feat(codepipeline-actions): add pipeline invoke action support. #34039

hwum · 2025-04-03T23:56:40Z

Issue # 33818

Closes #33818
#33818

Reason for this change

Codepipeline team launched pipeline invoke action last year, but not available in cdk library yet.

Description of changes

Pipeline invoke action support

Describe any new or updated permissions being added

no

Description of how you validated changes

Unit test, local deployment, integ test.

Checklist

[Y] My code adheres to the CONTRIBUTING GUIDE and DESIGN GUIDELINES

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache-2.0 license

aws-cdk-automation

(This review is outdated)

✅ Updated pull request passes all PRLinter validations. Dismissing previous PRLinter review.

codecov · 2025-04-04T00:17:31Z

Codecov Report

All modified and coverable lines are covered by tests ✅

Project coverage is 83.98%. Comparing base (74cbe27) to head (4802233).
Report is 28 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main   #34039   +/-   ##
=======================================
  Coverage   83.98%   83.98%           
=======================================
  Files         120      120           
  Lines        6976     6976           
  Branches     1178     1178           
=======================================
  Hits         5859     5859           
  Misses       1005     1005           
  Partials      112      112

Flag	Coverage Δ
suite.unit	`83.98% <ø> (ø)`

Flags with carried forward coverage won't be shown. Click here to find out more.

Components	Coverage Δ
packages/aws-cdk	`∅ <ø> (∅)`
packages/aws-cdk-lib/core	`83.98% <ø> (ø)`

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

go-to-k · 2025-04-04T08:26:52Z

...k-testing/framework-integ/test/aws-codepipeline-actions/test/integ.pipeline-invoke-action.ts

@@ -0,0 +1,88 @@
+import { Stack } from 'aws-cdk-lib';
+import { RevisionType } from 'aws-cdk-lib/aws-codepipeline-actions';
+import { app } from '../../aws-appmesh/test/integ.mesh-port-match';


../../aws-appmesh/test/integ.mesh-port-match

Is this a mistake?

go-to-k · 2025-04-04T08:29:39Z

...k-testing/framework-integ/test/aws-codepipeline-actions/test/integ.pipeline-invoke-action.ts

+const repo = new codecommit.Repository(stack, 'MyRepo', {
+  repositoryName: 'my-repo',
+});


CodeCommit has already stopped accepting new ones, so it would be better to use other source actions in case another developer takes over this test in the future, what do you think?

Will update in the next revision. Thanks for mentioning

go-to-k · 2025-04-04T08:37:04Z

...k-testing/framework-integ/test/aws-codepipeline-actions/test/integ.pipeline-invoke-action.ts

+
+const integrationTest = new IntegTest(app, 'codepipeline-integ-test', {
+  testCases: [stack],
+  stackUpdateWorkflow: false,


stackUpdateWorkflow: false,

Is this necessary?

Assertion is recommended actually. Not necessary.

go-to-k · 2025-04-04T08:39:55Z

...k-testing/framework-integ/test/aws-codepipeline-actions/test/integ.pipeline-invoke-action.ts

+const awsApiCall1 = integrationTest.assertions.awsApiCall('CodePipeline', 'getPipeline', { name: pipelineName });
+awsApiCall1.assertAtPath('pipeline.name', ExpectedResult.stringLikeRegexp(pipelineName));
+awsApiCall1.assertAtPath('pipeline.stages.1.actions.1.name', ExpectedResult.stringLikeRegexp('Invoke'));


How about using the assertions that actually run the pipeline (for startPipelineExecution and getPipelineState with Succeeded status), which I thought could be used to check IAM permissions etc.

ref: https://github.com/aws/aws-cdk/blob/v2.188.0/packages/@aws-cdk-testing/framework-integ/test/aws-codepipeline-actions/test/integ.pipeline-ecr-build-and-publish-public.ts#L84-L112

I prefer the cdk integ test should be testing cdk input -> cfn input -> service The goal of these tests are checking if backend service correctly received the parameters from cdk app. The IAM and PipelineExecution are more about functionalities, which have been well checked in our internal tests, so I don't think they're necessary..

