CDK 2 CodeBuild with GitHubSourceAction not fetching source code

[crucialfelix]

Hello! We've been running a CodeBuild Pipeline for several years–managed with CDK 1. I've just updated to CDK 2.

Everything worked, except our deploys are failing. The GitHubSourceAction doesn't seem to be checking anything out. There is no source code.

I've diffed pre and post migration and besides the imports, nothing has changed really on my side.

Simplified:

import { RemovalPolicy, SecretValue, Stack, StackProps } from "aws-cdk-lib";
import {
  Artifacts,
  BuildSpec,
  LinuxBuildImage,
  Project
} from "aws-cdk-lib/aws-codebuild";
import { Artifact } from "aws-cdk-lib/aws-codepipeline";
import codepipeline = require("aws-cdk-lib/aws-codepipeline");
import {
  CodeBuildAction,
  GitHubSourceAction
} from "aws-cdk-lib/aws-codepipeline-actions";
import { Repository } from "aws-cdk-lib/aws-ecr";
import { Role, ServicePrincipal } from "aws-cdk-lib/aws-iam";
import { Bucket } from "aws-cdk-lib/aws-s3";
import { Construct } from "constructs";

interface Props extends StackProps {
  prod: boolean;
  gitHubToken: string;
  repositoryName: string;
  uniqueSuffix: string;
}

export class Pipeline extends Construct {
  constructor(scope: Construct, id: string, props: Props) {
    super(scope, id);

    const gitHubRepo = "company";
    const gitHubUser = "user";

    const { prod, gitHubToken, repositoryName, uniqueSuffix } = props;

    const gitHubBranch = prod ? "master" : "develop";
    const stage = prod ? "production" : "staging";
    const Stage = prod ? "Production" : "Staging";

    const repository = new Repository(this, "ECR", {
      repositoryName
    });

    const codeBuildServiceRole = new Role(this, "CodeBuildServiceRole", {
      assumedBy: new ServicePrincipal("codebuild.amazonaws.com")
    });
    codeBuildServiceRole.addManagedPolicy({
      managedPolicyArn: "arn:aws:iam::aws:policy/AmazonS3FullAccess"
    });
    codeBuildServiceRole.addManagedPolicy({
      managedPolicyArn: "arn:aws:iam::aws:policy/CloudWatchLogsFullAccess"
    });
    codeBuildServiceRole.addManagedPolicy({
      managedPolicyArn:
        "arn:aws:iam::aws:policy/AmazonEC2ContainerRegistryPowerUser"
    });

    // no longer needed?
    const artifactBucket = new Bucket(this, "CodeBuildArtifactBucket", {
      bucketName: `code-build-artifacts.${stage}${uniqueSuffix}.company.com`,
      removalPolicy: RemovalPolicy.DESTROY
    });

    const codeBuildProject = new Project(this, "CodeBuildProject", {
      artifacts: Artifacts.s3({
        name: artifactBucket.bucketName,
        bucket: artifactBucket
      }),

      // I tried this What is this source?
      // errors with "authentication required for primary source"
      // Where do you supply credentials?
      // source: Source.gitHub({
      //   owner: gitHubUser,
      //   repo: gitHubRepo,
      //   branchOrRef: gitHubBranch
      //   // reportBuildStatus: true,
      //   // oauthToken: SecretValue.unsafePlainText(gitHubToken)
      // }),

      environment: {
        // >= STANDARD_2_0 is required in order to specify a custom node version
        // else the default is v10.19.0 which is too old for our needs
        buildImage: LinuxBuildImage.STANDARD_6_0,
        environmentVariables: {
          REPOSITORY_URI: { value: repository.repositoryUri },
          STAGE: { value: stage }
        }
      },
      buildSpec: BuildSpec.fromObject(this.buildSpec()),
      role: codeBuildServiceRole
    });

    const sourceCode = new Artifact("SourceCode");
    const buildOutput = new Artifact("BuildOutput");

    const pipeline = new codepipeline.Pipeline(this, "CodePipeline", {
      artifactBucket,
      pipelineName: Stage,
      restartExecutionOnUpdate: true,

      stages: [
        {
          stageName: "Source",
          actions: [
            new GitHubSourceAction({
              actionName: "FetchSource",
              // outputs to the sourceCode artifact
              output: sourceCode,
              owner: gitHubUser,
              repo: gitHubRepo,
              branch: gitHubBranch,
              oauthToken: SecretValue.unsafePlainText(gitHubToken)
            })
          ]
        },
        {
          stageName: "Build",
          actions: [
            // this runs the codeBuildProject
            new CodeBuildAction({
              actionName: "Build",
              // input is the sourceCode artficat that was the output of the Source stage
              input: sourceCode,
              outputs: [buildOutput],
              // the project contains the build steps
              project: codeBuildProject
            })
          ]
        }
        // stage Migrate
        // stage Deploy
      ]
    });
  }

  buildSpec() {
    // https://docs.aws.amazon.com/codebuild/latest/userguide/build-spec-ref.html#build-spec-ref-example
    return {
      version: 0.2,
      phases: {
        // I never had a download_source phase because the GitHubSourceAction runs in the Source stage above.
        // So it succeeds instantly because there is no phase to run.
        // [Container] 2023/01/26 13:08:15 Phase complete: DOWNLOAD_SOURCE State: SUCCEEDED
        // [Container] 2023/01/26 13:08:15 Phase context status code:  Message:

        install: {
          "runtime-versions": {
            nodejs: "16.x"
          }
          // [Container] 2023/01/26 13:08:15 Entering phase INSTALL
          // [Container] 2023/01/26 13:08:15 Phase complete: INSTALL State: SUCCEEDED
          // [Container] 2023/01/26 13:08:15 Phase context status code:  Message:
        },
        pre_build: {
          commands: [
            "echo pre_build pwd: $(pwd)",
            "ls -la"

            // [Container] 2023/01/26 13:08:15 Entering phase PRE_BUILD
            // [Container] 2023/01/26 13:08:15 Running command echo pre_build pwd: $(pwd)
            // pre_build pwd: /codebuild/output/src438679302/src

            // [Container] 2023/01/26 13:08:15 Running command ls -la
            // total 0
            // drwxr-xr-x 3 root root 22 Jan 26 13:05 .
            // drwxr-xr-x 3 root root 17 Jan 26 13:04 ..
          ]
        },
        build: {
          commands: [
            // there is nothing here, no source code
            "echo pwd: $(pwd)",
            "ls -la"

            // normally there are the actual build commands here
            // "echo Build frontend",
            // yarn build frontend
            // docker build backend
          ]
        },
        post_build: {
          commands: [
            // push to ECR
            // upload built static files to S3
          ]
        }
      }
    };
  }
}

What is this Source.gitHub ? If I try to supply it, it fails because of course there are no credentials.

      source: Source.gitHub({
        owner: gitHubUser,
        repo: gitHubRepo,
        branchOrRef: gitHubBranch
        // reportBuildStatus: true,
        // oauthToken: SecretValue.unsafePlainText(gitHubToken)
      }),

Thanks for any help or pointers!

[crucialfelix]

It seems it silently fails (or doesn't try at all) because of SecretValue.unsafePlainText(gitHubToken)

Using a proper SecretManager secret causes it to actually call Github