Azure DevOps Cloud Integration

Code Scan

The code scan can be done in two ways

• Workflows
• On-premise runner

Azure DevOps workflow

Select Azure DevOps workflow to configure DuckDefender in Azure DevOps by adding the yml file, that you need to download from the flyingduck portal for Libraries and Secrets information.

After selecting Azure DevOps workflow, then click the Download. This will download the azure-pipelines.yml file, which is configured to perform SBOM and SCA. Here in the yaml file, under the "branches -> include" add names of the branches commonly utilized for development within your environment. These are the branches for which you wish to conduct code scan.

Add the azure-pipelines.yml file in the root directory of the repository.

SBOM and SCA in pipelines

This azure-pipelines.yml file runs the scan for SBOM, SCA and secrets only.

trigger:
  branches:
    include:
      - main
      - master
      - develop
      - release
      
pool:
  vmImage: 'ubuntu-latest'
 
variables:
  imageName: flyingduckio/duckdefender:latest
 
steps:
  - script: |
      docker pull ${{ variables.imageName }}
    displayName: 'Pull Duckdefender Docker Image'
 
  - script: |
      docker run \
      -e AZURE_DEVOPS_REPO_NAME="$(Build.Repository.Name)" \
      -e AZURE_DEVOPS_BRANCH=$(Build.SourceBranch) \
      -e AZURE_DEVOPS_COMMIT=$(Build.SourceVersion) \
      -e FD_API_KEY=$(FD_API_KEY) \
      -v $(Build.SourcesDirectory):/src  ${{ variables.imageName }} 
    displayName: 'Run Duckdefender Container'

SBOM, SCA and SAST in Pipelines

To run scans for SBOM, SCA, and SAST, add the highlighted command to the azure-pipelines.yml file.

trigger:
  branches:
    include:
      - main
      - master
      - develop
      - release
      
pool:
  vmImage: 'ubuntu-latest'
 
variables:
  imageName: flyingduckio/duckdefender:latest
 
steps:
  - script: |
      docker pull ${{ variables.imageName }}
    displayName: 'Pull Duckdefender Docker Image'
 
  - script: |
      docker run \
      -e AZURE_DEVOPS_REPO_NAME="$(Build.Repository.Name)" \
      -e AZURE_DEVOPS_BRANCH=$(Build.SourceBranch) \
      -e AZURE_DEVOPS_COMMIT=$(Build.SourceVersion) \
      -e FD_API_KEY=$(FD_API_KEY) \
      -v $(Build.SourcesDirectory):/src  \
      --entrypoint /bin/sh ${{ variables.imageName }} -c "duckdefender code --all"
    displayName: 'Run Duckdefender Container'

If the agent pool is configured, update the pool name in the azure-pipelines.yaml file.

From:

pool:
  vmImage: 'ubuntu-latest'

To:

pool:
  name: configuredPoolName

Add API Key and pipeline to the Repository

Navigate to Azure Devops pipelines (Azure Devops -> projects -> pipelines) click on New pipeline.

You've to complete 4 stages. Under connect tab select Azure Repos Git.

Select your Repo

Under configure click on existing Azure pipelines yaml file if you added the azure-pipelines.yml file in the root directory of repository. Otherwise click on starter pipeline and add the azure-pipelines.yml snippet.

Give your branch name, select file name and click on continue

You will be able to see the file that you selected and click on variables.

Click new variable button.

Provide the API key name FD_API_KEY and paste the API key value. Make sure to select Keep this value secret, then click the OK button.

click on save button.

click on run button.

In pipelines a new job will be runned.

After adding the file you should commit. Based on which branch you've commited, if the branch is included in the given file, the respective data like libraries, secrets will be sent to Flyingduck portal.

Custom Branch

If you want to commit to the custom branch like feature/* or bug/* and to check the findings of that branch then include that specific branch into the branches in azure-pipelines.yml file.

trigger:
  branches:
    include:
      - main
      - master
      - develop
      - release
      - feature/*
      - bug/*

Troubleshoot

The debug option is used to understand what is happening within a particular command. If you need to troubleshoot, include this command LOG_LEVEL="debug" in the file.

trigger:
  branches:
    include:
      - main
      - master
      - develop
      - release
      
pool:
  vmImage: 'ubuntu-latest'
 
variables:
  imageName: flyingduckio/duckdefender:latest
 
steps:
  - script: |
      docker pull ${{ variables.imageName }}
    displayName: 'Pull Duckdefender Docker Image'
 
  - script: |
      docker run \
      -e AZURE_DEVOPS_REPO_NAME="$(Build.Repository.Name)" \
      -e AZURE_DEVOPS_BRANCH=$(Build.SourceBranch) \
      -e AZURE_DEVOPS_COMMIT=$(Build.SourceVersion) \
      -e FD_API_KEY=$(FD_API_KEY) \
      -e LOG_LEVEL="debug" \
      -v $(Build.SourcesDirectory):/src  ${{ variables.imageName }}
    displayName: 'Run Duckdefender Container'