Skip to content

Commit 16e05ac

Browse files
damienjburksdamienjburks
committed
2 parents 60d0120 + 15f659b commit 16e05ac

File tree

8 files changed

+236
-8
lines changed

8 files changed

+236
-8
lines changed

‎LICENSE‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2024 The DevSec Blueprint (DSB)
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎README.md‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,11 +1,11 @@
11
# AWS DevSecOps Pipeline - Terraform
22

3-
![License](https://img.shields.io/github/license/The-DevSec-Blueprint/dsb-blogging-assistant?logo=license)
3+
![License](https://img.shields.io/github/license/The-DevSec-Blueprint/aws-devsecops-pipeline?logo=license)
44
![Terraform Cloud](https://img.shields.io/badge/Terraform-Registry-purple?logo=terraform)
5-
![GitHub Issues](https://img.shields.io/github/issues/The-DevSec-Blueprint/dsb-blogging-assistant?logo=github)
6-
![GitHub Forks](https://img.shields.io/github/forks/The-DevSec-Blueprint/dsb-blogging-assistant?logo=github)
7-
![GitHub Stars](https://img.shields.io/github/stars/The-DevSec-Blueprint/dsb-blogging-assistant?logo=github)
8-
![GitHub Last Commit](https://img.shields.io/github/last-commit/The-DevSec-Blueprint/dsb-blogging-assistant?logo=github)
5+
![GitHub Issues](https://img.shields.io/github/issues/The-DevSec-Blueprint/aws-devsecops-pipeline?logo=github)
6+
![GitHub Forks](https://img.shields.io/github/forks/The-DevSec-Blueprint/aws-devsecops-pipeline?logo=github)
7+
![GitHub Stars](https://img.shields.io/github/stars/The-DevSec-Blueprint/aws-devsecops-pipeline?logo=github)
8+
![GitHub Last Commit](https://img.shields.io/github/last-commit/The-DevSec-Blueprint/aws-devsecops-pipeline?logo=github)
99
![CI Status](https://github.com/The-DevSec-Blueprint/aws-devsecops-pipeline/actions/workflows/main.yml/badge.svg)
1010

1111
## Overview

‎terraform/pipelines/modules/codepipeline/buildspecs/formatcheck.yml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
version: 0.2
2+
3+
phases:
4+
install:
5+
runtime-versions:
6+
python: 3.12 # Specify the desired Python version
7+
commands:
8+
- echo "Installing required dependencies..."
9+
- pip install --upgrade pip
10+
- pip install -r requirements.txt
11+
- pip install black # Install black
12+
pre_build:
13+
commands:
14+
- echo "Starting format check with black..."
15+
build:
16+
commands:
17+
- echo "Running black format check..."
18+
- black --check . # Check formatting without modifying files
19+
post_build:
20+
commands:
21+
- echo "Format check completed."
22+
23+
artifacts:
24+
files:
25+
- "**/*" # Include all files
26+
discard-paths: yes

‎terraform/pipelines/modules/codepipeline/buildspecs/lintcheck.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
version: 0.2
2+
3+
phases:
4+
install:
5+
runtime-versions:
6+
python: 3.12 # Specify the desired Python version
7+
commands:
8+
- echo "Installing required dependencies..."
9+
- pip install --upgrade pip
10+
- pip install -r requirements.txt
11+
- pip install pylint # Install pylint
12+
pre_build:
13+
commands:
14+
- echo "Starting pylint checks..."
15+
build:
16+
commands:
17+
- echo "Running pylint documentation check..."
18+
- pylint . # Check for missing docstrings
19+
- echo "Documentation check completed."
20+
post_build:
21+
commands:
22+
- echo "Pylint documentation check completed successfully."
23+
24+
artifacts:
25+
files:
26+
- "**/*" # Include all files
27+
discard-paths: yes

‎terraform/pipelines/modules/codepipeline/buildspecs/ossdepscan.yml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,7 +3,7 @@ version: 0.2
33
phases:
44
install:
55
runtime-versions:
6-
python: 3.9
6+
python: 3.12
77
commands:
88
- echo "Installing container scanning tools..."
99
- pip install --upgrade pip

‎terraform/pipelines/modules/codepipeline/buildspecs/sastscanning.yml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -12,6 +12,7 @@ phases:
1212
pre_build:
1313
commands:
1414
- echo "Installing dependencies..."
15+
- pip install --upgrade pip
1516
- pip install -r requirements.txt
1617
build:
1718
commands:

‎terraform/pipelines/modules/codepipeline/buildspecs/unittests.yml‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
version: 0.2
2+
3+
phases:
4+
install:
5+
runtime-versions:
6+
python: 3.12 # Specify the desired Python version
7+
commands:
8+
- echo "Installing required dependencies..."
9+
- pip install --upgrade pip
10+
- pip install -r requirements.txt
11+
- pip install pytest pytest-cov # Install pytest and pytest-cov for coverage reporting
12+
pre_build:
13+
commands:
14+
- echo "Starting unit test process..."
15+
build:
16+
commands:
17+
- echo "Running pytest with coverage reporting..."
18+
# Run tests and generate coverage report
19+
- pytest tests/ --cov=. --cov-report=xml --cov-report=term-missing --cov-fail-under=80
20+
post_build:
21+
commands:
22+
- echo "Unit testing and coverage reporting completed."
23+
24+
artifacts:
25+
files:
26+
- "coverage.xml" # Include the coverage report as an artifact
27+
discard-paths: yes

