AWS codebuild: CODEBUILD_BUILD_SUCCEEDIN is still 1 even build step failed

Question

Step 65/154 : RUN  apt-get install -y python3-pip
 ---> Running in 29f078573813
Reading package lists...
Building dependency tree...
Reading state information...
E: Unable to locate package python3-pip
The command '/bin/sh -c apt-get install -y python3-pip' returned a non-zero code: 100

[Container] 2022/04/20 02:31:18 Phase complete: BUILD State: SUCCEEDED
[Container] 2022/04/20 02:31:18 Phase context status code:  Message: 
[Container] 2022/04/20 02:31:18 Entering phase POST_BUILD
[Container] 2022/04/20 02:31:18 Running command echo check CODEBUILD_BUILD_SUCCEEDING $CODEBUILD_BUILD_SUCCEEDING
check CODEBUILD_BUILD_SUCCEEDING 1

As above build log, I am using the AWS code pipeline and I try to install python3-pip in the docker but failed. It returns code 100. But the BUILD State is still SUCCEEDED. And when I echo the value of CODEBUILD_BUILD_SUCCEEDING in the post_build step, its value is still 1 which means the building succeeded. I think the CODEBUILD_BUILD_SUCCEEDING should be set as 0 automatically. I want to exit if the CODEBUILD_BUILD_SUCCEEDING is not 1. Could you please help me to figure out why the CODEBUILD_BUILD_SUCCEEDING is still 1 even the exit code is 100?

In case you want to check my buildspec.yml:

version: 0.2

phases:
  install:
    runtime-versions:
      docker: 18
  pre_build:
    commands:
      - echo Logging in to Amazon ECR...
      - aws --version
      - echo $AWS_DEFAULT_REGION
      - eval $(aws ecr get-login --region $AWS_DEFAULT_REGION --no-include-email)
      - REPOSITORY_URI=xxxxxxxxx.dkr.ecr.us-east-1.amazonaws.com/test-farget-ecr-t
      - COMMIT_HASH=$(echo $CODEBUILD_RESOLVED_SOURCE_VERSION | cut -c 1-7)
      - IMAGE_TAG=${COMMIT_HASH:=latest}
      ############################
      # Pull the previous docker image
      - docker pull $REPOSITORY_URI:latest
  build:
    commands:
      - echo Build started on `date`
      - echo Building the Docker image...
      - |
        if [[ $NEED_BUILD == "yes" ]]
        then
            docker build --cache-from $REPOSITORY_URI:latest -t $REPOSITORY_URI:latest .
            docker tag $REPOSITORY_URI:latest $REPOSITORY_URI:$IMAGE_TAG
        fi
  post_build:
    commands:
      - echo "check CODEBUILD_BUILD_SUCCEEDING $CODEBUILD_BUILD_SUCCEEDING"
      - bash -c "if [ "$CODEBUILD_BUILD_SUCCEEDING" == "0" ]; then exit 1; fi"
      - echo Build completed on `date`
      - echo Pushing the Docker images...
      - |
        if [[ $NEED_BUILD == "yes" ]]
        then
            docker push $REPOSITORY_URI:latest
            docker push $REPOSITORY_URI:$IMAGE_TAG
        fi
      - echo Writing image definitions file...
      - printf '{"name":"fargate-test-api-ecr","ImageURI":"%s"}' $REPOSITORY_URI:latest > imageDetail.json
artifacts:
    files:  
      - imageDetail.json
      - taskdef.json
      - appspec.yaml

Answer 1

CodeBuild only gets the exit code of the last command in each build step. In the buildstep

if [[ $NEED_BUILD == "yes" ]]
then
    docker build --cache-from $REPOSITORY_URI:latest -t $REPOSITORY_URI:latest .
    docker tag $REPOSITORY_URI:latest $REPOSITORY_URI:$IMAGE_TAG
fi

your last command is docker tag whose exit code is independent of the previous docker build command. You should combine these commands with && to short circuit in the case of a failed docker build.