aws-cc-codepipeline-source-binding

id: aws-cc-codepipeline-source-binding
emits: ContainsResourceReference
applies_to:
- aws
note: Analogous to aws-cc-codebuild-source-binding but for CodePipeline source stages. Records that a
  CodePipeline pipeline stage references a CodeCommit repository as its source. The tracked_branch property
  enables the derived codecommit.yaml rules to emit CanModifyCode(Identity -> pipeline BuildWorker) when
  the identity can push to the tracked branch. ContainsResourceReference is non-walkable structural metadata.
match_record:
  resource_type: AWS::CodePipeline::Pipeline
  field: stages[].actions[].actionTypeId.provider
  value: CodeCommit
where:
- actionTypeId.category == 'Source'
- actionTypeId.owner == 'AWS'
- configuration.RepositoryName is present
emit:
  source_type: BuildWorker
  target_type: '*'
  source: <CodePipeline (BuildWorker) node>
  target: <CodeCommit Repository (ArtifactRepository) node resolved from configuration.RepositoryName
    + account/region>
  api_source: codepipeline:GetPipeline
  evidence_field: stages[].actions[].configuration.RepositoryName, configuration.BranchName
  properties:
    tracked_branch: configuration.BranchName
    output_artifact: outputArtifacts[0].name (fed to downstream build/deploy stages)
  narrative: CodePipeline {pipeline.name} references CodeCommit repository {repo.name} as its source on
    branch {tracked_branch}; a push to that branch starts a new pipeline execution (feeds CanModifyCode
    derivation for the pipeline's BuildWorker).