feat(codepipeline-actions): support `InspectorEcrImageScanAction` and `InspectorSourceCodeScanAction` actions #33378

go-to-k · 2025-02-11T08:00:09Z

Issue # (if applicable)

Closes #33377.

Reason for this change

AWS CodePipeline introduces new build action: InspectorScan action.

Description of changes

Add InspectorEcrImageScanAction and InspectorSourceCodeScanAction classes that extends BaseInspectorScan class.

The BaseInspectorScan class that extends Action class to aws-codepipeline-actions module.

Describe any new or updated permissions being added

Description of how you validated changes

Both unit and integ tests

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

aws-cdk-automation

(This review is outdated)

codecov · 2025-02-11T08:43:08Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 83.98%. Comparing base (3154d01) to head (231c074).

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #33378   +/-   ##
=======================================
  Coverage   83.98%   83.98%           
=======================================
  Files         120      120           
  Lines        6976     6976           
  Branches     1178     1178           
=======================================
  Hits         5859     5859           
  Misses       1005     1005           
  Partials      112      112

Flag	Coverage Δ
suite.unit	`83.98% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
packages/aws-cdk	`∅ <ø> (∅)`
packages/aws-cdk-lib/core	`83.98% <ø> (ø)`

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

go-to-k · 2025-02-14T13:29:05Z

.../aws-cdk-lib/aws-codepipeline-actions/test/inspector/inspector-ecr-image-scan-action.test.ts

+  test('can get variables', () => {
+    // WHEN
+    const inspectorEcrImageScanAction = new cpactions.InspectorEcrImageScanAction({
+      actionName: 'InspectorScan',
+      output: scanOutput,
+      repository,
+    });
+
+    // THEN
+    expect(inspectorEcrImageScanAction.variables.highestScannedSeverity).toMatch(/^#{\${Token\[TOKEN\.[0-9]*\]}.HighestScannedSeverity}$/);
+  });


This and other common code are about the common behavior of the base class.

But as users are not aware of the base class because they call the subclasses directly, and in case there are any changes by contributors, it is also confirmation for regressions in the subclasses. Therefore, the tests in inspector-ecr-image-scan-action.test.ts and inspector-source-code-scan-action.test.ts are partially identical.
This also makes the test useful even if the base class is deleted and each class is implemented independently in the future.

5d

LGTM

5d · 2025-04-01T17:37:09Z

Great work! 👍 Thanks

go-to-k · 2025-04-01T18:05:28Z

@Mergifyio update

mergify · 2025-04-01T18:05:36Z

update

❌ Mergify doesn't have permission to update

For security reasons, Mergify can't update this pull request. Try updating locally.
GitHub response: refusing to allow a GitHub App to create or update workflow .github/workflows/README.md without workflows permission

go-to-k · 2025-04-01T18:08:21Z

@5d
Thanks for your approval!

But the merge process doesn't seem to be running. Could you please address this?

shikha372 · 2025-04-01T18:19:02Z

@Mergifyio update

mergify · 2025-04-01T18:19:12Z

update

❌ Mergify doesn't have permission to update

For security reasons, Mergify can't update this pull request. Try updating locally.
GitHub response: refusing to allow a GitHub App to create or update workflow .github/workflows/README.md without workflows permission

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

Pull request has been modified.

go-to-k · 2025-04-02T12:55:34Z

@5d @shikha372

I updated the branch locally to address the mergify error.

In addition, the following changes were made:

The link on the cp-action's reference page seems to have changed in the last few days, so I changed that as well.
- commit: 6cfd08c
The already existing method for ecr:GetAuthorizationToken is now used.
- commit: 81c8c5c
A vulnerability was found in the Dockerfile for the integ test and the scan failed, so the threshold in the test was changed to avoid the error.
- commit: b6edaf8
Since the feature flag (@aws-cdk/pipelines:reduceStageRoleTrustScope) was introduced in this PR, changes to the snapshot occur unless specified in the integ tests. So specified the flag in the integ tests.
- commit: bdb589d

Could you please check it again and merge it if you are okay?

5d

LGTM

mergify · 2025-04-02T17:44:50Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

mergify · 2025-04-02T17:48:44Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

aws-cdk-automation · 2025-04-02T18:48:04Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: 231c074
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

mergify · 2025-04-02T18:48:15Z

Thank you for contributing! Your pull request will be updated from main and then merged automatically (do not update manually, and be sure to allow changes to be pushed to your fork).

github-actions · 2025-04-02T18:48:28Z

Comments on closed issues and PRs are hard for our team to see.
If you need help, please open a new issue that references this one.

