Secure your code as it's written. Use Snyk Code to scan source code in minutes - no build needed - and fix issues immediately.
)
// Allow access to secret environment variables in Parameter Store required for tests
role.addToPolicy(
new iam.PolicyStatement({
actions: ['ssm:GetParameters'],
resources: [
`arn:aws:ssm:${config.region}:${
config.accountIds.cicd
}:parameter/test/*`
]
})
)
super(scope, id, {
projectName: `${props.stageName}IntegrationTest`,
environment: {
buildImage: LinuxBuildImage.STANDARD_2_0
},
environmentVariables: {
SLIC_STAGE: {
type: BuildEnvironmentVariableType.PLAINTEXT,
value: props.stageName
},
CROSS_ACCOUNT_ID: {
type: BuildEnvironmentVariableType.PLAINTEXT,
value: `${config.accountIds[props.stageName]}`
},
MAILOSAUR_API_KEY: {
type: BuildEnvironmentVariableType.PARAMETER_STORE,
value: '/test/mailosaur/apiKey'
},
MAILOSAUR_SERVER_ID: {
type: BuildEnvironmentVariableType.PARAMETER_STORE,
// Allow access to secret environment variables in Parameter Store required for tests
role.addToPolicy(
new iam.PolicyStatement({
actions: ['ssm:GetParameters'],
resources: [
`arn:aws:ssm:${config.region}:${
config.accountIds.cicd
}:parameter/test/*`
]
})
)
super(scope, id, {
projectName: `${props.stageName}E2ETest`,
environment: {
buildImage: LinuxBuildImage.STANDARD_2_0
},
environmentVariables: {
SLIC_STAGE: {
type: BuildEnvironmentVariableType.PLAINTEXT,
value: props.stageName
},
CROSS_ACCOUNT_ID: {
type: BuildEnvironmentVariableType.PLAINTEXT,
value: `${config.accountIds[props.stageName]}`
},
MAILOSAUR_API_KEY: {
type: BuildEnvironmentVariableType.PARAMETER_STORE,
value: '/test/mailosaur/apiKey'
},
MAILOSAUR_SERVER_ID: {
type: BuildEnvironmentVariableType.PARAMETER_STORE,
const sourceAction = new S3SourceAction({
bucket: artifactsBucket,
bucketKey: `${stageName}_module_pipelines/module_source/${moduleName}.zip`,
output: sourceOutputArtifact,
trigger: S3Trigger.EVENTS, // Use EVENTS instead of POLL to avoid triggering. We won't set up CloudTrail for S3.
actionName: `${moduleName}_src`,
role: pipelineRole
})
this.addStage({
stageName: 'Source',
actions: [sourceAction]
})
const environmentVars = {
CROSS_ACCOUNT_ID: {
type: BuildEnvironmentVariableType.PLAINTEXT,
value: `${config.accountIds[stageName]}`
},
TARGET_REGION: {
type: BuildEnvironmentVariableType.PLAINTEXT,
value: `${config.defaultRegions[stageName]}`
},
SLIC_STAGE: {
type: BuildEnvironmentVariableType.PLAINTEXT,
value: stageName
},
MODULE_NAME: {
type: BuildEnvironmentVariableType.PLAINTEXT,
value: moduleName
},
...projectEnvironmentVars
}
trigger: S3Trigger.EVENTS, // Use EVENTS instead of POLL to avoid triggering. We won't set up CloudTrail for S3.
actionName: `${moduleName}_src`,
role: pipelineRole
})
this.addStage({
stageName: 'Source',
actions: [sourceAction]
})
const environmentVars = {
CROSS_ACCOUNT_ID: {
type: BuildEnvironmentVariableType.PLAINTEXT,
value: `${config.accountIds[stageName]}`
},
TARGET_REGION: {
type: BuildEnvironmentVariableType.PLAINTEXT,
value: `${config.defaultRegions[stageName]}`
},
SLIC_STAGE: {
type: BuildEnvironmentVariableType.PLAINTEXT,
value: stageName
},
MODULE_NAME: {
type: BuildEnvironmentVariableType.PLAINTEXT,
value: moduleName
},
...projectEnvironmentVars
}
const moduleBuildOutputArtifact = new Artifact()
const moduleBuildAction = new CodeBuildAction({
actionName: 'Build',
installCmds.push('npm i -g npm')
installCmds.push('npm ci')
buildCmds.push('npm run build')
postBuildCmds.push('npm run test')
const deployEnv = `BRANCH_NAME=${this.branchName} DEPLOY_MODE=${this.mode}`
postBuildCmds.push(`${deployEnv} NO_PROFILE_CHECK=true npm run deploy`)
const install = { commands: installCmds }
const build = { commands: buildCmds }
const postBuild = { commands: postBuildCmds }
const phases = { build, install, post_build: postBuild }
const buildSpec = { phases, version: '0.2' }
const role = this.role
const projectConfig = { buildSpec, environment, role }
const project = new CB.PipelineProject(this, 'BuildProject', projectConfig)
const stage = this.pipeline.addStage('BuildStage', { placement })
const buildProps = { project, stage }
// tslint:disable-next-line:no-unused-expression
new CB.PipelineBuildAction(this, 'CodeBuild', buildProps)
}
super(parent, name, props);
const repository = new Repository(this, 'Repository', {
repositoryName: 'MyRepositoryName',
description: 'Some description.', // optional property
});
const sourceArtifact = new Artifact();
