Skip to content

Commit 14bb036

Browse files
author
awstools
committed
feat(client-codebuild): AWS CodeBuild now supports comment-based pull request control.
1 parent 79364bd commit 14bb036

File tree

5 files changed

+259
-2
lines changed

5 files changed

+259
-2
lines changed

clients/client-codebuild/src/commands/CreateWebhookCommand.ts

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -64,6 +64,12 @@ export interface CreateWebhookCommandOutput extends CreateWebhookOutput, __Metad
6464
* domain: "STRING_VALUE",
6565
* scope: "GITHUB_ORGANIZATION" || "GITHUB_GLOBAL" || "GITLAB_GROUP", // required
6666
* },
67+
* pullRequestBuildPolicy: { // PullRequestBuildPolicy
68+
* requiresCommentApproval: "DISABLED" || "ALL_PULL_REQUESTS" || "FORK_PULL_REQUESTS", // required
69+
* approverRoles: [ // PullRequestBuildApproverRoles
70+
* "GITHUB_READ" || "GITHUB_TRIAGE" || "GITHUB_WRITE" || "GITHUB_MAINTAIN" || "GITHUB_ADMIN" || "GITLAB_GUEST" || "GITLAB_PLANNER" || "GITLAB_REPORTER" || "GITLAB_DEVELOPER" || "GITLAB_MAINTAINER" || "GITLAB_OWNER" || "BITBUCKET_READ" || "BITBUCKET_WRITE" || "BITBUCKET_ADMIN",
71+
* ],
72+
* },
6773
* };
6874
* const command = new CreateWebhookCommand(input);
6975
* const response = await client.send(command);

clients/client-codebuild/src/commands/UpdateWebhookCommand.ts

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,12 @@ export interface UpdateWebhookCommandOutput extends UpdateWebhookOutput, __Metad
5353
* ],
5454
* ],
5555
* buildType: "BUILD" || "BUILD_BATCH" || "RUNNER_BUILDKITE_BUILD",
56+
* pullRequestBuildPolicy: { // PullRequestBuildPolicy
57+
* requiresCommentApproval: "DISABLED" || "ALL_PULL_REQUESTS" || "FORK_PULL_REQUESTS", // required
58+
* approverRoles: [ // PullRequestBuildApproverRoles
59+
* "GITHUB_READ" || "GITHUB_TRIAGE" || "GITHUB_WRITE" || "GITHUB_MAINTAIN" || "GITHUB_ADMIN" || "GITLAB_GUEST" || "GITLAB_PLANNER" || "GITLAB_REPORTER" || "GITLAB_DEVELOPER" || "GITLAB_MAINTAINER" || "GITLAB_OWNER" || "BITBUCKET_READ" || "BITBUCKET_WRITE" || "BITBUCKET_ADMIN",
60+
* ],
61+
* },
5662
* };
5763
* const command = new UpdateWebhookCommand(input);
5864
* const response = await client.send(command);

clients/client-codebuild/src/models/models_0.ts

Lines changed: 89 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -5979,6 +5979,81 @@ export interface CreateReportGroupOutput {
59795979
reportGroup?: ReportGroup | undefined;
59805980
}
59815981