I understand your perspective, but I see it a bit differently. This is L2 construct, not L1 construct. L2 constructs are not just simple wrappers around CloudFormation - they provide sensible defaults and recommended configurations. That's why the bound method automatically configures and sets appropriate IAM permissions by default.
However, there's always a possibility that CDK contributors might implement inappropriate IAM settings. Where would we catch such issues? Unit tests only verify input/output matching and can't cover this aspect. In my view, integ tests are precisely the place to verify the actual behavior of CDK's internal code.

go-to-k

I'm not sure, as I haven't used this new action yet, but can this action be used cross-accounting?
If so, should we support it in this action class? Or is this action intended to be performed within a single account?

go-to-k · 2025-04-04T10:33:53Z

packages/aws-cdk-lib/aws-codepipeline-actions/lib/codepipeline/invoke-action.ts

+  /**
+   * The name of the pipeline that will, upon running, start the current target pipeline.
+   * You must have already created the invoking pipeline.
+   */
+  readonly pipelineName: string;


How about using IPipeline?

Sorry, I was mistaken. I thought this was the name of the target pipeline, but it is the name of the pipeline that executes this action.
So it was my understanding that it is impossible to pass the pipeline to which this action belongs...

PS.) No, was my perception correct...?

Please let me know if my understanding is different. (It's a bit confusing, so even if we don't use IPipeline, we might as well change the property name in the CDK.)

I would insist on the pipelineName since the targetPipeline could not be created by cdk... If customers have a pipeline created by console or terraform, they cannot use IPipeline here

I'll revise here to reduce the ambiguity

btw, https://docs.aws.amazon.com/codepipeline/latest/userguide/action-reference-PipelineInvoke.html this doc is kind of confusing, I already asked the doc team to improve

I would insist on the pipelineName since the targetPipeline could not be created by cdk... If customers have a pipeline created by console or terraform, they cannot use IPipeline here

The interfaces starting with 'I' like IPipeline are specifically designed to import resources (called unowned resources) created outside of CDK (such as through the console or Terraform) into your stack.

https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md#owned-vs-unowned-constructs

You can use methods like fromPipelineArn to virtually incorporate these external resources into your stack. This approach allows you to use convenient features like onEvent methods on imported resources, unlike with primitive types.

https://github.com/aws/aws-cdk/blob/main/packages/aws-cdk-lib/aws-codepipeline/lib/pipeline.ts#L538-L542

const unownedPipelineArn = 'MyUnownedPipelineArn'; // importedPipeline: IPipeline const importedPipeline = Pipeline.fromPipelineArn(this, 'ImportedPipeline', unownedPipelineArn); // can use like construct imported.onEvent('test'); console.log(imported.pipelineArn); console.log(imported.pipelineName); new OtherResource(this, 'OtherResource', { pipeline: importedPipeline, });

Additionally, using primitive type properties (i.e. physical attributes) in props is generally not recommended in CDK design.

https://github.com/aws/aws-cdk/blob/main/docs/DESIGN_GUIDELINES.md#types

go-to-k · 2025-04-04T10:36:50Z

packages/aws-cdk-lib/aws-codepipeline-actions/lib/codepipeline/invoke-action.ts

+      actions: ['codepipeline:StartPipelineExecution'],
+      resources: ['*'],


This is related to the comment above, could IPipeline in this props be used to properly narrow down the resources instead of *? (using pipeline.pipelineArn)

This may be relevant to the following comment...

I'm not sure, as I haven't used this new action yet, but can this action be used cross-accounting?
If so, should we support it in this action class? Or is this action intended to be performed within a single account?

related: #34039 (comment)

go-to-k · 2025-04-04T10:39:48Z

packages/aws-cdk-lib/aws-codepipeline-actions/lib/codepipeline/invoke-action.ts

+}
+/**


Suggested change

}

/**

}

/**

go-to-k · 2025-04-04T10:46:36Z

packages/aws-cdk-lib/aws-codepipeline-actions/lib/codepipeline/invoke-action.ts

+  readonly revisionType: RevisionType;
+  /**


Suggested change

readonly revisionType: RevisionType;

/**

readonly revisionType: RevisionType;

