Question

A development team uses AWS CodePipeline with three stages: Source (CodeCommit), Build (CodeBuild), and Deploy (CodeDeploy to ECS). Leadership mandates that no code with critical SonarQube static-analysis findings may proceed to deployment. The team already runs unit tests inside the Build stage's buildspec. They want the pipeline execution to STOP automatically when SonarQube reports a failed quality gate, without adding a manual approval and without deploying the flawed artifact. What is the MOST appropriate way to implement this?

Accepted Answer

Add a separate CodeBuild action in a new stage after Build that queries the SonarQube quality gate API and exits with a non-zero status when the gate fails, causing the pipeline to halt before Deploy.

Answer

Configure a CodeDeploy AfterAllowTraffic lifecycle hook that calls a Lambda function to check the SonarQube result and roll back if the gate failed.

Answer

Enable CodePipeline's built-in SonarQube quality gate action type and set the failure threshold in the pipeline configuration.

Answer

Add a CloudWatch alarm on the SonarQube findings metric and use an EventBridge rule to disable the pipeline's transition into the Deploy stage.