5982+
/**
5983+
* @public
5984+
* @enum
5985+
*/
5986+
export const PullRequestBuildApproverRole = {
5987+
BITBUCKET_ADMIN: "BITBUCKET_ADMIN",
5988+
BITBUCKET_READ: "BITBUCKET_READ",
5989+
BITBUCKET_WRITE: "BITBUCKET_WRITE",
5990+
GITHUB_ADMIN: "GITHUB_ADMIN",
5991+
GITHUB_MAINTAIN: "GITHUB_MAINTAIN",
5992+
GITHUB_READ: "GITHUB_READ",
5993+
GITHUB_TRIAGE: "GITHUB_TRIAGE",
5994+
GITHUB_WRITE: "GITHUB_WRITE",
5995+
GITLAB_DEVELOPER: "GITLAB_DEVELOPER",
5996+
GITLAB_GUEST: "GITLAB_GUEST",
5997+
GITLAB_MAINTAINER: "GITLAB_MAINTAINER",
5998+
GITLAB_OWNER: "GITLAB_OWNER",
5999+
GITLAB_PLANNER: "GITLAB_PLANNER",
6000+
GITLAB_REPORTER: "GITLAB_REPORTER",
6001+
} as const;
6002+
6003+
/**
6004+
* @public
6005+
*/
6006+
export type PullRequestBuildApproverRole =
6007+
(typeof PullRequestBuildApproverRole)[keyof typeof PullRequestBuildApproverRole];
6008+
6009+
/**
6010+
* @public
6011+
* @enum
6012+
*/
6013+
export const PullRequestBuildCommentApproval = {
6014+
ALL_PULL_REQUESTS: "ALL_PULL_REQUESTS",
6015+
DISABLED: "DISABLED",
6016+
FORK_PULL_REQUESTS: "FORK_PULL_REQUESTS",
6017+
} as const;
6018+
6019+
/**
6020+
* @public
6021+
*/
6022+
export type PullRequestBuildCommentApproval =
6023+
(typeof PullRequestBuildCommentApproval)[keyof typeof PullRequestBuildCommentApproval];
6024+
6025+
/**
6026+
* <p>Configuration policy that defines comment-based approval requirements for triggering builds on pull requests. This policy helps control when automated builds are executed based on contributor permissions and approval workflows.</p>
6027+
* @public
6028+
*/
6029+
export interface PullRequestBuildPolicy {
6030+
/**
6031+
* <p>Specifies when comment-based approval is required before triggering a build on pull requests. This setting determines whether builds run automatically or require explicit approval through comments.</p>
6032+
* <ul>
6033+
* <li>
6034+
* <p>
6035+
* <i>DISABLED</i>: Builds trigger automatically without requiring comment approval</p>
6036+
* </li>
6037+
* <li>
6038+
* <p>
6039+
* <i>ALL_PULL_REQUESTS</i>: All pull requests require comment approval before builds execute (unless contributor is one of the approver roles)</p>
6040+
* </li>
6041+
* <li>
6042+
* <p>
6043+
* <i>FORK_PULL_REQUESTS</i>: Only pull requests from forked repositories require comment approval (unless contributor is one of the approver roles)</p>
6044+
* </li>
6045+
* </ul>
6046+
* @public
6047+
*/
6048+
requiresCommentApproval: PullRequestBuildCommentApproval | undefined;
6049+
6050+
/**
6051+
* <p>List of repository roles that have approval privileges for pull request builds when comment approval is required. Only users with these roles can provide valid comment approvals. If a pull request contributor is one of these roles, their pull request builds will trigger automatically. This field is only applicable when <code>requiresCommentApproval</code> is not <i>DISABLED</i>.</p>
6052+
* @public
6053+
*/
6054+
approverRoles?: PullRequestBuildApproverRole[] | undefined;
6055+
}
6056+
59826057
/**
59836058
* @public
59846059
*/
@@ -6044,6 +6119,12 @@ export interface CreateWebhookInput {
60446119
* @public
60456120
*/
60466121
scopeConfiguration?: ScopeConfiguration | undefined;
6122+
6123+
/**
6124+
* <p>A PullRequestBuildPolicy object that defines comment-based approval requirements for triggering builds on pull requests. This policy helps control when automated builds are executed based on contributor permissions and approval workflows.</p>
6125+
* @public
6126+
*/
6127+
pullRequestBuildPolicy?: PullRequestBuildPolicy | undefined;
60476128
}
60486129

60496130
/**
@@ -8329,7 +8410,8 @@ export interface StartBuildInput {
83298410
* <p>Since this property allows you to change the build commands that will run in the container,
83308411
* you should note that an IAM principal with the ability to call this API and set this parameter
83318412
* can override the default settings. Moreover, we encourage that you use a trustworthy buildspec location
8332-
* like a file in your source repository or a Amazon S3 bucket.</p>
8413+
* like a file in your source repository or a Amazon S3 bucket. Alternatively, you can restrict overrides
8414+
* to the buildspec by using a condition key: <a href="https://docs.aws.amazon.com/codebuild/latest/userguide/action-context-keys.html#action-context-keys-example-overridebuildspec.html">Prevent unauthorized modifications to project buildspec</a>.</p>
83338415
* </note>
83348416
* @public
83358417
*/
@@ -9647,6 +9729,12 @@ export interface UpdateWebhookInput {
96479729
* @public
96489730
*/
96499731
buildType?: WebhookBuildType | undefined;
9732+
9733+
/**
9734+
* <p>A PullRequestBuildPolicy object that defines comment-based approval requirements for triggering builds on pull requests. This policy helps control when automated builds are executed based on contributor permissions and approval workflows.</p>
9735+
* @public
9736+
*/
9737+
pullRequestBuildPolicy?: PullRequestBuildPolicy | undefined;
96509738
}
96519739

