Skip to main content
A practical, step-by-step walkthrough to build a simple CI pipeline using GitHub as the source and AWS CodePipeline + CodeBuild for automation. This lesson focuses on the Source and Build stages; deployment will be covered in a later lesson.

​
What you’ll learn

  • How to connect GitHub to AWS CodePipeline using CodeStar Connections (GitHub App).
  • How to create a custom CodePipeline with Source and Build stages.
  • How CodeBuild uses buildspec.yml in your repository to run builds.
  • Where pipeline artifacts are stored and how to verify executions.

​
Preparation

For this demo we use a sample GitHub repository containing a small Python app and a buildspec.yml file. The buildspec.yml defines build phases and commands used by CodeBuild.
Screenshot of a dark-themed GitHub repository page for "020-060-sample-app" showing the file list (src, tests, .gitignore, README.md, buildspec.yml, requirements.txt) and repo details. The README section displays the title "Sample Application for Demo 020-060."

​
1. Connect CodePipeline to GitHub (CodeStar Connections)

Use CodeStar Connections (GitHub App) to grant CodePipeline access to your GitHub repository. This method is preferred over OAuth tokens for improved manageability and security. Steps:
  1. In the AWS Console navigate to CodePipeline -> Settings -> Connections.
  2. Create a new connection and select GitHub (via GitHub App / CodeStar Connections). During the GitHub App authorization you will be prompted to allow repository access and permissions required by AWS.
A dark-mode GitHub settings page showing the "AWS Connector for GitHub" app with its permissions and repository access options. The left sidebar lists account and access settings like Appearance, Notifications, and SSH keys.
  1. After authorization the connection will appear in CodePipeline Connections with status “Available”. You may scope the connection to all repositories or limit it to selected repositories during installation.
Screenshot of the AWS Developer Tools Connections page showing a connection named "github-devops-demo." The connection details show provider GitHub, its ARN, and a green "Available" status banner.

​
2. Create a custom CodePipeline

Create a pipeline manually (not from a template) so you can explicitly control Source and Build stages.
  1. Go to CodePipeline -> Pipelines -> Create a pipeline.
  2. Choose the custom pipeline option to add stages manually.
A screenshot of the AWS CodePipeline "Choose creation option" page showing category choices (Deployment is selected) and template cards below, with "Push to ECR" highlighted.
Important pipeline settings:
  • Pipeline name: eg. github-demo-pipeline
  • Execution mode:
    • queued — preserve execution order (recommended default for most pipelines).
    • superseded — abort previous in-progress executions when a new run starts.
    • parallel — allow concurrent executions (useful for independent branches). In this demo we use queued to preserve order and avoid resource conflicts.
  • Service role: choose an existing IAM role or allow creation of a new one. The role requires permissions for CodePipeline, CodeBuild, and S3 artifact access.
  • Artifact store: choose a custom S3 bucket (or let CodePipeline create one). You can choose AWS-managed or customer-managed encryption keys.
Screenshot of the AWS CodePipeline "Create new pipeline" settings showing the Artifact store configured to a custom S3 bucket (devops-020-060-artifacts-ba411df6) with the default AWS-managed encryption key selected. The Variables section and an "Add variable" button are visible below.

​
3. Configure the Source stage (GitHub)

Set up the repository and branch that will trigger pipeline runs. Steps:
  1. For Source provider select GitHub and choose the CodeStar Connection you created.
  2. Select the repository (for example: peopleforrester/020-060-sample-app) and the default branch (for example: main).
  3. Artifact format:
    • CodePipeline default (ZIP) — fastest; does not include .git metadata.
    • Full clone — runs git clone and preserves git metadata (useful if you need git commands or history during build).
  4. Enable webhook events to trigger the pipeline on pushes and pull requests. This enables near real-time builds via GitHub webhooks.
See GitHub webhooks docs for more: https://docs.github.com/en/developers/webhooks-and-events/about-webhooks
Screenshot of the AWS CodePipeline "Create new pipeline" setup page. It shows a GitHub connection, repository "peopleforrester/020-060-sample-app", the default branch set to "main", and artifact format options.