const sourceAction = new CodeCommitSourceAction({
actionName: 'CodeCommit',
repository,
output: sourceArtifact,
});
const project = new PipelineProject(this, 'MyProject');
const buildAction = new CodeBuildAction({
actionName: 'CodeBuild',
project,
input: sourceArtifact,
});
const slackBotToken = process.env.SLACK_BOT_TOKEN as string;
const slackSigningSecret = process.env.SLACK_SIGNING_SECRET as string;
const slackChannel = process.env.SLACK_CHANNEL as string;
const approvalAction = new SlackApprovalAction({
actionName: 'SlackApproval',
slackBotToken,
slackSigningSecret,
slackChannel,
//removalPolicy: cdk.RemovalPolicy.DESTROY, // NOT recommended for production code
});
coffeeShopBucket.grantPut(buildRole);
coffeeShopBucket.grantRead(buildRole);
coffeeShopBucket.grantReadWrite(buildRole);
coffeeShopBucket.grantWrite(buildRole);
new codebuild.Project(this, 'CodeBuildProject', {
role: buildRole,
source: defaultSource,
// Enable Docker AND custom caching
cache: codebuild.Cache.local(codebuild.LocalCacheMode.DOCKER_LAYER, codebuild.LocalCacheMode.CUSTOM),
environment: {
buildImage: codebuild.LinuxBuildImage.AMAZON_LINUX_2,
privileged: true,
},
buildSpec: codebuild.BuildSpec.fromObject({
version: '0.2',
phases: {
install:{
'runtime-versions': {
java: 'corretto8'
}
},
build: {
commands: [
'echo "Build all modules"',
'echo "Run Maven clean install to have all the required jars in local .m2 repository"',
'cd sources/coffeeshop',
'mvn clean install -Dmaven.test.skip=true'
postBuildCmds.push('npm run test')
const deployEnv = `BRANCH_NAME=${this.branchName} DEPLOY_MODE=${this.mode}`
postBuildCmds.push(`${deployEnv} NO_PROFILE_CHECK=true npm run deploy`)
const install = { commands: installCmds }
const build = { commands: buildCmds }
const postBuild = { commands: postBuildCmds }
const phases = { build, install, post_build: postBuild }
const buildSpec = { phases, version: '0.2' }
const role = this.role
const projectConfig = { buildSpec, environment, role }
const project = new CB.PipelineProject(this, 'BuildProject', projectConfig)
const stage = this.pipeline.addStage('BuildStage', { placement })
const buildProps = { project, stage }
// tslint:disable-next-line:no-unused-expression
new CB.PipelineBuildAction(this, 'CodeBuild', buildProps)
}
let bucketName = 'coffeeshop-' + Math.random().toString(36).substring(7);
const coffeeShopBucket = new s3.Bucket(this, 'CoffeeShopBucket', {
bucketName: bucketName,
// The default removal policy is RETAIN, which means that cdk destroy will not attempt to delete
// the new bucket, and it will remain in your account until manually deleted. By setting the policy to
// DESTROY, cdk destroy will attempt to delete the bucket, but will error if the bucket is not empty.
//removalPolicy: cdk.RemovalPolicy.DESTROY, // NOT recommended for production code
});
coffeeShopBucket.grantPut(buildRole);
coffeeShopBucket.grantRead(buildRole);
coffeeShopBucket.grantReadWrite(buildRole);
coffeeShopBucket.grantWrite(buildRole);
new codebuild.Project(this, 'CodeBuildProject', {
role: buildRole,
source: defaultSource,
// Enable Docker AND custom caching
cache: codebuild.Cache.local(codebuild.LocalCacheMode.DOCKER_LAYER, codebuild.LocalCacheMode.CUSTOM),
environment: {
buildImage: codebuild.LinuxBuildImage.AMAZON_LINUX_2,
privileged: true,
},
buildSpec: codebuild.BuildSpec.fromObject({
version: '0.2',
phases: {
install:{
'runtime-versions': {
java: 'corretto8'
}
},
// the new bucket, and it will remain in your account until manually deleted. By setting the policy to
// DESTROY, cdk destroy will attempt to delete the bucket, but will error if the bucket is not empty.
//removalPolicy: cdk.RemovalPolicy.DESTROY, // NOT recommended for production code
});
coffeeShopBucket.grantPut(buildRole);
coffeeShopBucket.grantRead(buildRole);
coffeeShopBucket.grantReadWrite(buildRole);
coffeeShopBucket.grantWrite(buildRole);
new codebuild.Project(this, 'CodeBuildProject', {
role: buildRole,
source: defaultSource,
// Enable Docker AND custom caching
cache: codebuild.Cache.local(codebuild.LocalCacheMode.DOCKER_LAYER, codebuild.LocalCacheMode.CUSTOM),
environment: {
buildImage: codebuild.LinuxBuildImage.AMAZON_LINUX_2,
privileged: true,
},
buildSpec: codebuild.BuildSpec.fromObject({
version: '0.2',
phases: {
install:{
'runtime-versions': {
java: 'corretto8'
}
},
build: {
commands: [
'echo "Build all modules"',
'echo "Run Maven clean install to have all the required jars in local .m2 repository"',