/**

go-to-k · 2025-04-04T10:46:48Z

packages/aws-cdk-lib/aws-codepipeline-actions/lib/codepipeline/invoke-action.ts

+  S3_OBJECT_VERSION_ID = 'S3_OBJECT_VERSION_ID',
+
+  /**


Suggested change

S3_OBJECT_VERSION_ID = 'S3_OBJECT_VERSION_ID',

/**

S3_OBJECT_VERSION_ID = 'S3_OBJECT_VERSION_ID',

/**

go-to-k · 2025-04-04T11:34:12Z

packages/aws-cdk-lib/aws-codepipeline-actions/lib/codepipeline/invoke-action.ts

+/**
+ * A pipeline-level variable used for a pipeline execution.
+ */
+export interface Variable {
+  /**
+   * The name of a pipeline-level variable.
+   */
+  readonly name: string;
+
+  /**
+   * The value of a pipeline-level variable.
+   */
+  readonly value: string;


If the variables generated here are to be used in the target pipeline, do they need to be called in the following form?: #{variables.xxx}

If so, wouldn't it be more convenient to create a class with a method to wrap this behaviour and use an instance of that class?

ref: https://github.com/aws/aws-cdk/blob/v2.188.0/packages/aws-cdk-lib/aws-codepipeline/lib/variable.ts#L69-L71

The class in that file is for VariableDeclaration so we can't use it here, and we need a new class.

P.S.) "Variable namespace" is available in the management console, but cannot it be specified in CloudFormation?

go-to-k · 2025-04-04T12:26:13Z

...k-testing/framework-integ/test/aws-codepipeline-actions/test/integ.pipeline-invoke-action.ts

@@ -0,0 +1,88 @@
+import { Stack } from 'aws-cdk-lib';
+import { RevisionType } from 'aws-cdk-lib/aws-codepipeline-actions';


We can use the definition below this one. (line 4)

import * as cpactions from 'aws-cdk-lib/aws-codepipeline-actions';

go-to-k

nit

go-to-k · 2025-04-04T12:38:11Z

packages/aws-cdk-lib/aws-codepipeline-actions/lib/codepipeline/invoke-action.ts

+   */
+  COMMIT_ID = 'COMMIT_ID',
+  /**
+   * The revision type is a image digest.


Suggested change

* The revision type is a image digest.

* The revision type is an image digest.

go-to-k · 2025-04-04T12:38:20Z

packages/aws-cdk-lib/aws-codepipeline-actions/lib/codepipeline/invoke-action.ts

+   */
+  IMAGE_DIGEST = 'IMAGE_DIGEST',
+  /**
+   * The revision type is a s3 object version id.


Suggested change

* The revision type is a s3 object version id.

* The revision type is an S3 object version id.

go-to-k · 2025-04-04T12:38:48Z

packages/aws-cdk-lib/aws-codepipeline-actions/lib/codepipeline/invoke-action.ts

+  S3_OBJECT_VERSION_ID = 'S3_OBJECT_VERSION_ID',
+
+  /**
+   * The revision type is a s3 object version key.


Suggested change

* The revision type is a s3 object version key.

* The revision type is an S3 object version key.

Thanks for bring this up lol. I'll talk to our AI team for this issue

go-to-k · 2025-04-04T13:03:40Z

packages/aws-cdk-lib/aws-codepipeline-actions/test/codepipeline/invoke-action.test.ts

+import * as cpactions from '../../lib';
+import { RevisionType } from '../../lib';


Could be merged.

go-to-k · 2025-04-04T13:04:30Z

packages/aws-cdk-lib/aws-codepipeline-actions/test/codepipeline/invoke-action.test.ts

+
+/* eslint-disable quote-props */
+
+describe('', () => {


Would be removed.

go-to-k · 2025-04-04T13:07:19Z

packages/aws-cdk-lib/aws-codepipeline-actions/test/codepipeline/invoke-action.test.ts

+      }));
+    });
+
+    function stackIncludingPipelineInvokeCodePipeline(pipelineName: string, app?: App) {


It would be good to get it out of the 'describe' so that it can be used in other tests.

aws-cdk-automation · 2025-04-11T19:40:52Z

AWS CodeBuild CI Report

CodeBuild project: AutoBuildv2Project1C6BFA3F-wQm2hXv2jqQv
Commit ID: 4802233
Result: SUCCEEDED
Build Logs (available for 30 days)