96529740
/**

clients/client-codebuild/src/protocols/Aws_json1_1.ts

Lines changed: 6 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -239,6 +239,8 @@ import {
239239
ProjectSource,
240240
ProjectSourceVersion,
241241
ProxyConfiguration,
242+
PullRequestBuildApproverRole,
243+
PullRequestBuildPolicy,
242244
PutResourcePolicyInput,
243245
RegistryCredential,
244246
Report,
@@ -2565,6 +2567,10 @@ const se_DescribeCodeCoveragesInput = (input: DescribeCodeCoveragesInput, contex
25652567

25662568
// se_ProxyConfiguration omitted.
25672569

2570+
// se_PullRequestBuildApproverRoles omitted.
2571+
2572+
// se_PullRequestBuildPolicy omitted.
2573+
25682574
// se_PutResourcePolicyInput omitted.
25692575

25702576
// se_RegistryCredential omitted.

codegen/sdk-codegen/aws-models/codebuild.json

Lines changed: 152 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3632,6 +3632,12 @@
36323632
"traits": {
36333633
"smithy.api#documentation": "<p>The scope configuration for global or organization webhooks.</p>\n <note>\n <p>Global or organization webhooks are only available for GitHub and Github Enterprise webhooks.</p>\n </note>"
36343634
}
3635+
},
3636+
"pullRequestBuildPolicy": {
3637+
"target": "com.amazonaws.codebuild#PullRequestBuildPolicy",
3638+
"traits": {
3639+
"smithy.api#documentation": "<p>A PullRequestBuildPolicy object that defines comment-based approval requirements for triggering builds on pull requests. This policy helps control when automated builds are executed based on contributor permissions and approval workflows.</p>"
3640+
}
36353641
}
36363642
},
36373643
"traits": {
@@ -7421,6 +7427,145 @@
74217427
"smithy.api#documentation": "<p>Information about the proxy configurations that apply network access control to your reserved capacity instances.</p>"
74227428
}
74237429
},
7430+
"com.amazonaws.codebuild#PullRequestBuildApproverRole": {
7431+
"type": "enum",
7432+
"members": {
7433+
"GITHUB_READ": {
7434+
"target": "smithy.api#Unit",
7435+
"traits": {
7436+
"smithy.api#enumValue": "GITHUB_READ"
7437+
}
7438+
},
7439+
"GITHUB_TRIAGE": {
7440+
"target": "smithy.api#Unit",
7441+
"traits": {
7442+
"smithy.api#enumValue": "GITHUB_TRIAGE"
7443+
}
7444+
},
7445+
"GITHUB_WRITE": {
7446+
"target": "smithy.api#Unit",
7447+
"traits": {
7448+
"smithy.api#enumValue": "GITHUB_WRITE"
7449+
}
7450+
},
7451+
"GITHUB_MAINTAIN": {
7452+
"target": "smithy.api#Unit",
7453+
"traits": {
7454+
"smithy.api#enumValue": "GITHUB_MAINTAIN"
7455+
}
7456+
},
7457+
"GITHUB_ADMIN": {
7458+
"target": "smithy.api#Unit",
7459+
"traits": {
7460+
"smithy.api#enumValue": "GITHUB_ADMIN"
7461+
}
7462+
},
7463+
"GITLAB_GUEST": {
7464+
"target": "smithy.api#Unit",
7465+
"traits": {
7466+
"smithy.api#enumValue": "GITLAB_GUEST"
7467+
}
7468+
},
7469+
"GITLAB_PLANNER": {
7470+
"target": "smithy.api#Unit",
7471+
"traits": {
7472+
"smithy.api#enumValue": "GITLAB_PLANNER"
7473+
}
7474+
},
7475+
"GITLAB_REPORTER": {
7476+
"target": "smithy.api#Unit",
7477+
"traits": {
7478+
"smithy.api#enumValue": "GITLAB_REPORTER"
7479+
}
7480+
},
7481+
"GITLAB_DEVELOPER": {
7482+
"target": "smithy.api#Unit",
7483+
"traits": {
7484+
"smithy.api#enumValue": "GITLAB_DEVELOPER"
7485+
}
7486+
},
7487+
"GITLAB_MAINTAINER": {
7488+
"target": "smithy.api#Unit",
7489+
"traits": {
7490+
"smithy.api#enumValue": "GITLAB_MAINTAINER"
7491+
}
7492+
},
7493+
"GITLAB_OWNER": {
7494+
"target": "smithy.api#Unit",
7495+
"traits": {
7496+
"smithy.api#enumValue": "GITLAB_OWNER"
7497+
}
7498+
},
7499+
"BITBUCKET_READ": {
7500+
"target": "smithy.api#Unit",
7501+
"traits": {
7502+
"smithy.api#enumValue": "BITBUCKET_READ"
7503+
}
7504+
},
7505+
"BITBUCKET_WRITE": {
