feat(codepipeline-actions): support `InspectorEcrImageScanAction` and `InspectorSourceCodeScanAction` actions #33378

go-to-k · 2025-02-11T08:00:09Z

Issue # (if applicable)

Closes #33377.

Reason for this change

AWS CodePipeline introduces new build action: InspectorScan action.

Description of changes

Add InspectorEcrImageScanAction and InspectorSourceCodeScanAction classes that extends BaseInspectorScan class.

The BaseInspectorScan class that extends Action class to aws-codepipeline-actions module.

Describe any new or updated permissions being added

Description of how you validated changes

Both unit and integ tests

Checklist

My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

aws-cdk-automation

(This review is outdated)

codecov · 2025-02-11T08:43:08Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 81.00%. Comparing base (c400e0e) to head (779d8e3).
Report is 47 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main   #33378      +/-   ##
==========================================
+ Coverage   80.92%   81.00%   +0.07%     
==========================================
  Files         236      238       +2     
  Lines       14256    14271      +15     
  Branches     2491     2492       +1     
==========================================
+ Hits        11537    11560      +23     
+ Misses       2434     2425       -9     
- Partials      285      286       +1

Flag	Coverage Δ
suite.unit	`81.00% <ø> (+0.07%)`	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
packages/aws-cdk	`79.92% <ø> (+0.18%)`	⬆️
packages/aws-cdk-lib/core	`82.16% <ø> (-0.05%)`	⬇️

go-to-k · 2025-02-14T13:29:05Z

.../aws-cdk-lib/aws-codepipeline-actions/test/inspector/inspector-ecr-image-scan-action.test.ts

+  test('can get variables', () => {
+    // WHEN
+    const inspectorEcrImageScanAction = new cpactions.InspectorEcrImageScanAction({
+      actionName: 'InspectorScan',
+      output: scanOutput,
+      repository,
+    });
+
+    // THEN
+    expect(inspectorEcrImageScanAction.variables.highestScannedSeverity).toMatch(/^#{\${Token\[TOKEN\.[0-9]*\]}.HighestScannedSeverity}$/);
+  });


This and other common code are about the common behavior of the base class.

But as users are not aware of the base class because they call the subclasses directly, and in case there are any changes by contributors, it is also confirmation for regressions in the subclasses. Therefore, the tests in inspector-ecr-image-scan-action.test.ts and inspector-source-code-scan-action.test.ts are partially identical.
This also makes the test useful even if the base class is deleted and each class is implemented independently in the future.

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

aws-cdk-automation

(This review is outdated)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

aws-cdk-automation

(This review is outdated)

go-to-k · 2025-02-14T15:30:00Z

Exemption Request:

❌ CodeCov is indicating a drop in code coverage

Should already have written unit tests that cover the code I have added.

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

aws-cdk-automation

The pull request linter fails with the following errors:

❌ CodeCov is indicating a drop in code coverage

If you believe this pull request should receive an exemption, please comment and provide a justification. A comment requesting an exemption should contain the text Exemption Request. Additionally, if clarification is needed, add Clarification Request to a comment.

✅ A exemption request has been requested. Please wait for a maintainer's review.

aws-cdk-automation · 2025-02-14T16:16:35Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: 779d8e3
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

go-to-k · 2025-02-17T09:09:44Z

packages/aws-cdk-lib/aws-codepipeline-actions/lib/inspector/scan-action-base.ts

+   * Valid values are medium | high | critical.
+   */
+  readonly highestScannedSeverity: string;


This is not input to the construct, but output from the pipeline, which is a string formatted with the variableExpression method. Therefore, it cannot be an enum.

go-to-k · 2025-02-17T09:14:04Z

packages/aws-cdk-lib/aws-codepipeline-actions/lib/inspector/ecr-image-scan-action.ts

+    // This permission was not listed in the above reference, but without it,
+    // an error would occur since `ecr get-login-password` is executed in the action.
+    options.role.addToPrincipalPolicy(new iam.PolicyStatement({
+      resources: ['*'],
+      actions: [
+        'ecr:GetAuthorizationToken',
+      ],


The error message by CFn requested a wildcard for resources.