​
4. Add a Build stage

A typical CI pipeline includes a Build stage to run tests, linters, or package artifacts. You can choose between simple inline commands or a full CodeBuild project.
  • If your needs are minimal, CodePipeline supports inline “Commands” for quick tasks:
  • For full CI, select AWS CodeBuild to run your repository’s buildspec.yml. Using buildspec.yml in the repo is recommended because it keeps build logic versioned with your code.
Select CodeBuild as build provider and point it to the repo buildspec (default behavior if buildspec.yml exists).
Screenshot of the AWS CodePipeline "Add build stage - optional" page showing build provider options (Commands or Other build providers) with AWS CodeBuild selected, plus fields for project name and environment variables.

​
Create a CodeBuild project

When creating a CodeBuild project, configure these essential values:
  • Project name: e.g., demo-020060
  • Environment image: e.g., aws/codebuild/ami/amazonlinux-x86_64-base:latest
  • Service role: select or create a role allowing read access to source artifacts and write access to build artifacts in S3
  • Compute size: small is usually enough for lightweight demos
  • Buildspec: use the buildspec.yml in the repository (default if present)
Example environment values used in this demo:
Screenshot of the AWS CodePipeline "Create new pipeline" page showing a green success banner that a CodeBuild project was created. The page displays settings for environment variables, build type (Single build selected), region, and input artifacts.
After creating the CodeBuild project, your build stage is configured in the pipeline. Optionally set environment variables, batch builds, VPC settings, timeouts, and logging.

​
5. Create and run the pipeline

  • You can omit Test/Deploy stages if you only want Source -> Build for CI.
  • Create the pipeline and watch execution. The Source stage will fetch the repository artifact (ZIP or full clone) and place it into the pipeline S3 artifact bucket. The Build stage picks up that artifact and executes the buildspec.yml in CodeBuild.
A screenshot of the AWS CodePipeline console for a pipeline named "github-demo-pipeline," with a green success banner indicating the pipeline was created. The pipeline view shows Source (GitHub) and Build (AWS CodeBuild) stages, with actions marked succeeded or in progress.

​
Where artifacts are stored

  • Source artifacts produced by the Source action are placed in the pipeline S3 bucket you configured.
  • Build output artifacts (inputs for any subsequent Deploy stage) are also stored in S3 under the pipeline bucket/prefix.
  • Verify artifacts in the S3 console under the bucket/prefix created for your pipeline.

​
Viewing a successful pipeline run

After the build completes you should see green success markers for the Source and Build stages in the CodePipeline console. The S3 artifact becomes the input for any later deploy stage you add.
A screenshot of the AWS CodePipeline console showing a "github-demo-pipeline" with a green success banner. The pipeline's Source and Build stages are displayed and marked as succeeded.

​
Quick reference: Pipeline components and purpose

​
Key takeaways

  • Use CodeStar Connections (GitHub App) to securely integrate GitHub with CodePipeline; it offers repository-scoped access versus legacy OAuth tokens.
  • Choose the correct pipeline execution mode (queued, superseded, parallel) to match your workflow and concurrency requirements.
  • Source actions produce artifacts (ZIP or full clone) saved in the pipeline S3 bucket; the Build stage consumes those artifacts.
  • Keep build logic in the repository with buildspec.yml to ensure build configuration is versioned alongside your code. Inline Commands are fine for quick, simple tasks.
Ensure IAM roles for CodePipeline and CodeBuild have the necessary permissions: S3 read/write for artifacts, CloudWatch Logs permissions, and any resource-specific permissions your build or deploy steps require. Insufficient permissions are a common root cause of pipeline failures.
That completes this simple CI pipeline walkthrough: GitHub as Source, CodeBuild for builds, and S3 for artifact storage, all orchestrated by CodePipeline.

Watch Video

Practice Lab