PARITY.md

service	codebuild
sdk_module	aws-sdk-go-v2/service/codebuild@v1.68.11
last_audit_commit	0627d5d3
last_audit_date	2026-07-25
overall	A
ops	CreateProject UpdateProject DeleteProject BatchGetProjects ListProjects StartBuild StopBuild BatchGetBuilds ListBuilds ListBuildsForProject RetryBuild BatchDeleteBuilds StartBuildBatch StopBuildBatch RetryBuildBatch BatchGetBuildBatches DeleteBuildBatch ListBuildBatches ListBuildBatchesForProject CreateReportGroup UpdateReportGroup DeleteReportGroup BatchGetReportGroups ListReportGroups BatchGetReports DeleteReport ListReports ListReportsForReportGroup GetReportGroupTrend DescribeCodeCoverages DescribeTestCases CreateFleet UpdateFleet DeleteFleet BatchGetFleets ListFleets CreateWebhook UpdateWebhook DeleteWebhook ImportSourceCredentials DeleteSourceCredentials ListSourceCredentials PutResourcePolicy GetResourcePolicy DeleteResourcePolicy UpdateProjectVisibility InvalidateProjectCache StartSandbox StopSandbox BatchGetSandboxes ListSandboxes ListSandboxesForProject StartSandboxConnection StartCommandExecution BatchGetCommandExecutions ListCommandExecutionsForSandbox ListCuratedEnvironmentImages ListSharedProjects ListSharedReportGroups wire errors state persist note ok ok ok ok FIXED this pass: now threads top-level sourceVersion, see gaps fixed below wire errors state persist note ok ok ok ok FIXED this pass, same as CreateProject wire errors state persist note ok ok ok ok cascades build deletion via buildsByProject index wire errors state persist note ok ok ok ok includes webhook and sourceVersion fields wire errors state persist note ok ok ok ok FIXED this pass: nextToken/sortBy(NAME|CREATED_TIME|LAST_MODIFIED_TIME)/sortOrder all implemented via ListProjectsSortedBy + paginateIDs, 100-item default page matching real AWS wire errors state persist note ok ok ok ok env var override uses correct AWS replace-by-name-else-append merge semantics wire errors state persist ok ok ok ok wire errors state persist note ok ok ok ok accepts both build ID and ARN via buildsByARN index wire errors state persist note ok ok ok ok FIXED this pass: nextToken/sortOrder via paginateIDs (ListBuilds has no sortBy/maxResults in the real request shape) wire errors state persist note ok ok ok ok FIXED this pass: nextToken/sortOrder via paginateIDs wire errors state persist note ok ok ok ok inherits env/source/artifacts/role/timeouts from original build, matching AWS wire errors state persist ok ok ok ok wire errors state persist ok ok ok ok wire errors state persist ok ok ok ok wire errors state persist ok ok ok ok wire errors state persist ok ok ok ok wire errors state persist ok ok ok ok wire errors state persist note ok ok ok ok FIXED this pass: filter.status/nextToken/sortOrder/maxResults implemented, and the op is now documented here (it was already routed/tested pre-pass, just missing from this manifest) wire errors state persist note ok ok ok ok FIXED this pass, same as ListBuildBatches; also newly documented here wire errors state persist ok ok ok ok wire errors state persist ok ok ok ok wire errors state persist ok ok ok ok wire errors state persist note ok ok ok ok accepts ARN or bare name wire errors state persist note ok ok ok ok FIXED this pass: nextToken/sortBy(NAME|CREATED_TIME|LAST_MODIFIED_TIME)/sortOrder/maxResults via ListReportGroupsSortedBy + paginateIDs wire errors state persist ok ok ok ok wire errors state persist ok ok ok ok wire errors state persist note ok ok ok ok FIXED this pass: filter.status/nextToken/sortOrder/maxResults implemented wire errors state persist note ok ok ok ok FIXED this pass, same as ListReports wire errors state persist note partial ok ok n/a returns empty stats map (no report-execution data modeled), acceptable stub-free no-op since no reports carry numeric stats; see items_still_open wire errors state persist note partial ok ok n/a always empty list — no coverage data modeled; see items_still_open wire errors state persist note partial ok ok n/a always empty list — no test-case data modeled; see items_still_open wire errors state persist note ok ok ok ok id (Fleet had no separate id field at all -- now uuid-generated), overflowBehavior, imageId, fleetServiceRole fixed in the earlier 2026-07-25 pass. Second 2026-07-25 pass: computeConfiguration/proxyConfiguration/vpcConfig/scalingConfiguration now also accepted, stored, and echoed back (scalingConfiguration's desiredCapacity is populated from baseCapacity, matching AWS's no-scaling-event-yet behavior -- see fleets.go's outputScalingConfiguration doc comment) wire errors state persist note ok ok ok ok computeType/environmentType/overflowBehavior/imageId/fleetServiceRole fixed in the earlier 2026-07-25 pass. Second 2026-07-25 pass: computeConfiguration/proxyConfiguration/vpcConfig/scalingConfiguration now also updatable (nil pointer leaves the existing value unchanged, non-nil overwrites -- matches real UpdateFleetInput's partial-update semantics) wire errors state