7506+
"target": "smithy.api#Unit",
7507+
"traits": {
7508+
"smithy.api#enumValue": "BITBUCKET_WRITE"
7509+
}
7510+
},
7511+
"BITBUCKET_ADMIN": {
7512+
"target": "smithy.api#Unit",
7513+
"traits": {
7514+
"smithy.api#enumValue": "BITBUCKET_ADMIN"
7515+
}
7516+
}
7517+
}
7518+
},
7519+
"com.amazonaws.codebuild#PullRequestBuildApproverRoles": {
7520+
"type": "list",
7521+
"member": {
7522+
"target": "com.amazonaws.codebuild#PullRequestBuildApproverRole"
7523+
}
7524+
},
7525+
"com.amazonaws.codebuild#PullRequestBuildCommentApproval": {
7526+
"type": "enum",
7527+
"members": {
7528+
"DISABLED": {
7529+
"target": "smithy.api#Unit",
7530+
"traits": {
7531+
"smithy.api#enumValue": "DISABLED"
7532+
}
7533+
},
7534+
"ALL_PULL_REQUESTS": {
7535+
"target": "smithy.api#Unit",
7536+
"traits": {
7537+
"smithy.api#enumValue": "ALL_PULL_REQUESTS"
7538+
}
7539+
},
7540+
"FORK_PULL_REQUESTS": {
7541+
"target": "smithy.api#Unit",
7542+
"traits": {
7543+
"smithy.api#enumValue": "FORK_PULL_REQUESTS"
7544+
}
7545+
}
7546+
}
7547+
},
7548+
"com.amazonaws.codebuild#PullRequestBuildPolicy": {
7549+
"type": "structure",
7550+
"members": {
7551+
"requiresCommentApproval": {
7552+
"target": "com.amazonaws.codebuild#PullRequestBuildCommentApproval",
7553+
"traits": {
7554+
"smithy.api#documentation": "<p>Specifies when comment-based approval is required before triggering a build on pull requests. This setting determines whether builds run automatically or require explicit approval through comments.</p>\n <ul>\n <li>\n <p>\n <i>DISABLED</i>: Builds trigger automatically without requiring comment approval</p>\n </li>\n <li>\n <p>\n <i>ALL_PULL_REQUESTS</i>: All pull requests require comment approval before builds execute (unless contributor is one of the approver roles)</p>\n </li>\n <li>\n <p>\n <i>FORK_PULL_REQUESTS</i>: Only pull requests from forked repositories require comment approval (unless contributor is one of the approver roles)</p>\n </li>\n </ul>",
7555+
"smithy.api#required": {}
7556+
}
7557+
},
7558+
"approverRoles": {
7559+
"target": "com.amazonaws.codebuild#PullRequestBuildApproverRoles",
7560+
"traits": {
7561+
"smithy.api#documentation": "<p>List of repository roles that have approval privileges for pull request builds when comment approval is required. Only users with these roles can provide valid comment approvals. If a pull request contributor is one of these roles, their pull request builds will trigger automatically. This field is only applicable when <code>requiresCommentApproval</code> is not <i>DISABLED</i>.</p>"
7562+
}
7563+
}
7564+
},
7565+
"traits": {
7566+
"smithy.api#documentation": "<p>Configuration policy that defines comment-based approval requirements for triggering builds on pull requests. This policy helps control when automated builds are executed based on contributor permissions and approval workflows.</p>"
7567+
}
7568+
},
74247569
"com.amazonaws.codebuild#PutResourcePolicy": {
74257570
"type": "operation",
74267571
"input": {
@@ -9161,7 +9306,7 @@
91619306
"buildspecOverride": {
91629307
"target": "com.amazonaws.codebuild#String",
91639308
"traits": {
9164-