feat(codepipeline-actions): support InspectorScan invoke action

b65a7ec

aws-cdk-automation requested a review from a team February 11, 2025 08:00

github-actions bot added feature-request A feature should be added or improved. p2 distinguished-contributor [Pilot] contributed 50+ PRs to the CDK labels Feb 11, 2025

aws-cdk-automation previously requested changes Feb 11, 2025

View reviewed changes

implemented class without todo

52b96ee

filename

3ec6f77

go-to-k changed the title ~~feat(codepipeline-actions): support InspectorScan invoke action~~ feat(codepipeline-actions): support InspectorScan action Feb 11, 2025

refactor with EcrImageScanAction and SourceCodeScanAction

3624f58

go-to-k changed the title ~~feat(codepipeline-actions): support InspectorScan action~~ feat(codepipeline-actions): support EcrImageScanAction and SourceCodeScanAction action Feb 11, 2025

go-to-k changed the title ~~feat(codepipeline-actions): support EcrImageScanAction and SourceCodeScanAction action~~ feat(codepipeline-actions): support EcrImageScanAction and SourceCodeScanAction actions Feb 11, 2025

class names

c6ab25c

go-to-k changed the title ~~feat(codepipeline-actions): support EcrImageScanAction and SourceCodeScanAction actions~~ feat(codepipeline-actions): support InspectorEcrImageScanAction and InspectorSourceCodeScanAction actions Feb 11, 2025

go-to-k added 13 commits February 11, 2025 20:40

filenames

4c0e0b0

jsdoc

abfba63

integ for source scan

ea99afa

renderActionConfiguration

05f41b5

ecr:GetAuthorizationToken

4b89baf

integ

41afadb

comment

ad0f227

comment

be4da86

comments

90643d9

comments

e62b4cc

integ and snapshots with MOCK

519d087

comments

e545b9c

unit tests

ac9f823

github-actions bot added the effort/medium Medium work item – several days of effort label Feb 14, 2025

go-to-k commented Feb 14, 2025

View reviewed changes

5d self-assigned this Mar 13, 2025

go-to-k mentioned this pull request Mar 14, 2025

feat(codepipeline-actions): support ECRBuildAndPublish action #33375

Merged

1 task

5d previously approved these changes Apr 1, 2025

View reviewed changes

aws-cdk-automation removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Apr 1, 2025

go-to-k added 2 commits April 2, 2025 19:52

Merge branch 'main' into cp-actions-inspector-scan

a832486

change links

6cfd08c

use AuthorizationToken.grantRead

81c8c5c

go-to-k added 2 commits April 2, 2025 20:51

change Threshold in integ

b6edaf8

change integ tests and snapshots

bdb589d

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Apr 2, 2025

5d approved these changes Apr 2, 2025

View reviewed changes

aws-cdk-automation removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Apr 2, 2025

Merge branch 'main' into cp-actions-inspector-scan

231c074

mergify bot merged commit 2dc8cc7 into aws:main Apr 2, 2025
20 checks passed

github-actions bot locked as resolved and limited conversation to collaborators Apr 2, 2025

go-to-k deleted the cp-actions-inspector-scan branch April 3, 2025 01:11

feat(codepipeline-actions): support InspectorEcrImageScanAction and InspectorSourceCodeScanAction actions #33378

feat(codepipeline-actions): support InspectorEcrImageScanAction and InspectorSourceCodeScanAction actions #33378

Uh oh!

Conversation

go-to-k commented Feb 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Issue # (if applicable)

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

Uh oh!

aws-cdk-automation left a comment • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

codecov bot commented Feb 11, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

go-to-k Feb 14, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

5d left a comment

Choose a reason for hiding this comment

Uh oh!

5d commented Apr 1, 2025

Uh oh!

go-to-k commented Apr 1, 2025

Uh oh!

mergify bot commented Apr 1, 2025

❌ Mergify doesn't have permission to update

Uh oh!

go-to-k commented Apr 1, 2025

Uh oh!

shikha372 commented Apr 1, 2025

Uh oh!

mergify bot commented Apr 1, 2025

❌ Mergify doesn't have permission to update

Uh oh!

go-to-k commented Apr 2, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

5d left a comment

Choose a reason for hiding this comment

Uh oh!

mergify bot commented Apr 2, 2025

Uh oh!

mergify bot commented Apr 2, 2025

Uh oh!

aws-cdk-automation commented Apr 2, 2025

AWS CodeBuild CI Report

Uh oh!

Uh oh!

mergify bot commented Apr 2, 2025

Uh oh!

github-actions bot commented Apr 2, 2025

Uh oh!

Uh oh!

feat(codepipeline-actions): support `InspectorEcrImageScanAction` and `InspectorSourceCodeScanAction` actions #33378

feat(codepipeline-actions): support `InspectorEcrImageScanAction` and `InspectorSourceCodeScanAction` actions #33378

go-to-k commented Feb 11, 2025 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

codecov bot commented Feb 11, 2025 •

edited

Loading

go-to-k Feb 14, 2025 •

edited

Loading

go-to-k commented Apr 2, 2025 •

edited

Loading