Azure Pipelines

​

Installation

1. Go to the CodeAnt AI Extension on the Azure DevOps Marketplace
2. Click Get it free
3. Select your Azure DevOps organization
4. Click Install

​

Repository Scenarios

​

Video Tutorial

​

Azure Pipelines Workflow

​

Scenario 1: Azure Repos + Azure DevOps Pipeline

trigger:
  branches:
    include:
      - main

pool:
  vmImage: 'ubuntu-latest'

steps:
  - checkout: self

  - task: CodeAntCIScan@1
    inputs:
      accessToken: $(ACCESS_TOKEN)
    displayName: 'CodeAnt CI Scan'

Note: No additional configuration needed. The task automatically extracts information from these Azure DevOps built-in variables:

• SYSTEM_TEAMPROJECT - Project name
• BUILD_REPOSITORY_NAME - Repository name
• BUILD_SOURCEVERSION - Commit SHA

​

Scenario 2: GitHub Repository + Azure DevOps Pipeline

trigger:
  branches:
    include:
      - main

pool:
  vmImage: 'ubuntu-latest'

steps:
  - checkout: self

  - task: CodeAntCIScan@1
    inputs:
      accessToken: $(ACCESS_TOKEN)
      service: 'github'
      repo: 'myorg/my-repo'
      commitId: '$(Build.SourceVersion)'
    displayName: 'CodeAnt CI Scan'

​

Parameters for GitHub

​

Scenario 3: GitLab Repository + Azure DevOps Pipeline

trigger:
  branches:
    include:
      - main

pool:
  vmImage: 'ubuntu-latest'

steps:
  - checkout: self

  - task: CodeAntCIScan@1
    inputs:
      accessToken: $(ACCESS_TOKEN)
      service: 'gitlab'
      repo: 'mygroup/my-project'
      commitId: '$(Build.SourceVersion)'
    displayName: 'CodeAnt CI Scan'

​

Parameters for GitLab

​

Scenario 4: Bitbucket Repository + Azure DevOps Pipeline

trigger:
  branches:
    include:
      - main

pool:
  vmImage: 'ubuntu-latest'

steps:
  - checkout: self

  - task: CodeAntCIScan@1
    inputs:
      accessToken: $(ACCESS_TOKEN)
      service: 'bitbucket'
      repo: 'myworkspace/my-repo'
      commitId: '$(Build.SourceVersion)'
    displayName: 'CodeAnt CI Scan'

​

Parameters for Bitbucket

​

Task Parameters Reference

​

Required Parameters

​

Optional Parameters

​

Available Scanners

• scanners: 'all' - Run all scanners for comprehensive analysis
• scanners: 'sast,secrets' - Run only SAST and secrets detection
• scanners: 'sast,sca,secrets,iac' - Run a complete security suite

​

How it works

1. Setup environment The task extracts repository information either from user-provided inputs or Azure DevOps built-in variables.
2. Download script The task fetches the CI scan script from the CodeAnt API endpoint.
3. Trigger scan The script initiates a CI scan for your commit, optionally waiting for results based on the noWait parameter.
4. Pipeline feedback
   • Success: Scan completes successfully (or is triggered in no-wait mode)
   • Failure: Scan fails or detects critical issues, blocking the build

​

Execution Time Considerations

• With result waiting (default): ~7 minutes
  • Triggers scan and waits for complete analysis results
  • Includes both security and SCA (Software Composition Analysis) results
  • Best for comprehensive CI/CD pipelines where you need immediate feedback
• With noWait: 'true': ~2 minutes
  • Only triggers the scan and returns immediately
  • Results can be fetched later or viewed in the CodeAnt dashboard
  • Ideal for faster CI runs or when results can be processed asynchronously

​

Example Configurations

​

Fast CI Mode (No Wait)

steps:
  - checkout: self

  - task: CodeAntCIScan@1
    inputs:
      accessToken: $(ACCESS_TOKEN)
      noWait: 'true'
    displayName: 'CodeAnt CI Scan (Fast Mode)'

​

Comprehensive Analysis (Wait for Results)

steps:
  - checkout: self

  - task: CodeAntCIScan@1
    inputs:
      accessToken: $(ACCESS_TOKEN)
      timeout: '600'
      pollInterval: '20'
      noWait: 'false'
    displayName: 'CodeAnt CI Scan (Full Results)'

​

Custom File Filtering with Security Focus

steps:
  - checkout: self

  - task: CodeAntCIScan@1
    inputs:
      accessToken: $(ACCESS_TOKEN)
      includePaths: 'src/**/*.{js,ts}'
      excludePaths: '**/node_modules/**,**/dist/**,**/test/**'
      noWait: 'true'
    displayName: 'CodeAnt CI Scan (Security Focused)'

