LogoLogo
WebsitePricingBlog
  • Debricked Documentation
  • Overview
    • Getting started
      • Create a OpenText Core SCA account
      • Running OpenText Core SCA
    • Help
      • Frequently asked questions (FAQ)
      • Upgrade your account
      • Get help in OpenText Core SCA tool
    • Language support
      • C# - Nuget, Paket
      • CycloneDX SBOM
      • Go - Go Modules, Go Dep, Bazel
      • Java & Kotlin - Gradle, Maven, Bazel
      • JavaScript - NPM, Yarn, Bower
      • Objective-C - CocoaPods
      • PHP - Composer
      • Python - Pip, Pipenv
      • Ruby - RubyGems
      • Rust - Cargo
      • Swift - CocoaPods
      • Linux package managers
      • Scala - SBT
    • Security overview
  • Product
    • Vulnerability management
      • Security terms
      • Data sources
      • See your data
      • Pull Requests (PR)
        • Enable Pull Request support
        • Solve vulnerabilities using Pull Requests (PR)
        • Solve vulnerabilities using Pull Requests (PR) via API
      • Set a review status
        • Snooze or pause a review status
      • Reachability Analysis
        • Set up Reachability Analysis for Java
        • Set up Reachability Analysis for Go
      • Solve vulnerabilities manually with root fixes
    • License risk management
      • Licence families
      • License risks
      • Set up a use case
        • Set up a use case using API
      • Proxy non-standard license identifiers
    • Project health
      • Contributors
      • Popularity
      • Security
    • Open source select
      • Search projects
      • Compare projects
      • View more details
      • Start left policies
      • OpenText Core SCA Select Browser Extension
      • End of Life (EOL)
    • Automation
      • Create an automation rule
      • Edit an automation rule
      • Default automation rules
      • Set up webhooks
      • Policies
      • Monitoring
    • Exporting or SBOM
      • Overview
      • License export
      • Vulnerability export
      • SBOM export
        • CycloneDX SBOM export
        • SPDX SBOM export
    • Administration
      • Generate access token
      • Account
        • Change your password
        • Delete your account
        • Delete company account
      • Billing
        • Manage contributing developers
        • Manage billing frequency
        • Manage payment methods
        • Access invoices
        • Manage your subscription
      • Settings
        • Enable and disable snoozing vulnerabilities
        • Supported language for Debricked tool
        • View logged events
        • Two-Factor Authentication (2FA)
      • Users
        • User roles (freemium and premium)
        • Role-Based Access Control (Enterprise)
        • Manage users
          • Add a new user
      • Repositories
        • Default Branch
        • Repository groups
        • Manually upload a dependency file
        • Manage your commits
  • Tools & Integrations
    • Command Line Interface (CLI)
      • Debricked CLI
        • High performance scans
        • File fingerprinting
      • Legacy CLI
    • CI/CD integrations
      • GitHub
      • CircleCI
      • BuildKite
      • GitLab
      • Bitbucket
      • Azure DevOps
      • Argo workflows
      • Travis CI
      • Jenkins
      • Bamboo
      • TeamCity
    • Fortify on Demand (FoD)
    • Fortify Software Security Center (SSC)
    • Debricked APIs
      • Open source select API
    • Integrated Development Environments (IDEs)
    • Single Sign-On (SSO)
      • Single Sign-On (SSO) through Okta
      • Single Sign-On (SSO) through Microsoft Entra ID
      • Single Sign-On (SSO) through JumpCloud OIDC
      • Single Sign-On (SSO) through GitHub
  • Tips & Tricks
    • Debricked CLI migration guide
    • Workarounds
      • Scanning Conan (C++) projects
      • Scanning a repository with different services
      • Scanning Docker images
      • Automations: Do not fail on found CVE lacking a fix
Powered by GitBook
LogoLogo

Company

  • Pricing
  • Blog

Support

  • Privacy Policy
  • Terms & Conditions
  • Service Status

Resources

  • Vulnerability DB
  • Open Source Select

© 2018-2024 | Open Text

On this page
  • Integrate a single repository
  • Integrate multiple repositories
  • Credentials for pull requests

Was this helpful?

Export as PDF
  1. Tools & Integrations
  2. CI/CD integrations

Azure DevOps

Learn how to integrate Debricked with Azure DevOps.

