This article shows how to use the Tidelift CLI with AWS CodeBuild to check catalog alignment during a build stage. As part of the CI/CD process, customers are provided with the option to configure builds in such a way that they fail if they include unapproved packages based on the set standards.
Create a Project in Tidelift and generate an API key
After logging into the Tidelift Subscription dashboard:
- Select Projects
- Select Track New Project
- Enter the project name as it appears in version control
- When prompted, select the catalog to use or leave the default organization catalog
Select Next, then close the Upload manifest files dialog box to skip manually uploading manifests.
Select the Edit Project Settings gear on the left navigation, select Get Project Key then select Generate Project Key.
Add the API Key to your AWS CodeBuild project
From within your Build project in AWS CodeBuild, go to Edit > Environment and select Additional Configuration. Locate the section called Environment Variables and select Add environment variable.
Integrate AWS CodeBuild with Tidelift
To integrate AWS CodeBuild with Tidelift, commands will need to be added to your buildspec.yml file in the root directory of your source code. Commands are added to download the Tidelift CLI in the pre_build phase which will then be executed in the post_build phase. If a buildspec.yml does not already exist, one will need to be created.
In the example below, these commands have been added to a buildspec.yml file for a Maven based project.
After saving the buildspec.yml, select the project in CodeBuild and click Start Build. Once the build completes, the alignment details will be updated within your project in Tidelift.
Reviewing your alignment results
If your project logs are configured to be sent to an S3 bucket, you can also see the build output by selecting the Build run from within the Build history. In the Build logs, select the S3 location. The Tidelift alignment details can be found in the POST_BUILD phase of the logs.