--commit-range flag does not appear to have a substantial effect

[bellis-ai]

I'm trying to set up this tool in my CICD pipeline. My workflow is that, from my local machine, I do a full repository scan. Once that's done, I add a pipeline step to my CICD pipeline that does incremental scans supposedly on the new lines of code that I push up.

Problem is, I don't think the incremental scans are restricted to just the new lines of code that I push up. It appears to always scan the entire repo.

See this repo for a minimal reproducible example: https://gitlab.com/bellis3/aws-codeguru-cli-commit-range-test

It appears to scan lines of code even when no new lines of code are present. It also seems to scan amounts of code that aren't even within the range of the commits. I get no error about using "--commit-range" either, leading me to believe that my usage is correct.

[martinschaef]

Did you check in your AWS Console if it was run as an incremental scan or full repo scan? If you provide build artifacts, you might get security recommendations for code outside the diff, but you will only be billed for the changed lines.

[bellis-ai]

Console says "Pull request", number of lines of code reviewed comes from the "Reviewed lines of code" column, not sure how I would know if I provided "build artifacts".

The command I used to run the scan was

./aws-codeguru-cli/bin/aws-codeguru-cli --region $AWS_CODEGURU_REGION --bucket-name $AWS_CODEGURU_BUCKET --no-prompt --root-dir ./ --commit-range "$CI_COMMIT_BEFORE_SHA:$CI_COMMIT_SHA"

[martinschaef]

The -b option would provide build artifacts, but that is only relevant for Java. Let me find out what the issue with the diff size is.

[martinschaef]

I checked the line number issue. The UX is a little confusing and we should address this. The "Reviewed lines of code" refers to the total number of lines analyzed for this association. So, if your first diff contains six lines, and the second contains zero line, it will show six lines for both.

[linghuiluo]

@martinschaef Aren't you on vacation?