazon.com/codeguru/latest/profiler-ug/working-with-eventbridge.html

The most challenging part would be developing a Lambda to react to this event and then issue a CodePipeline stop from SDK: https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_StopPipelineExecution.html

Happy coding! If this helps, please accept this answer.

profile picture
con risposta 10 mesi fa

Accesso non effettuato. Accedi per postare una risposta.

Una buona risposta soddisfa chiaramente la domanda, fornisce un feedback costruttivo e incoraggia la crescita professionale del richiedente.

Linee guida per rispondere alle domande