From c3925caff98388f1ed98c4933d9ea948a1d0255e Mon Sep 17 00:00:00 2001 From: Joey Mussalli Date: Mon, 24 Aug 2026 15:33:21 -0400 Subject: [PATCH] docs(codecatalyst): resolve the GitHub-Actions-path TODO codecatalyst/README.md offered running the existing GitHub Action inside a CodeCatalyst workflow as a quick alternative, and asked the reader to "verify GitHub-Actions-in-CodeCatalyst support against current AWS docs" -- leaving the one question that decides whether the suggestion is usable unanswered, in the document that makes the suggestion. Verified. It is supported: the action identifier is aws/github-actions-runner@v1, and the GitHub Action's `steps:` block is pasted into the CodeCatalyst action's `Steps:`. Added a worked example. It is not a drop-in, which is the part worth writing down. AWS states outright that "detailed migration steps are outside the scope of this guide", and their own porting example shows `GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}` being deleted, because CodeCatalyst has no GitHub secrets context. Since the token here exists to dodge GitHub's 60 req/hr anonymous limit, someone taking this path and copying the action verbatim would land straight back on rate limiting with no obvious cause. Also noted that anything outside the action's `steps:` block has to be re-expressed in CodeCatalyst YAML, and that reports and artifacts are configured on the CodeCatalyst action rather than by the GitHub Action. Kept the recommendation pointing at the native script, and said why. Documentation only; no code changes. Refs: https://docs.aws.amazon.com/codecatalyst/latest/userguide/github-action-ref.html --- codecatalyst/README.md | 36 ++++++++++++++++++++++++++++++++---- 1 file changed, 32 insertions(+), 4 deletions(-) diff --git a/codecatalyst/README.md b/codecatalyst/README.md index f710c14..0c1544e 100644 --- a/codecatalyst/README.md +++ b/codecatalyst/README.md @@ -9,10 +9,38 @@ A gate failure exits non-zero -> the action fails. Findings surface in the **Reports** tab via the SARIF report (`trustabl.sarif`). -**Alternative (quick) path:** instead of the native script, run the existing -GitHub Action in a CodeCatalyst workflow via the GitHub Actions action -(`trustabl/trustabl-action@v0`). Verify GitHub-Actions-in-CodeCatalyst support -against current AWS docs. +**Alternative path:** instead of the native script, run the existing GitHub +Action inside a CodeCatalyst workflow. This is supported — the action +identifier is `aws/github-actions-runner@v1`, and you paste the GitHub Action's +`steps:` block into the CodeCatalyst action's `Steps:`: + +```yaml +Actions: + Trustabl_Scan: + Identifier: aws/github-actions-runner@v1 + Inputs: + Sources: + - WorkflowSource + Configuration: + Steps: + - name: Trustabl + uses: trustabl/trustabl-action@v0 +``` + +It is not a drop-in, though, and AWS says "detailed migration steps are outside +the scope of this guide": + +- **`${{ secrets.GITHUB_TOKEN }}` does not exist here.** CodeCatalyst has no + GitHub secrets context, and AWS's own porting example shows that line being + deleted. If the action wants a token for GitHub API rate limits, supply it + from a CodeCatalyst secret instead. +- Anything the action relies on outside its `steps:` block has to be + re-expressed in CodeCatalyst's own YAML. +- Reports and artifacts are configured on the CodeCatalyst action + (`Outputs.Reports`, `Outputs.Artifacts`), not by the GitHub Action. + +The native script above avoids all of that, which is why it is the documented +path. See [GitHub Actions action YAML](https://docs.aws.amazon.com/codecatalyst/latest/userguide/github-action-ref.html). ## Quickstart — from zero (CodeCatalyst)