microsoft / security-devops-action

Microsoft Security DevOps for GitHub Actions.
MIT License
99 stars 45 forks source link

Validate Azure DevOps pipeline steps (integration of other SAST/SCA tooling) #19

Open markl11 opened 2 years ago

markl11 commented 2 years ago

Hi,

Could I also use this to check for the existence of certain steps in an Azure DevOps YAML pipeline? Does it have this capability? For example, if there is a step that uses SonarQube or Nexus IQ - ie. can MSDO scan the following Azure DevOps YAML file and look for the existence of the steps involving SonarQube (example YAML below):

trigger: - master # or the name of the main branch - feature/*

steps:

- task: SonarQubePrepare@5 inputs: SonarQube: 'YourSonarqubeServerEndpoint' scannerMode: 'Other' extraProperties: 'sonar.projectKey=YourProjectKey'

- task: SonarQubePublish@5 inputs: pollingTimeoutSec: '300'