CodeGuru Build Break

0

Hi,

It is possible to configure a "Build Break" in AWS CI pipeline when CodeGuru detects issues/vulnerabilities?

MartinB
已提問 10 個月前檢視次數 341 次
2 個答案
1

Hi, a simple way to achieve what you what is to use the CodeGuru CLI 'aws codeguru-reviewer describe-code-review" in the ad hoc step of your pipeline : https://docs.aws.amazon.com/cli/latest/reference/codeguru-reviewer/describe-code-review.html

The fornat of its output is at https://docs.aws.amazon.com/codeguru/latest/reviewer-api/API_DescribeCodeReview.html

You will loop on this command until "Status" is "Complete" and then use the value "FindingsCount" to decide if your shell script returns code 0 or not depending on findings. If your return error, the pipeline stage will fail and build will break

Best Didier

profile pictureAWS
專家
已回答 10 個月前
  • Nicely done, Didier! Having a command line method of generating the output is exactly what is needed and will be an excellent way to stop the pipeline.

1

Very Interesting Idea! This doesn't seem to be very straightforward.

I read that CodeGuru could be kicked off from the command line https://docs.aws.amazon.com/codeguru/latest/profiler-ug/enabling-the-agent-with-command-line.html

Once the profiler executes, it would generate an event for the recommendations state change which would have full details, including severity of the issue. https://docs.aws.amazon.com/codeguru/latest/profiler-ug/working-with-eventbridge.html

The most challenging part would be developing a Lambda to react to this event and then issue a CodePipeline stop from SDK: https://docs.aws.amazon.com/codepipeline/latest/APIReference/API_StopPipelineExecution.html

Happy coding! If this helps, please accept this answer.

profile picture
已回答 10 個月前

您尚未登入。 登入 去張貼答案。

一個好的回答可以清楚地回答問題並提供建設性的意見回饋,同時有助於提問者的專業成長。

回答問題指南