‎terraform/pipelines/modules/codepipeline/main.tf‎

Lines changed: 128 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -245,25 +245,69 @@ resource "aws_codepipeline" "pipeline" {
245245
name = "Test"
246246

247247
action {
248-
name = "StaticCodeAnalysis"
248+
name = "FormatCheck"
249249
category = "Test"
250250
owner = "AWS"
251251
provider = "CodeBuild"
252252
version = "1"
253253
input_artifacts = ["BuildArtifact"]
254+
run_order = 1
255+
256+
configuration = {
257+
ProjectName = aws_codebuild_project.format_check_project.name
258+
}
259+
}
260+
261+
action {
262+
name = "LintCheck"
263+
category = "Test"
264+
owner = "AWS"
265+
provider = "CodeBuild"
266+
version = "1"
267+
input_artifacts = ["BuildArtifact"]
268+
run_order = 1
269+
270+
configuration = {
271+
ProjectName = aws_codebuild_project.lint_check_project.name
272+
}
273+
}
274+
275+
action {
276+
name = "RunUnitTests"
277+
category = "Test"
278+
owner = "AWS"
279+
provider = "CodeBuild"
280+
version = "1"
281+
input_artifacts = ["BuildArtifact"]
282+
run_order = 2
283+
284+
configuration = {
285+
ProjectName = aws_codebuild_project.unittest_project.name
286+
}
287+
}
288+
289+
action {
290+
name = "SnykSecurityScan"
291+
category = "Test"
292+
owner = "AWS"
293+
provider = "CodeBuild"
294+
version = "1"
295+
input_artifacts = ["BuildArtifact"]
296+
run_order = 3
254297

255298
configuration = {
256299
ProjectName = aws_codebuild_project.static_analysis_project.name
257300
}
258301
}
259302

260303
action {
261-
name = "OSSDependencyScan"
304+
name = "ContainerSecurityScan"
262305
category = "Test"
263306
owner = "AWS"
264307
provider = "CodeBuild"
265308
version = "1"
266309
input_artifacts = ["BuildArtifact"]
310+
run_order = 3
267311

268312
configuration = {
269313
ProjectName = aws_codebuild_project.oss_scanning_project.name
@@ -318,6 +362,88 @@ resource "aws_codebuild_project" "build_project" {
318362
}
319363
}
320364

365+
resource "aws_codebuild_project" "format_check_project" {
366+
name = "${var.repo_name}-formatcheck-project"
367+
service_role = aws_iam_role.codebuild_role.arn
368+
369+
environment {
370+
compute_type = var.compute_type
371+
image = var.build_image
372+
type = var.environment_type
373+
privileged_mode = var.privileged_mode
374+
375+
environment_variable {
376+
name = "IMAGE_REPO_NAME"
377+
value = aws_ecr_repository.this.name
378+
}
379+
}
380+
381+
source {
382+
type = "NO_SOURCE"
383+
buildspec = file("${path.module}/buildspecs/formatcheck.yml")
384+
}
385+
386+
artifacts {
387+
type = "S3"
388+
location = var.s3_bucket_name
389+
}
390+
}
391+
392+
resource "aws_codebuild_project" "unittest_project" {
393+
name = "${var.repo_name}-unittest-project"
394+
service_role = aws_iam_role.codebuild_role.arn
395+
396+
environment {
397+
compute_type = var.compute_type
398+
image = var.build_image
399+
type = var.environment_type
400+
privileged_mode = var.privileged_mode
401+
402+
environment_variable {
403+
name = "IMAGE_REPO_NAME"
404+
value = aws_ecr_repository.this.name
405+
}
406+
}
407+
408+
source {
409+
type = "NO_SOURCE"
410+
buildspec = file("${path.module}/buildspecs/unittests.yml")
411+
}
412+
413+
artifacts {
414+
type = "S3"
415+
location = var.s3_bucket_name
416+
}
417+
}
418+
419+
420+
resource "aws_codebuild_project" "lint_check_project" {
421+
name = "${var.repo_name}-lintcheck-project"
422+
service_role = aws_iam_role.codebuild_role.arn
423+
424+
environment {
425+
compute_type = var.compute_type
426+
image = var.build_image
427+
type = var.environment_type
428+
privileged_mode = var.privileged_mode
429+
430+
environment_variable {
431+
name = "IMAGE_REPO_NAME"
432+
value = aws_ecr_repository.this.name
433+
}
434+
}
435+
436+
source {
437+
type = "NO_SOURCE"
438+
buildspec = file("${path.module}/buildspecs/lintcheck.yml")
439+
}
440+
441+
artifacts {
442+
type = "S3"
443+
location = var.s3_bucket_name
444+
}
445+
}
446+
321447
resource "aws_codebuild_project" "deploy_project" {
322448
name = "${var.repo_name}-deploy-prj"
323449
service_role = aws_iam_role.codebuild_role.arn

0 commit comments

Comments
 (0)