​

External Repository with Custom Commit

steps:
  - checkout: self

  - task: CodeAntCIScan@1
    inputs:
      accessToken: $(ACCESS_TOKEN)
      service: 'github'
      repo: 'myorg/my-repo'
      commitId: '$(Build.SourceVersion)'
    displayName: 'CodeAnt CI Scan (GitHub)'

​

Branch-Specific Configuration

steps:
  - checkout: self

  # Fast mode for feature branches
  - task: CodeAntCIScan@1
    condition: ne(variables['Build.SourceBranch'], 'refs/heads/main')
    inputs:
      accessToken: $(ACCESS_TOKEN)
      noWait: 'true'
    displayName: 'CodeAnt CI Scan (Feature Branch - Fast)'

  # Full analysis for main branch
  - task: CodeAntCIScan@1
    condition: eq(variables['Build.SourceBranch'], 'refs/heads/main')
    inputs:
      accessToken: $(ACCESS_TOKEN)
      timeout: '600'
      noWait: 'false'
    displayName: 'CodeAnt CI Scan (Main Branch - Full)'

​

Best Practices

1. Use fast mode for PRs: Set noWait: 'true' for pull request pipelines to keep them fast
2. Full analysis for main: Use complete analysis (wait for results) on main/master branch merges
3. Customize scanners: Use scanners: 'all' for comprehensive coverage or specific combinations like scanners: 'sast,secrets' for targeted checks
4. Default scanners: The default configuration (sast,sca) provides a good balance between coverage and execution time
5. Adjust timeouts: Increase timeout for larger repositories that take longer to analyze
6. File filtering: Use include/exclude patterns to focus analysis on relevant code
7. Keep tokens secure: Always use Azure DevOps Variable Groups or Pipeline Variables for tokens
8. Monitor performance: Track scan times and optimize based on your repository size

​

Troubleshooting

​

Task not found

• Ensure the CodeAnt extension is installed in your Azure DevOps organization
• Go to Organization Settings → Extensions to verify installation
• Check that the extension is enabled for your project

​

Scan times out

• Increase the timeout using timeout: '600' (10 minutes) or higher
• Check if the CodeAnt service is operational
• Consider using noWait: 'true' for faster pipeline execution
• Review your network connectivity to the CodeAnt API

​

Authentication failures

• Verify your ACCESS_TOKEN variable is correctly configured in Pipeline Variables or Variable Groups
• Ensure the token has appropriate repository permissions
• Check that the variable is marked as secret
• Verify the token hasn’t expired

​

No results returned

• Check that CI scanning is enabled for your repository in CodeAnt
• Verify the commit SHA is correct
• Ensure your Azure DevOps organization has proper integration with CodeAnt
• Check the CodeAnt dashboard to see if the scan was registered

​

Repository format issues

• For Azure Repos: Verify BUILD_REPOSITORY_NAME, BUILD_SOURCEVERSION, and SYSTEM_TEAMPROJECT are available
• For external repos: Ensure you’ve provided service and repo inputs
• Check the expected format: owner/repo for GitHub/GitLab/Bitbucket

​

External repository not working

• Ensure you’ve specified the correct service value (github, gitlab, or bitbucket)
• Verify the repo format matches the expected pattern for your service
• Check that your access token has permissions for the external repository

​

Windows compatibility issues

• Ensure Git Bash or WSL is available on the agent
• The task automatically detects Windows and uses bash for script execution
• Consider using Linux agents (ubuntu-latest) for best compatibility

​

Advanced Configuration

​

Parallel Jobs

jobs:
  - job: ScanBackend
    steps:
      - task: CodeAntCIScan@1
        inputs:
          accessToken: $(ACCESS_TOKEN)
          includePaths: 'backend/**'
        displayName: 'Scan Backend'

  - job: ScanFrontend
    steps:
      - task: CodeAntCIScan@1
        inputs:
          accessToken: $(ACCESS_TOKEN)
          includePaths: 'frontend/**'
        displayName: 'Scan Frontend'

​

On-Premise Deployment

steps:
  - checkout: self

  - task: CodeAntCIScan@1
    inputs:
      accessToken: $(ACCESS_TOKEN)
      apiBase: 'https://your-codeant-instance.example.com'
    displayName: 'CodeAnt CI Scan (On-Premise)'

Note: The apiBase parameter is only required for on-premise deployments. Cloud users do not need to configure this.