Last updated 2 months ago

Was this helpful?

With our CI integration to Azure DevOps you can automatically upload your latest commits and pull requests to Debricked or whenever you run your pipeline. Our Azure DevOps integration support the same options as our Bitbucket integration.

Integrate a single repository

Configure Debricked token

  1. Start by . Copy the token so that you can use it in the next step.

  2. Configure your DEBRICKED_TOKEN variable by going to [your repository] -> Pipelines -> [your pipeline name] -> Edit -> Variables. Make sure to check “Keep this value secret” so that you do not expose your login credentials to the world.

Configure Azure pipelines

Depending on what package manager you are using there are different step setups.

In order to analyze all dependencies in your project, their versions, and relations, files containing the resolved dependency trees have to be created prior to scanning. Those depend on the package manager used. Debricked tries to generate the lacking files, which can negatively affect speed and accuracy.

Example 1: If is used in your project you will have a package.json file, but in order to scan all your dependencies, Debricked requires either package-lock.json or yarn.lock as well.

Example 2: If is used in your project, you will have a "pom.xml" file, but in order to resolve all your dependencies, Debricked requires a second file, as Maven does not offer a lock file system. Instead, "Maven dependency:tree" plugin can be used to create a file called ".debricked-maven-dependencies.tgf".

  1. Add the to your "azure-pipelines.yml" file (if the file does not exist, create one)

  1. Commit your changes to "azure-pipelines.yml" and watch the CI run.

Configure Azure pipelines - video guide

Integrate multiple repositories

Integrating many repositories with one configuration using Azure DevOps can greatly simplify the process of managing and deploying code across multiple projects.

Step 1: Create a variable group

To avoid having to add the DEBRICKED_TOKEN to every integrated repository, it is possible to share the Debricked token between repositories. In order to enable this, you should create a variable group:

  1. Sign into your organization and select your project.

  2. Go to Pipelines → Library → Variable groups.

  3. Click + Variable group.

  4. Enter a suitable name for your variable group, for example, "Debricked”.

  5. Click + Add.

  6. Add your token to a secret variable called DEBRICKED_TOKEN (to make it secret, toggle the "lock" icon at the end of the row).

  7. Click Save.

  8. Go to the Pipeline permissions tab.

  9. Click the three vertical dots and choose Open access to allow access in all pipelines. If you want to, it is also possible to just specify specific pipelines who should get access. After this, you can use the created variable in your repository pipelines.

Step 2: Create new service connection

If you would like to use our shared template out-of-the box without modifications, you should first create a service connection to GitHub. If you are, however, planning on copying the main template into your own organization you can skip this step.

  1. Go to Project settings → Service connections.

  2. Click Create service connection.

  3. Select Github from the list and click Next.

  4. Under OAuth Configuration drop-down, select AzurePipelines.

  5. Click Authorize and follow instructions, using your own GitHub account.

  6. Give new service connection name, which you will use as a value for endpoint parameter later on

  7. Click Save.

Step 3: Use template in pipelines of required repositories

NOTE: During the first run of the pipeline, you will be asked permission to run the subsequent jobs. You should click Permit.

Triggering template

trigger:
  branches:
    include:
      - '*' # Run on all branches

variables:
  - group: <variable_group_name>

resources:
  repositories:
    - repository: <repository_reference>
      type: <repository_type>
      name: <username_or_project>/<repository_name>
      endpoint: <service_connection_name>

jobs:
  - template: <resource_template_file_name>@<repository_reference>
    parameters:
      DEBRICKED_TOKEN: $(DEBRICKED_TOKEN)

Option 1: Directly referencing the Debricked core repository

By directly referencing the Debricked core repository, you will automatically receive any new updates made to the Debricked core repository template. If you want to customize the template, use the setup described in option 2 below.

  1. In the repositories that you want to trigger the shared pipeline from, paste the triggering template above to an azure pipelines yaml file.

  2. Fill in the variables to match the Debricked core repository according to the list below. If youare not using the variable group from step 1, remove the variables section from the triggering template:

    • <variable_group_name> - The name of the variable group created in step 1.

    • <repository_reference> - The named reference of your choice.

    • <repository_type> - github

    • <username_or_project> - debricked

    • <repository_name> - cli

    • <service_connection_name> - The name of the service connection created in step 2.