persist note ok ok ok ok accepts ARN or bare name wire errors state persist ok ok ok ok wire errors state persist note ok ok ok ok FIXED this pass: nextToken/sortBy(NAME|CREATED_TIME|LAST_MODIFIED_TIME)/sortOrder/maxResults via ListFleetsSortedBy + paginateIDs; also fixed default ordering to be NAME-ascending (was ARN-string-ascending, an internal artifact with no real-AWS basis) wire errors state persist note ok ok ok ok FIXED this pass: adds manualCreation/scopeConfiguration/pullRequestBuildPolicy request fields and status/secret/lastModifiedSecret/statusMessage response fields, see gaps fixed below wire errors state persist note ok ok ok ok FIXED this pass: adds pullRequestBuildPolicy/rotateSecret request fields (rotateSecret regenerates secret+lastModifiedSecret) wire errors state persist note ok ok ok ok clears Project.Webhook wire errors state persist ok ok ok ok wire errors state persist ok ok ok ok wire errors state persist ok ok ok ok wire errors state persist ok ok ok ok wire errors state persist ok ok ok ok wire errors state persist note ok ok ok ok idempotent, matches AWS wire errors state persist note ok ok ok ok generates/clears publicProjectAlias correctly on PUBLIC_READ toggle wire errors state persist note ok ok ok n/a correctly a real no-op (cache not modeled) once project existence is validated wire errors state persist ok ok ok ok wire errors state persist ok ok ok ok wire errors state persist ok ok ok ok wire errors state persist note ok ok ok ok FIXED this pass: nextToken/sortOrder/maxResults via paginateIDs wire errors state persist note ok ok ok ok FIXED this pass, same as ListSandboxes wire errors state persist note partial ok ok n/a returns a synthesized wss:// endpoint; real interactive terminal not modeled, acceptable for an emulator wire errors state persist ok ok ok ok wire errors state persist ok ok ok ok wire errors state persist note ok ok ok ok correctly returns full CommandExecution objects, not just IDs wire errors state persist note ok n/a ok n/a hardcoded minimal image catalog, acceptable (AWS's own catalog is also effectively static reference data) wire errors state persist note ok n/a ok n/a correctly empty — no cross-account project sharing modeled wire errors state persist note ok n/a ok n/a correctly empty, same reasoning
families	errors persistence janitor tags status note ok handleError maps ErrNotFound/ErrAlreadyExists/ErrValidation to ResourceNotFoundException/ResourceAlreadyExistsException/InvalidInputException at 400, matching real AWS; all backend ErrNotFound paths reach errCodeLookup correctly; invalid nextToken now also maps to InvalidInputException via ErrValidation status note ok Handler.Snapshot/Restore delegate to InMemoryBackend.Snapshot/Restore, versioned (codebuildSnapshotVersion), backed by store.Registry across all store.Table-based resource maps plus a plain resourcePolicies map status note ok janitor.tick runs sweepCompletedBuilds (TTL eviction) then advanceInProgressBuilds (status advancement) every tick status note ok REMOVED this pass: TagResource/UntagResource/ListTagsForResource were gopherstack-invented operations with no counterpart on the real aws-sdk-go-v2/service/codebuild Client (verified: the SDK module has no api_op_TagResource.go/api_op_UntagResource.go/api_op_ListTagsForResource.go, and Client's exported method set — grepped directly from api_op_*.go — has no such methods). Real AWS CodeBuild only supports tagging inline via the `tags` field on CreateProject/CreateReportGroup/CreateFleet/UpdateProject (already implemented and unaffected). Deleted services/codebuild/tags.go, handler_tags.go, tags_test.go; removed the 3 ops from GetSupportedOperations()/dispatchTable(); TestHandler_GetSupportedOperations now asserts their absence.
items_still_open	DescribeCodeCoverages/DescribeTestCases/GetReportGroupTrend always return empty results because no report actually populates coverage/test-case/trend data anywhere in the backend (reports are seed-only via the AddReportInternal test helper — there is no real CodeBuild API to push test-case/coverage content; on real AWS it's ingested by the managed build agent parsing buildspec `reports` sections and artifact files, which this emulator's build execution does not model). Implementing this for real would require modeling report-content ingestion from build artifacts, which is out of scope for this pass.
gaps
deferred	Report-content ingestion (DescribeCodeCoverages/DescribeTestCases/GetReportGroupTrend real data) — see items_still_open above for why this is a substantially larger feature (build artifact parsing), not a quick fix.
leaks	status note clean janitor.Run selects on ctx.Done() and calls worker.Group.Stop(); TestCodeBuildJanitor_RunContext passes under -race. paginateIDs/ListProjectsSortedBy/ListFleetsSortedBy/ListReportGroupsSortedBy are pure functions under the existing RLock scope — no new goroutines, no new lock paths, all backend locks remain defer-released.

