CodeGuru Build Break

0

Hi,

It is possible to configure a "Build Break" in AWS CI pipeline when CodeGuru detects issues/vulnerabilities?

2 Answers
1

Hi, a simple way to achieve what you what is to use the CodeGuru CLI 'aws codeguru-reviewer describe-code-review" in the ad hoc step of your pipeline : https://docs.aws.amazon.com/cli/latest/reference/codeguru-reviewer/describe-code-review.html

The fornat of its output is at https://docs.aws.amazon.com/codeguru/latest/reviewer-api/API_DescribeCodeReview.html

You will loop on this command until "Status" is "Complete" and then use the value "FindingsCount" to decide if your shell script returns code 0 or not depending on findings. If your return error, the pipeline stage will fail and build will break

Best Didier

profile pictureAWS
EXPERT
answered 9 months ago
  • Nicely done, Didier! Having a command line method of generating the output is exactly what is needed and will be an excellent way to stop the pipeline.

1

Very Interesting Idea! This doesn't seem to be very straightforward.

I read that CodeGuru could be kicked off from the command line https://docs.aws.amazon.com/codeguru/latest/profiler-ug/enabling-the-agent-with-command-line.html

Once the profiler executes, it would generate an event for the recommendations state change which would have full details, including severity of the issue. https://docs.aws.amazon.com/codeguru/latest/profiler-ug/working-with-eventbridge.html

The most challenging part would be developing a Lambda to react to this event and then issue a CodePipeline stop from SDK: https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_StopPipelineExecution.html

Happy coding! If this helps, please accept this answer.

profile picture
answered 9 months ago

You are not logged in. Log in to post an answer.

A good answer clearly answers the question and provides constructive feedback and encourages professional growth in the question asker.

Guidelines for Answering Questions