    • <resource_template_file_name> - examples/templates/Azure/azure-pipelines.yml

Option 2: Using your own core repository in Azure DevOps

By using your own core repository containing the template in Azure DevOps, you do not need to create a service connection and can customise the template to your liking.

  1. Create a new repository in your organisation or use an already existing one as the core.

  1. If you want to set up scanning in this repository as well and want to use the variable group from step 1, add the variables section from the triggering template above into the template under the “debricked_scan” job.

  2. In the repositories that you want to trigger the shared pipeline from, paste the triggering template above to an "azure pipelines yaml" file. If you are not using a service connection, you should remove the endpoint variable from the triggering template.

  3. Fill in the variables to match the chosen core repository according to the list below. If you are not using the variable group from step 1, remove the variables section from the triggering template:

    • <variable_group_name> - The name of the variable group created in step 1.

    • <repository_reference> - The named reference of your choice.

    • <repository_type> - git

    • <username_or_project> - The name of the azure project containing your core repository.

    • <repository_name> - The name of the core repository.

    • <service_connection_name> - This variable is not needed if the core repository exists in your organisation. Remove the endpoint variable.

    • <resource_template_file_name> - The path or name to the template file in your core repository.

Credentials for pull requests

Debricked can generate pull requests for you, but to be able to use it in Azure DevOps, you should provide the credentials so that the pull request can be created on your Azure DevOps instance.

You can generate a Personal access token by going to the User settings -> Personal access tokens. You should:

  1. Select your organization (or you can create a token for all accessible organizations).

  2. Set custom expiration date to the maximum possible value.

  3. Grant the token the code (read, write and manage) scope. When you try to create a Pull Request inside the Debricked tool, it will automatically ask you for your credentials when needed.

  4. Fill out the form:

  • Host: enter the domain, e.g.: "https://dev.azure.com/", "https://azure.yourcompany.com", "https://org.visualstudio.com"

  • Token: enter the personal access token created before and enter

  1. After clicking Confirm, the merge request generation will start.

Opening a Debricked generated pull request on Azure DevOps - video guide

.

You can now use the following template in pipelines of repositories you want to integrate with Debricked. The triggering template refers directly to the core repository found in the Debricked CLI repository. If you want to make modifications to it, it is also possible to copy the template from the CLI repository into a core repository of your own, which you would then refer to in the triggering template below.

Paste the Debricked template contents from into an "azure pipelines yaml" file:

Generate a Debricked access token
Azure DevOps template
the Debricked template
generating an access token
npm
Maven
template
https://github.com/debricked/cli/blob/main/examples/templates/Azure/azure-pipelines.yml
jobs:
- job: debricked_scan
  displayName: Debricked scan
  pool:
    vmImage: 'ubuntu-latest'
  steps:
    # - task: MavenAuthenticate@0
    #   displayName: 'Maven Authenticate'
    #   inputs:
    #     artifactsFeeds: <your-private-repository-id>
    # Uncomment the above lines if you need to authenticate private maven registries
    # - task: NuGetAuthenticate@1
    #   displayName: NuGet Authentication
    # Uncomment the above lines if you need to authenticate private nuget registries
    - script: |
        curl -LsS https://github.com/debricked/cli/releases/download/release-v2/cli_linux_x86_64.tar.gz | tar -xz debricked
        ./debricked scan
      displayName: Debricked scan
      env:
        DEBRICKED_TOKEN: $(DEBRICKED_TOKEN)
https://github.com/debricked/cli/blob/main/examples/templates/Azure/azure-pipelines.yml
jobs:
- job: debricked_scan
  displayName: Debricked scan
  pool:
    vmImage: 'ubuntu-latest'
  steps:
    # - task: MavenAuthenticate@0
    #   displayName: 'Maven Authenticate'
    #   inputs:
    #     artifactsFeeds: <your-private-repository-id>
    # Uncomment the above lines if you need to authenticate private maven registries
    # - task: NuGetAuthenticate@1
    #   displayName: NuGet Authentication
    # Uncomment the above lines if you need to authenticate private nuget registries
    - script: |
        curl -LsS https://github.com/debricked/cli/releases/download/release-v2/cli_linux_x86_64.tar.gz | tar -xz debricked
        ./debricked scan
      displayName: Debricked scan
      env:
        DEBRICKED_TOKEN: $(DEBRICKED_TOKEN)