Notes

Protocol: awsjson1.1 (single POST endpoint, X-Amz-Target: CodeBuild_20161006.<Op>). Route matcher (RouteMatcher) is a simple X-Amz-Target prefix check — verified every op in GetSupportedOperations() round-trips through doRequest's header-based dispatch in the existing handler_test.go/codebuild_ops_test.go/aws_accuracy_test.go suites, not just via Handler() direct calls that could bypass the matcher.

Timestamps (created, lastModified, startTime, endTime, etc.) are plain float64 Unix-seconds fields that marshal as bare JSON numbers — this is wire-compatible with the real deserializer's case "created": ... jtv.(json.Number) -> smithytime.ParseEpochSeconds path (confirmed by reading codebuild@v1.68.11/deserializers.go), even though the field isn't typed via pkgs/awstime.Epoch. Not a bug; noted so a future auditor doesn't "fix" it.

Pagination: services/codebuild/pagination.go's paginateIDs applies nextToken/maxResults/ sortOrder uniformly across every List* op, using pkgs/page.New for the opaque-offset token (matching the pattern already used by e.g. services/acm). defaultListPageSize = 100 matches real AWS's documented page cap. ListProjects/ListFleets/ListReportGroups additionally support sortBy (NAME|CREATED_TIME|LAST_MODIFIED_TIME) via dedicated List*SortedBy(sortBy string) backend methods, since real AWS's request shape for exactly these three ops includes a sortBy field (confirmed by field-diffing api_op_ListProjects.go/api_op_ListFleets.go/api_op_ListReportGroups.go against api_op_ListBuilds.go et al, which have no sortBy). ListBuildBatches(ForProject)/ ListReports(ForReportGroup) additionally support filter.status, matching real AWS's BuildBatchFilter/ReportFilter request shapes (each a single optional status field).

Invented-ops deletion this pass

TagResource / UntagResource / ListTagsForResource were gopherstack inventions, not real AWS CodeBuild operations. Field-diffed against aws-sdk-go-v2/service/codebuild@v1.68.11: the module directory has no api_op_TagResource.go, api_op_UntagResource.go, or api_op_ListTagsForResource.go, and grepping every func (c *Client) ... across all api_op_*.go files in the module yields exactly 59 operations — none of which are these three. Real CodeBuild only exposes tagging inline via the tags field on CreateProject/ UpdateProject/CreateReportGroup/CreateFleet (cross-service ARN-based tag discovery is the job of the separate resourcegroupstaggingapi service on real AWS, which CodeBuild does not duplicate). Deleted tags.go (backend TagResource/UntagResource/ListTagsForResource methods), handler_tags.go (the three op handlers), and tags_test.go (12 tests exercising the invented API). Removed the three names from GetSupportedOperations()/dispatchTable() in handler.go. TestHandler_GetSupportedOperations now asserts these three are absent, so a future accidental reintroduction gets caught immediately. janitor_test.go's TestJanitor_SweepCleansARNIndex (which used TagResource on an evicted build's ARN purely as a convenient "does an ARN-based op see this as gone" probe) was rewritten to use BatchGetBuilds instead — same assertion (no ghost row after eviction), real op.

