Azure DevOps
Learn how to integrate Debricked with Azure DevOps.
Last updated
Learn how to integrate Debricked with Azure DevOps.
Last updated
© 2018-2024 | Open Text
With our CI integration to Azure DevOps you can automatically upload your latest commits and pull requests to Debricked or whenever you run your pipeline. Our Azure DevOps integration support the same options as our Bitbucket integration.
Start by generating an access token. Copy the token so that you can use it in the next step.
Configure your DEBRICKED_TOKEN variable by heading over to [your repository] -> Pipelines -> [your pipeline name] -> Edit -> Variables. Make sure to check “Keep this value secret” so you don’t expose your login credentials to the world.
Depending on what package manager you are using there are different step setups.
In order for us to analyze all dependencies in your project, their versions, and relations, files containing the resolved dependency trees have to be created prior to scanning. Those depend on the package manager used. If files are lacking we try to generate them on our side, which can negatively affect speed and accuracy.
Example 1: If npm is used in your project you will have a package.json file, but in order for us to scan all your dependencies we need either package-lock.json or yarn.lock as well.
Example 2: If Maven is used in your project you will have a pom.xml file, but in order for us to resolve all your dependencies we need a second file, as Maven does not offer a lock file system. Instead, Maven dependency:tree plugin can be used to create a file called .debricked-maven-dependencies.tgf.
Add the template to your azure-pipelines.yml file (if the file doesn't exist, create one)
Commit your changes to azure-pipelines.yml and watch the CI run!
Integrating many repositories with one configuration using Azure DevOps can greatly simplify the process of managing and deploying code across multiple projects.
To avoid having to add the DEBRICKED_TOKEN to every integrated repository, it is possible to share the Debricked token between repositories. In order to enable this, you need to create a variable group:
Sign in to your organization and select your project
Go to: Pipelines → Library → Variable groups
Click + Variable group
Enter a suitable name for your variable group, eg. "Debricked”
Click on + Add
Add your token from 1. to a secret variable called DEBRICKED_TOKEN (to make it secret, toggle the "lock" icon at the end of the row)
Click Save
Go to the Pipeline permissions tab
Press three vertical dots and choose Open access to allow access in all pipelines. If you want to, it is also possible to just specify specific pipelines who should get access.
After this you can use the created variable in your repository pipelines.
If you would like to use our shared template out-of-the box without modifications, you first need to create a service connection to GitHub. If you’re, however, planning on copying the main template into your own organization you can skip this step.
Go to: Project settings → Service connections
Click Create service connection
Select Github from the list, and press Next
In OAuth Configuration drop-down select AzurePipelines
Press Authorize and follow instructions, using your own GitHub account
Give new service connection name, which you will use as a value for endpoint parameter later on
Click Save
You can now use the following template in pipelines of repositories you want to integrate with Debricked. The triggering template refers directly to the Azure DevOps template core repository found in the Debricked CLI repository. If you would like to make modifications to it, it is also possible to copy the template from the CLI repository into a core repository of your own, which you would then refer to in the triggering template below.
NOTE: During the first run of the pipeline it will ask permission to run subsequent job. You should click Permit.
By directly referencing the Debricked core repository, you will automatically receive any new updates made to the Debricked core repository template. If you would like to customize the template, use the setup described in option 2 below.
In the repositories that you want to trigger the shared pipeline from, paste the triggering template above to an azure pipelines yaml file.
Fill in the variables to match the Debricked core repository according to the list below. If you’re not using the variable group from step 1, remove the variables section from the triggering template:
<variable_group_name>: Name of the variable group created in step 1
<repository_reference>: Named reference of your choice
<repository_type>: github
<username_or_project>: debricked
<repository_name>: cli
<service_connection_name>: The name of the service connection created in step 2
<resource_template_file_name>: examples/templates/Azure/azure-pipelines.yml
By using your own core repository containing the template in Azure DevOps, you do not need to create a service connection and can customise the template to your liking.
Create a new repository in your organisation or use an already existing one as the core.
Paste the Debricked template contents from the Debricked template into an azure pipelines yaml file
If you would like to set up scanning in this repository as well and want to use the variable group from step 1, add the variables section from the triggering template above into the template under the “debricked_scan” job.
In the repositories that you want to trigger the shared pipeline from, paste the triggering template above to an azure pipelines yaml file. If you’re not using a service connection, you should remove the endpoint variable from the triggering template.
Fill in the variables to match the chosen core repository according to the list below. If you’re not using the variable group from step 1, remove the variables section from the triggering template:
<variable_group_name>: Name of the variable group created in step 1
<repository_reference>: Named reference of your choice
<repository_type>: git
<username_or_project>: The name of the azure project containing your core repository
<repository_name>: The name of the core repository
<service_connection_name>: Not needed if the core repository exists in your organisation, remove the endpoint variable
<resource_template_file_name>: The path/name to the template file in your core repository
Debricked can generate pull requests for you, but to be able to use it in Azure DevOps, you also need to provide us with credentials such that we can create the pull request on your Azure DevOps instance.
You can generate a Personal access token by going to the User settings -> Personal access tokens. You need to:
Select your organization (or you can create a token for all accessible organizations);
Set custom expiration date to the maximum possible value
Grant the token the Code (Read, write, & manage) scope
Then when you try to create a Pull Request inside the Debricked tool, it will automatically ask you for your credentials when needed
Fill out the form:
Host: enter the domain, e.g.: "https://dev.azure.com/", "https://azure.yourcompany.com", "https://org.visualstudio.com"
Token: enter the personal access token created before and enter
After clicking Confirm, the merge request generation will start
