Azure Pipelines

1. Add the variable

Create a secret key in Safeguard under Settings → Developer with the scopes scans:trigger and scans:read. In Azure DevOps, edit the pipeline, open Variables, and add SAFEGUARD_API_KEY with Keep this value secret on. A variable group works too.

2. Add the pipeline

Save this as azure-pipelines.yml (download):

trigger:
  branches:
    include: [main]

pr:
  branches:
    include: [main]

pool:
  vmImage: ubuntu-latest

steps:
  - checkout: self
  - bash: |
      set -eu
      export SAFEGUARD_INSTALL_DIR="$(Agent.TempDirectory)/safeguard-bin"
      curl -fsSL https://cli.safeguard.sh/install | bash
      "$SAFEGUARD_INSTALL_DIR/safeguard" ci scan --wait --fail-on critical
    displayName: Safeguard scan
    env:
      SAFEGUARD_API_KEY: $(SAFEGUARD_API_KEY)

Secret variables reach a script only through env, as shown.

Choose the branches

• trigger.branches.include lists the branches whose pushes are scanned.
• pr.branches.include lists the target branches of pull requests that are scanned. Use pr: none to scan pushes only.

Wildcards work, for example [main, release/*]. On a pull request the source branch is scanned and its commit names the version.

Options

Troubleshooting

• AUTHENTICATION_REQUIRED. The secret is not mapped into env, or the variable is named differently.
• Pull requests from forks. Secrets are not passed to fork builds unless you allow it in the pipeline's trigger settings.
• Other errors: see Troubleshooting.