make ecr check async

Author: kazmer97

patterns/pattern-2/buildspec.yml

@@ -56,36 +56,24 @@ phases:
       - echo "All Pattern-2 Docker images successfully built and pushed to ECR"
       - echo "ECR Repository - $ECR_URI"
       - echo "Image Version - $IMAGE_VERSION"
-      - echo "Waiting for vulnerability scans to complete..."
+      - echo "Note: ECR vulnerability scans initiated (ScanOnPush enabled)"
+      - echo "Scans will complete asynchronously. Check ECR console for results."
+      - echo "For accounts with Amazon Inspector Enhanced Scanning, scans may take 10-30 minutes per image."
       - |
-        # Wait for and check vulnerability scan results for all images
+        # Optional: Quick check if any scans have already completed
+        # This is informational only and does not block the build
         IMAGES=("ocr-function" "classification-function" "extraction-function" "assessment-function" "processresults-function" "hitl-wait-function" "hitl-status-update-function" "hitl-process-function" "summarization-function")
+        echo "Checking scan status (non-blocking)..."
         for IMAGE in "${IMAGES[@]}"; do
-          echo "Checking scan results for $IMAGE-$IMAGE_VERSION..."
-          # Wait for scan to complete (max 10 minutes)
-          for i in {1..60}; do
-            SCAN_STATUS=$(aws ecr describe-image-scan-findings --repository-name $(basename $ECR_URI) --image-id imageTag=$IMAGE-$IMAGE_VERSION --region $AWS_REGION --query 'imageScanStatus.status' --output text 2>/dev/null || echo "IN_PROGRESS")
-            if [ "$SCAN_STATUS" = "COMPLETE" ]; then
-              echo "Scan completed for $IMAGE-$IMAGE_VERSION"
-              # Get vulnerability counts
-              CRITICAL=$(aws ecr describe-image-scan-findings --repository-name $(basename $ECR_URI) --image-id imageTag=$IMAGE-$IMAGE_VERSION --region $AWS_REGION --query 'imageScanFindings.findingCounts.CRITICAL' --output text 2>/dev/null || echo "0")
-              HIGH=$(aws ecr describe-image-scan-findings --repository-name $(basename $ECR_URI) --image-id imageTag=$IMAGE-$IMAGE_VERSION --region $AWS_REGION --query 'imageScanFindings.findingCounts.HIGH' --output text 2>/dev/null || echo "0")
-              echo "Vulnerabilities found in $IMAGE-$IMAGE_VERSION: CRITICAL=$CRITICAL, HIGH=$HIGH"
-              # Fail build if critical vulnerabilities found
-              if [ "$CRITICAL" != "0" ] && [ "$CRITICAL" != "None" ]; then
-                echo "ERROR: Critical vulnerabilities found in $IMAGE-$IMAGE_VERSION. Build failed."
-                exit 1
-              fi
-              break
-            elif [ "$SCAN_STATUS" = "FAILED" ]; then
-              echo "WARNING: Vulnerability scan failed for $IMAGE-$IMAGE_VERSION"
-              break
-            fi
-            echo "Scan in progress for $IMAGE-$IMAGE_VERSION... (attempt $i/60)"
-            sleep 10
-          done
-          if [ "$SCAN_STATUS" != "COMPLETE" ]; then
-            echo "WARNING: Scan did not complete within timeout for $IMAGE-$IMAGE_VERSION"
+          SCAN_STATUS=$(aws ecr describe-image-scan-findings --repository-name $(basename $ECR_URI) --image-id imageTag=$IMAGE-$IMAGE_VERSION --region $AWS_REGION --query 'imageScanStatus.status' --output text 2>/dev/null || echo "IN_PROGRESS")
+          if [ "$SCAN_STATUS" = "COMPLETE" ]; then
+            CRITICAL=$(aws ecr describe-image-scan-findings --repository-name $(basename $ECR_URI) --image-id imageTag=$IMAGE-$IMAGE_VERSION --region $AWS_REGION --query 'imageScanFindings.findingCounts.CRITICAL' --output text 2>/dev/null || echo "0")
+            HIGH=$(aws ecr describe-image-scan-findings --repository-name $(basename $ECR_URI) --image-id imageTag=$IMAGE-$IMAGE_VERSION --region $AWS_REGION --query 'imageScanFindings.findingCounts.HIGH' --output text 2>/dev/null || echo "0")
+            echo "  $IMAGE-$IMAGE_VERSION: COMPLETE - CRITICAL=$CRITICAL, HIGH=$HIGH"
+          elif [ "$SCAN_STATUS" = "FAILED" ]; then
+            echo "  $IMAGE-$IMAGE_VERSION: FAILED"
+          else
+            echo "  $IMAGE-$IMAGE_VERSION: IN_PROGRESS"
           fi
         done
-      - echo "Vulnerability scanning completed for all images"
+        echo "Build complete. Review scan results in ECR console after scans finish."