All files index.ts

100% Statements 62/62
100% Branches 1/1
100% Functions 1/1
100% Lines 62/62

Press n or j to go to the next uncovered block, b, p or k for the previous block.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 631x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x 1x  
// Copyright Amazon.com, Inc. or its affiliates. All Rights Reserved.
// SPDX-License-Identifier: Apache-2.0
 
import * as cdk from 'aws-cdk-lib';
import * as codebuild from 'aws-cdk-lib/aws-codebuild';
import * as codepipeline from 'aws-cdk-lib/aws-codepipeline';
import * as codepipeline_actions from 'aws-cdk-lib/aws-codepipeline-actions';
import * as iam from 'aws-cdk-lib/aws-iam';
import { Construct } from 'constructs';
 
export interface CDKCodeBuildSonarcloudProps {
  readonly sourceOutput: codepipeline.Artifact;
  readonly sonarOrganizationName: string;
  readonly sonarProjectName: string;
}
 
export class CDKCodeBuildSonarcloud extends Construct {
  //Build action to include in your pipeline
  public readonly buildAction: codepipeline_actions.CodeBuildAction;
 
  constructor(scope: Construct, id: string, props: CDKCodeBuildSonarcloudProps) {
    super(scope, id);
 
    // Create an IAM policy statement granting access to the secret
    const secretAccessPolicy = new iam.PolicyStatement({
      actions: ['secretsmanager:GetSecretValue'],
      resources: [`arn:aws:secretsmanager:${cdk.Stack.of(this).region}:${cdk.Stack.of(this).account}:secret:sonar-token-*`],
    });
 
    const projectSonarScan = new codebuild.PipelineProject(this, 'SonarScannerProject', {
      // Configure CodeBuild project for sonarcloud scan
      environment: {
        buildImage: codebuild.LinuxBuildImage.STANDARD_7_0,
      },
      buildSpec: codebuild.BuildSpec.fromObject({
        version: '0.2',
        phases: {
          install: {
            commands: [
              'npm install -g sonar-scanner',
            ],
          },
          build: {
            commands: [
              'SONAR_TOKEN=$(aws secretsmanager get-secret-value --secret-id sonar-token --query SecretString --output text | jq -r .SONAR_TOKEN)',
              `sonar-scanner -Dsonar.organization=${props.sonarOrganizationName} -Dsonar.projectKey=${props.sonarProjectName} -Dsonar.sources=. -Dsonar.host.url=https://sonarcloud.io -Dsonar.login=$SONAR_TOKEN`,
            ],
          },
        },
      }),
    });
 
    projectSonarScan.addToRolePolicy(secretAccessPolicy);
 
    // Define build action for CodePipeline
    this.buildAction = new codepipeline_actions.CodeBuildAction({
      actionName: 'SonarScanner_Build',
      project: projectSonarScan,
      input: props.sourceOutput,
    });
  }
}