Powered by github-codebuild-logs, available on the AWS Serverless Application Repository

github-actions bot added repeat-contributor [Pilot] contributed between 3-5 PRs to the CDK effort/medium Medium work item – several days of effort feature-request A feature should be added or improved. p2 labels Apr 3, 2025

aws-cdk-automation requested a review from a team April 3, 2025 23:56

aws-cdk-automation previously requested changes Apr 3, 2025

View reviewed changes

hwum force-pushed the l2 branch from 362b99a to c22b4df Compare April 4, 2025 00:02

hwum changed the title ~~feat(codepipeline-actions):support pipeline invoke action~~ feat(codepipeline-actions): add pipeline invoke action support. Apr 4, 2025

hwum force-pushed the l2 branch from c22b4df to 9ace8bc Compare April 4, 2025 00:07

hwum force-pushed the l2 branch 5 times, most recently from 5981f91 to 66dd46d Compare April 4, 2025 06:06

aws-cdk-automation added the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Apr 4, 2025

hwum force-pushed the l2 branch from 66dd46d to 1ac89b1 Compare April 4, 2025 06:38

go-to-k reviewed Apr 4, 2025

View reviewed changes

go-to-k suggested changes Apr 4, 2025

View reviewed changes

aws-cdk-automation removed the pr/needs-community-review This PR needs a review from a Trusted Community Member or Core Team Member. label Apr 4, 2025

go-to-k reviewed Apr 4, 2025

View reviewed changes

feat(pipelines) add usePipelineRoleForActions field in L3 construct

af6d5bd

hwum force-pushed the l2 branch from 1ac89b1 to 9bcd5bb Compare April 11, 2025 00:03

feat(codepipeline-actions):support pipeline invoke action

cdb044f

hwum force-pushed the l2 branch from 9bcd5bb to cdb044f Compare April 11, 2025 01:00

Merge branch 'main' into l2

4802233

		actions: ['codepipeline:StartPipelineExecution'],
		resources: ['*'],

-}
-/**
+}
+/**

		@@ -0,0 +1,88 @@
		import { Stack } from 'aws-cdk-lib';
		import { RevisionType } from 'aws-cdk-lib/aws-codepipeline-actions';

	* The revision type is a image digest.
	* The revision type is an image digest.

	* The revision type is a s3 object version id.
	* The revision type is an S3 object version id.

		import * as cpactions from '../../lib';
		import { RevisionType } from '../../lib';

feat(codepipeline-actions): add pipeline invoke action support. #34039

Are you sure you want to change the base?

feat(codepipeline-actions): add pipeline invoke action support. #34039

Conversation

hwum commented Apr 3, 2025

Issue # 33818

Reason for this change

Description of changes

Describe any new or updated permissions being added

Description of how you validated changes

Checklist

aws-cdk-automation left a comment • edited Loading

Choose a reason for hiding this comment

codecov bot commented Apr 4, 2025 • edited Loading

Codecov Report

go-to-k Apr 4, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

go-to-k Apr 4, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

go-to-k Apr 4, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

go-to-k Apr 8, 2025 • edited Loading

Choose a reason for hiding this comment

go-to-k left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

go-to-k Apr 4, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

go-to-k Apr 8, 2025 • edited Loading

Choose a reason for hiding this comment

go-to-k Apr 4, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

go-to-k Apr 4, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

go-to-k Apr 4, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

go-to-k left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

aws-cdk-automation commented Apr 11, 2025

AWS CodeBuild CI Report

aws-cdk-automation left a comment •

edited

Loading

codecov bot commented Apr 4, 2025 •

edited

Loading

go-to-k Apr 4, 2025 •

edited

Loading

go-to-k Apr 4, 2025 •

edited

Loading

go-to-k Apr 4, 2025 •

edited

Loading

go-to-k Apr 8, 2025 •

edited

Loading

go-to-k Apr 4, 2025 •

edited

Loading

go-to-k Apr 8, 2025 •

edited

Loading

go-to-k Apr 4, 2025 •

edited

Loading

go-to-k Apr 4, 2025 •

edited

Loading

go-to-k Apr 4, 2025 •

edited

Loading