Bugs fixed this pass

1. Missing pagination wire shape on every List* operation (services/codebuild/pagination.go, handler_projects.go, handler_builds.go, handler_build_batches.go, handler_reports.go, handler_fleets.go, handler_sandboxes.go). Every List* op previously accepted but silently ignored nextToken/sortBy/sortOrder/maxResults, always returning the full unpaginated result set with nextToken always omitted. A real client relying on the SDK paginator's HasMorePages() (which checks the returned nextToken, not result-set size) would still terminate correctly, but a client testing "at least 100 items on this page then a token" load-testing/pagination-contract scenario, or a client using sortOrder=DESCENDING to see newest-first results, would silently get wrong data. Fixed by adding a shared paginateIDs(all []string, nextToken, sortOrder string, maxResults int32) (page.Page[string], error) helper (using pkgs/page, matching the pattern in services/acm) and wiring it into every List* handler. ListProjects/ListFleets/ListReportGroups (the three ops whose real request shape has sortBy) got new List*SortedBy(sortBy string) backend methods; ListFleets's default order was also corrected from ARN-string-ascending (an internal implementation artifact) to NAME-ascending, consistent with ListProjects/ListReportGroups and with sortBy=NAME.

2. Project missing the top-level sourceVersion field (services/codebuild/models.go, projects.go, handler_projects.go). Real AWS's Project shape has a sourceVersion field distinct from secondarySourceVersions (confirmed via codebuild@v1.68.11/types/types.go); CreateProjectInput/UpdateProjectInput also carry it. Nothing threaded it through before — a client setting sourceVersion on CreateProject would silently have it dropped. Fixed by adding Project.SourceVersion, ProjectConfig.SourceVersion, and wiring it through CreateProject/UpdateProject/applyProjectOptionalFields (update semantics: non-empty value overwrites, matching every other optional string field on this resource) and the createProjectInput/updateProjectInput wire structs.

3. Webhook missing status/statusMessage/manualCreation/lastModifiedSecret/secret/ pullRequestBuildPolicy/scopeConfiguration (services/codebuild/models.go, webhooks.go, handler_webhooks.go). Field-diffed against codebuild@v1.68.11/types/types.go's Webhook struct. Since this emulator never performs a real GitHub/GitLab/Bitbucket round-trip, CreateWebhook now synthesizes a terminal status: "ACTIVE" immediately (the state a client would eventually observe on real AWS after webhook provisioning completes) plus a generated secret and lastModifiedSecret timestamp; manualCreation/scopeConfiguration are accepted on CreateWebhook and echoed back; pullRequestBuildPolicy is accepted on both CreateWebhook and UpdateWebhook; UpdateWebhook also gained rotateSecret (regenerates secret + bumps lastModifiedSecret when true, leaves both untouched otherwise, matching real AWS's UpdateWebhookInput.rotateSecret semantics).

Covered by new table-driven tests: TestHandler_ListProjects_SortOrderDescending, TestHandler_ListProjects_InvalidNextToken, TestHandler_ListProjects_SortByCreatedTime, TestHandler_ListFleets_MaxResultsPagination, TestHandler_ListBuildBatches_FilterByStatus, TestHandler_ListReports_FilterByStatus (pagination_test.go); TestHandler_Project_SourceVersion (projects_test.go); TestHandler_CreateWebhook_ExtendedFields, TestHandler_UpdateWebhook_RotateSecret (webhooks_test.go).

Prior-pass fixes (builds/build batches stuck IN_PROGRESS forever; Project.Webhook not mirrored after CreateWebhook) remain in place and are covered by TestJanitor_AdvanceInProgressBuilds / TestJanitor_AdvanceInProgressBuilds_LeavesTerminalBuildsAlone (janitor_test.go) and TestHandler_Webhook_MirroredOnProject (webhooks_test.go).

