amazon-codeguru-samples/.github/workflows/codeguru-reviewer.yml at main · aws-samples/amazon-codeguru-samples · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60

name: Analyze with CodeGuru Reviewer

on:
  - push
  - pull_request
  - workflow_dispatch


permissions:
    id-token: write
    contents: read
    security-events: write

jobs:
  CodeGuruReviewerScan:
    runs-on: ubuntu-latest
    steps:
    - name: Assume IAM Role
      continue-on-error: true
      uses: aws-actions/configure-aws-credentials@v1
      id: iam-role
      with:
        role-to-assume: arn:aws:iam::048169001733:role/GuruGitHubCICDRole
        aws-region: us-west-2

    - uses: actions/checkout@v2
      if: steps.iam-role.outcome == 'success'
      with:
        fetch-depth: 0
    - name: Set up JDK 1.8
      if: steps.iam-role.outcome == 'success'
      uses: actions/setup-java@v1
      with:
        java-version: 1.8
    - name: Build with Maven
      if: steps.iam-role.outcome == 'success'
      run: ./gradlew jar

    - name: Run CodeGuru Reviewer
      if: steps.iam-role.outcome == 'success'
      id: codeguru
      uses: aws-actions/codeguru-reviewer@v1.1
      continue-on-error: false
      with:
        s3_bucket: codeguru-reviewer-build-artifacts-048169001733-us-west-2
        build_path: ./build/libs

    - name: Store SARIF file
      if: steps.iam-role.outcome == 'success' && steps.codeguru.outcome == 'success'
      uses: actions/upload-artifact@v2
      with:
        name: SARIF_recommendations
        path: ./codeguru-results.sarif.json

    - name: Upload review result
      if: steps.iam-role.outcome == 'success' && steps.codeguru.outcome == 'success'
      uses: github/codeql-action/upload-sarif@v1
      with:
        sarif_file: codeguru-results.sarif.json