"smithy.api#documentation": "<p>A buildspec file declaration that overrides the latest one defined \n in the build project, for this build only. The buildspec defined on the project is not changed.</p>\n <p>If this value is set, it can be either an inline buildspec definition, the path to an\n alternate buildspec file relative to the value of the built-in\n <code>CODEBUILD_SRC_DIR</code> environment variable, or the path to an S3 bucket.\n The bucket must be in the same Amazon Web Services Region as the build project. Specify the buildspec\n file using its ARN (for example,\n <code>arn:aws:s3:::my-codebuild-sample2/buildspec.yml</code>). If this value is not\n provided or is set to an empty string, the source code must contain a buildspec file in\n its root directory. For more information, see <a href=\"https://docs.aws.amazon.com/codebuild/latest/userguide/build-spec-ref.html#build-spec-ref-name-storage\">Buildspec File Name and Storage Location</a>.</p>\n <note>\n <p>Since this property allows you to change the build commands that will run in the container, \n you should note that an IAM principal with the ability to call this API and set this parameter \n can override the default settings. Moreover, we encourage that you use a trustworthy buildspec location \n like a file in your source repository or a Amazon S3 bucket.</p>\n </note>"
9309+
"smithy.api#documentation": "<p>A buildspec file declaration that overrides the latest one defined \n in the build project, for this build only. The buildspec defined on the project is not changed.</p>\n <p>If this value is set, it can be either an inline buildspec definition, the path to an\n alternate buildspec file relative to the value of the built-in\n <code>CODEBUILD_SRC_DIR</code> environment variable, or the path to an S3 bucket.\n The bucket must be in the same Amazon Web Services Region as the build project. Specify the buildspec\n file using its ARN (for example,\n <code>arn:aws:s3:::my-codebuild-sample2/buildspec.yml</code>). If this value is not\n provided or is set to an empty string, the source code must contain a buildspec file in\n its root directory. For more information, see <a href=\"https://docs.aws.amazon.com/codebuild/latest/userguide/build-spec-ref.html#build-spec-ref-name-storage\">Buildspec File Name and Storage Location</a>.</p>\n <note>\n <p>Since this property allows you to change the build commands that will run in the container, \n you should note that an IAM principal with the ability to call this API and set this parameter \n can override the default settings. Moreover, we encourage that you use a trustworthy buildspec location \n like a file in your source repository or a Amazon S3 bucket. Alternatively, you can restrict overrides \n to the buildspec by using a condition key: <a href=\"https://docs.aws.amazon.com/codebuild/latest/userguide/action-context-keys.html#action-context-keys-example-overridebuildspec.html\">Prevent unauthorized modifications to project buildspec</a>.</p>\n </note>"
91659310
}
91669311
},
91679312
"insecureSslOverride": {
@@ -10333,6 +10478,12 @@
1033310478
"traits": {
1033410479
"smithy.api#documentation": "<p>Specifies the type of build this webhook will trigger.</p>\n <note>\n <p>\n <code>RUNNER_BUILDKITE_BUILD</code> is only available for <code>NO_SOURCE</code> source type projects \n configured for Buildkite runner builds. For more information about CodeBuild-hosted Buildkite runner builds, see <a href=\"https://docs.aws.amazon.com/codebuild/latest/userguide/sample-runner-buildkite.html\">Tutorial: Configure a CodeBuild-hosted Buildkite runner</a> in the <i>CodeBuild\n user guide</i>.</p>\n </note>"
1033510480
}
10481+
},
10482+
"pullRequestBuildPolicy": {
10483+
"target": "com.amazonaws.codebuild#PullRequestBuildPolicy",
10484+
"traits": {
10485+
"smithy.api#documentation": "<p>A PullRequestBuildPolicy object that defines comment-based approval requirements for triggering builds on pull requests. This policy helps control when automated builds are executed based on contributor permissions and approval workflows.</p>"
10486+
}
1033610487
}
1033710488
},
1033810489
"traits": {

0 commit comments

Comments
 (0)