2026-07-25 pass: Fleet field-diff

Field-diffed Fleet/CreateFleetInput/UpdateFleetInput against aws-sdk-go-v2/service/codebuild@v1.68.11/types/types.go and awsAwsjson11_deserializeDocumentFleet directly (not against gopherstack's own output, per parity-principles.md rule 2). Found and fixed a real, previously-unflagged gap: Fleet had no id field at all (a real, separate field from name/arn on types.Fleet), and CreateFleetInput/UpdateFleetInput's wire structs had no overflowBehavior/imageId/fleetServiceRole members, so a real client setting any of these had them silently dropped on create and had no way at all to change them (or computeType/environmentType) after creation via UpdateFleet, which previously only ever touched baseCapacity. Fixed by adding Fleet.ID/Fleet.ImageID, generating a UUID id at CreateFleet time (mirroring how other resources in this service generate IDs), and refactoring CreateFleet/UpdateFleet's backend signatures to take CreateFleetOptions/UpdateFleetOptions structs (the growing flat-positional-parameter lists were becoming unwieldy) wired through from new createFleetInput/ updateFleetInput JSON fields. UpdateFleet's "empty string leaves field unchanged" semantics mirror the existing applyProjectOptionalFields convention for optional string-field updates on this service.

Also found, NOT fixed in this pass: Fleet.ComputeConfiguration/ProxyConfiguration/ VpcConfig/ScalingConfiguration (all real fields on types.Fleet) remained entirely unmodeled -- these are nested objects (attribute-based-compute vCPU/memory/disk specs, subnet/security-group VPC config, scaling-type semantics) that would require real design work, not a wire-shape passthrough fix. Documented as a new gaps: entry rather than silently left unflagged like the id/overflowBehavior/imageId/fleetServiceRole gap was before this pass. Closed in the second 2026-07-25 pass immediately below.

Covered by new tests: TestHandler_CreateFleet_ExtendedFields, TestHandler_UpdateFleet_ExtendedFields (fleets_test.go).

2026-07-25 pass #2: Fleet nested configuration objects (closes the gap above)

Implemented ComputeConfiguration/ProxyConfiguration/VpcConfig/ScalingConfiguration end to end, field-diffed against aws-sdk-go-v2/service/codebuild@v1.68.11's types.ComputeConfiguration/types.ProxyConfiguration/types.VpcConfig/ types.FleetProxyRule/types.TargetTrackingScalingConfiguration/ types.ScalingConfigurationInput/types.ScalingConfigurationOutput directly (go doc plus reading serializers.go's awsAwsjson11_serializeOpDocumentCreateFleetInput/ UpdateFleetInput for exact request field names, and deserializers.go's awsAwsjson11_deserializeDocumentFleet for the response). Added new model types (models.go): ComputeConfiguration, ProxyConfiguration, FleetProxyRule, TargetTrackingScalingConfig; extended the existing (previously dead-field) ScalingConfiguration type with TargetTrackingScalingConfigs. Fleet.VpcConfig deliberately reuses the existing VpcConfig type already defined for Project -- the real aws-sdk-go-v2/service/codebuild/types.VpcConfig used by both Fleet and Project has the identical shape (securityGroupIds/subnets/vpcId), so a second, duplicate type would have been pure duplication.

Wired through CreateFleetOptions/UpdateFleetOptions (fleets.go) -- extending the existing options structs from the prior pass rather than inventing a parallel path, per this pass's instructions -- and the createFleetInput/updateFleetInput JSON wire structs (handler_fleets.go). UpdateFleet's nested-object semantics: a non-nil pointer overwrites, nil (absent from the request) leaves the existing value unchanged, matching real UpdateFleetInput's partial-update contract (distinct from the string fields' "empty string leaves unchanged" convention, since a nested object has no equivalent "empty" sentinel).

ScalingConfiguration.DesiredCapacity is response-only on real AWS (types. ScalingConfigurationOutput has it; types.ScalingConfigurationInput, the request shape, does not) -- confirmed by diffing the two types separately in types/types.go. Since this emulator does not model live auto-scaling telemetry, outputScalingConfiguration (fleets.go) populates it with the fleet's baseCapacity on every Create/UpdateFleet response, matching real AWS's own value immediately after a create/update, before any scaling event has occurred -- not a fabricated number, the literal correct value for that moment.

Disguised-stub pattern found and fixed while doing this: Fleet.ScalingConfiguration already existed as a model field (with a real JSON tag) before this pass, but nothing anywhere ever set it -- a stray leftover from an earlier partial attempt, matching the "field exists, no write-sites" bug class documented in parity-principles.md. It is now genuinely wired end to end.

Covered by a new table test, TestHandler_Fleet_NestedConfiguration (fleets_test.go, cases: create_computeConfiguration, create_proxyConfiguration, create_vpcConfig, create_scalingConfiguration_desiredCapacityMatchesBase, update_overwrites_nested_configuration, update_without_nested_configuration_leaves_it_unchanged).