ado-scanning-stages

ado-scanning-stages

Produces optional security and code-quality scanning stages for Azure DevOps pipelines. Each scanner is emitted as a separate stage only when stages.<scanner>.enabled: true in .devops-agent.json. All scanning stages depend on the Build stage and run in parallel with each other and the UnitTest stage.

Emission Rules

Config key	Stage emitted
stages.sonar.enabled: true	SonarScan
stages.snyk.enabled: true	SnykScan
stages.wiz.enabled: true	WizScan

When no scanners are enabled the DockerBuildPush stage's dependsOn list includes only UnitTest. When one or more scanners are enabled they are appended to that dependsOn list automatically.

SonarQube

Uses the official SonarQube ADO extension tasks: SonarQubePrepare@6, SonarQubeAnalyze@6, and SonarQubePublish@6.

Prerequisites

• SonarQube extension installed in the ADO organisation.
• A service connection named SonarQubeServiceConnection of type SonarQube in the ADO project settings.
• Project key matches the repository name by default (configurable via stages.sonar.projectKey).

SonarQube Stage YAML

- stage: SonarScan
  displayName: 'SonarQube Analysis'
  dependsOn: Build
  jobs:
    - job: Scan
      pool:
        name: 'OrgLinuxPool'
      steps:
        - task: SonarQubePrepare@6
          inputs:
            SonarQube: 'SonarQubeServiceConnection'
            scannerMode: 'dotnet'        # or 'CLI' for Node.js/Go/Python
            projectKey: '$(Build.Repository.Name)'
            projectName: '$(Build.Repository.Name)'
        - script: dotnet build           # replace with language-appropriate build command
          displayName: 'Build for analysis'
        - task: SonarQubeAnalyze@6
        - task: SonarQubePublish@6
          inputs:
            pollingTimeoutSec: '300'

Scanner Mode Per Language

Language	scannerMode	Build command
.NET	dotnet	dotnet build
Node.js / Go / Python	CLI	(no separate build command needed)
Java (Maven)	Other (Maven plugin handles it)	mvn sonar:sonar

For scannerMode: CLI, add extraProperties to SonarQubePrepare@6:

- task: SonarQubePrepare@6
  inputs:
    SonarQube: 'SonarQubeServiceConnection'
    scannerMode: 'CLI'
    configMode: 'manual'
    cliProjectKey: '$(Build.Repository.Name)'
    cliSources: '.'

Config Reference

{
  "stages": {
    "sonar": {
      "enabled": true,
      "projectKey": "my-custom-project-key",
      "serviceConnection": "SonarQubeServiceConnection"
    }
  }
}

Snyk

Uses the SnykSecurityScan@1 task from the Snyk ADO extension. Supports application dependency scanning (testType: app) and container scanning (testType: container).

Prerequisites

• Snyk extension installed in the ADO organisation.
• A service connection named SnykServiceConnection of type Snyk in the ADO project settings.
• Severity threshold defaults to high; override via stages.snyk.severityThreshold.

Snyk Stage YAML

- stage: SnykScan
  displayName: 'Snyk Security Scan'
  dependsOn: Build
  jobs:
    - job: Scan
      pool:
        name: 'OrgLinuxPool'
      steps:
        - task: SnykSecurityScan@1
          inputs:
            serviceConnectionEndpoint: 'SnykServiceConnection'
            testType: 'app'
            severityThreshold: 'high'
            failOnIssues: true
            monitorWhen: 'always'
            additionalArguments: '--all-projects'

Severity Threshold Options

Value	Meaning
low	Fail on any vulnerability
medium	Fail on medium and above
high	Fail on high and critical (default)
critical	Fail only on critical vulnerabilities

Container Scan Variant

When stages.snyk.testType: container is set, scan the built Docker image instead of application dependencies:

- task: SnykSecurityScan@1
  inputs:
    serviceConnectionEndpoint: 'SnykServiceConnection'
    testType: 'container'
    dockerImageName: '$(registry)/$(imageName):$(tag)'
    dockerfilePath: '**/Dockerfile'
    severityThreshold: 'high'
    failOnIssues: true

Config Reference

{
  "stages": {
    "snyk": {
      "enabled": true,
      "severityThreshold": "high",
      "testType": "app",
      "serviceConnection": "SnykServiceConnection"
    }
  }
}

Wiz

Wiz container scanning uses the wizcli CLI tool via a Bash task. Credentials are sourced from pipeline variables backed by a Key Vault variable group — never hardcoded.

Prerequisites

• wizcli binary available on the agent, or downloaded at runtime (download step included below).
• WIZ_CLIENT_ID and WIZ_CLIENT_SECRET stored in an ADO variable group linked to Azure Key Vault (marked as secret).
• Wiz policy ID for the scan (configurable via stages.wiz.policyId).

Wiz Stage YAML

- stage: WizScan
  displayName: 'Wiz Security Scan'
  dependsOn: Build
  variables:
    - group: 'org-secrets-kv'          # must contain WIZ_CLIENT_ID and WIZ_CLIENT_SECRET
  jobs:
    - job: Scan
      pool:
        name: 'OrgLinuxPool'
      steps:
        - task: Bash@3
          displayName: 'Download wizcli'
          inputs:
            targetType: 'inline'
            script: |
              curl -s -o wizcli https://wizcli.app.wiz.io/latest/wizcli-linux-amd64
              chmod +x wizcli
              sudo mv wizcli /usr/local/bin/wizcli
        - task: Bash@3
          displayName: 'Wiz Docker Scan'
          inputs:
            targetType: 'inline'
            script: |
              wizcli auth --id "$(WIZ_CLIENT_ID)" --secret "$(WIZ_CLIENT_SECRET)"
              wizcli docker scan \
                --image "$(registry)/$(imageName):$(tag)" \
                --policy "$(wizPolicy)" \
                --tag "source=azure-devops,repo=$(Build.Repository.Name),build=$(Build.BuildId)"
          env:
            WIZ_CLIENT_ID: $(WIZ_CLIENT_ID)
            WIZ_CLIENT_SECRET: $(WIZ_CLIENT_SECRET)

Config Reference

{
  "stages": {
    "wiz": {
      "enabled": true,
      "policyId": "org-default-container-policy",
      "variableGroup": "org-secrets-kv"
    }
  }
}

Security Notes

• WIZ_CLIENT_ID and WIZ_CLIENT_SECRET must never appear as plain-text values in pipeline YAML.
• Reference them only via the variable group and the env: block in the Bash task so ADO masks them in logs.
• The --tag arguments to wizcli docker scan enrich the Wiz dashboard with build provenance metadata.

Combined Scanning Stage Dependency Graph

When all three scanners are enabled alongside UnitTest, the DockerBuildPush stage waits for all of them:

- stage: DockerBuildPush
  displayName: 'Docker Build & Push'
  dependsOn:
    - UnitTest
    - SonarScan
    - SnykScan
    - WizScan

When only a subset is enabled, dependsOn includes only the enabled stages plus UnitTest.