feat(codepipeline-actions): support InspectorScan invoke action

b65a7ec

aws-cdk-automation requested a review from a team February 11, 2025 08:00

github-actions bot added feature-request A feature should be added or improved. p2 distinguished-contributor [Pilot] contributed 50+ PRs to the CDK labels Feb 11, 2025

aws-cdk-automation previously requested changes Feb 11, 2025

View reviewed changes

implemented class without todo

52b96ee

filename

3ec6f77

go-to-k changed the title ~~feat(codepipeline-actions): support InspectorScan invoke action~~ feat(codepipeline-actions): support InspectorScan action Feb 11, 2025

refactor with EcrImageScanAction and SourceCodeScanAction

3624f58

go-to-k changed the title ~~feat(codepipeline-actions): support InspectorScan action~~ feat(codepipeline-actions): support EcrImageScanAction and SourceCodeScanAction action Feb 11, 2025

go-to-k changed the title ~~feat(codepipeline-actions): support EcrImageScanAction and SourceCodeScanAction action~~ feat(codepipeline-actions): support EcrImageScanAction and SourceCodeScanAction actions Feb 11, 2025

class names

c6ab25c

go-to-k changed the title ~~feat(codepipeline-actions): support EcrImageScanAction and SourceCodeScanAction actions~~ feat(codepipeline-actions): support InspectorEcrImageScanAction and InspectorSourceCodeScanAction actions Feb 11, 2025

go-to-k added 13 commits February 11, 2025 20:40

filenames

4c0e0b0

jsdoc

abfba63

integ for source scan

ea99afa

renderActionConfiguration

05f41b5

ecr:GetAuthorizationToken

4b89baf

integ

41afadb

comment

ad0f227

comment

be4da86

comments

90643d9

comments

e62b4cc

integ and snapshots with MOCK

519d087

comments

e545b9c

unit tests

ac9f823

github-actions bot added the effort/medium Medium work item – several days of effort label Feb 14, 2025

go-to-k commented Feb 14, 2025

View reviewed changes

go-to-k added 3 commits February 14, 2025 22:33

add test

6a415d8

README

a70091d

var names in integs

fab68f7

go-to-k marked this pull request as ready for review February 14, 2025 14:35

for rosetta

58a1d00

aws-cdk-automation previously requested changes Feb 14, 2025

View reviewed changes

fix inspector-source-code-scan-action.test.ts

202ffcd

aws-cdk-automation previously requested changes Feb 14, 2025

View reviewed changes

aws-cdk-automation added the pr-linter/exemption-requested The contributor has requested an exemption to the PR Linter feedback. label Feb 14, 2025

rosetta

779d8e3

aws-cdk-automation requested changes Feb 14, 2025

View reviewed changes

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Feb 14, 2025

go-to-k commented Feb 17, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(codepipeline-actions): support `InspectorEcrImageScanAction` and `InspectorSourceCodeScanAction` actions #33378

feat(codepipeline-actions): support `InspectorEcrImageScanAction` and `InspectorSourceCodeScanAction` actions #33378

go-to-k commented Feb 11, 2025 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

codecov bot commented Feb 11, 2025 •

edited

Loading

go-to-k Feb 14, 2025 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

go-to-k commented Feb 14, 2025

aws-cdk-automation left a comment

aws-cdk-automation commented Feb 14, 2025

go-to-k Feb 17, 2025

go-to-k Feb 17, 2025 •

edited

Loading

feat(codepipeline-actions): support InspectorEcrImageScanAction and InspectorSourceCodeScanAction actions #33378

Are you sure you want to change the base?

feat(codepipeline-actions): support InspectorEcrImageScanAction and InspectorSourceCodeScanAction actions #33378

Conversation

go-to-k commented Feb 11, 2025 • edited Loading

Issue # (if applicable)

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

aws-cdk-automation left a comment • edited Loading

Choose a reason for hiding this comment

codecov bot commented Feb 11, 2025 • edited Loading

Codecov Report

go-to-k Feb 14, 2025 • edited Loading

Choose a reason for hiding this comment

aws-cdk-automation left a comment • edited Loading

Choose a reason for hiding this comment

aws-cdk-automation left a comment • edited Loading

Choose a reason for hiding this comment

go-to-k commented Feb 14, 2025

aws-cdk-automation left a comment

Choose a reason for hiding this comment

aws-cdk-automation commented Feb 14, 2025

AWS CodeBuild CI Report

go-to-k Feb 17, 2025

Choose a reason for hiding this comment

go-to-k Feb 17, 2025 • edited Loading

Choose a reason for hiding this comment

feat(codepipeline-actions): support `InspectorEcrImageScanAction` and `InspectorSourceCodeScanAction` actions #33378

feat(codepipeline-actions): support `InspectorEcrImageScanAction` and `InspectorSourceCodeScanAction` actions #33378

go-to-k commented Feb 11, 2025 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

codecov bot commented Feb 11, 2025 •

edited

Loading

go-to-k Feb 14, 2025 •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

aws-cdk-automation left a comment •

edited

Loading

go-to-k Feb 17, 2025 •

edited

Loading