{"id":19368475,"url":"https://github.com/anchore/azure-devops-task","last_synced_at":"2025-04-23T15:30:41.767Z","repository":{"id":42723109,"uuid":"261587911","full_name":"anchore/azure-devops-task","owner":"anchore","description":"Anchore Task Extension for Azure DevOps Pipelines","archived":false,"fork":false,"pushed_at":"2023-01-26T23:58:09.000Z","size":236,"stargazers_count":4,"open_issues_count":8,"forks_count":3,"subscribers_count":14,"default_branch":"master","last_synced_at":"2025-04-02T16:50:42.498Z","etag":null,"topics":["anchore-engine","anchore-task","azure-devops-pipelines","pipeline","policy-evaluation","scanning-images","vulnerabilities"],"latest_commit_sha":null,"homepage":null,"language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/anchore.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":"CONTRIBUTING.rst","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":null,"security":null,"support":null}},"created_at":"2020-05-05T21:33:51.000Z","updated_at":"2023-01-26T23:58:14.000Z","dependencies_parsed_at":"2023-01-31T16:30:50.578Z","dependency_job_id":null,"html_url":"https://github.com/anchore/azure-devops-task","commit_stats":null,"previous_names":[],"tags_count":0,"template":false,"template_full_name":null,"repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anchore%2Fazure-devops-task","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anchore%2Fazure-devops-task/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anchore%2Fazure-devops-task/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/anchore%2Fazure-devops-task/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/anchore","download_url":"https://codeload.github.com/anchore/azure-devops-task/tar.gz/refs/heads/master","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":250460240,"owners_count":21434229,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":["anchore-engine","anchore-task","azure-devops-pipelines","pipeline","policy-evaluation","scanning-images","vulnerabilities"],"created_at":"2024-11-10T08:06:41.779Z","updated_at":"2025-04-23T15:30:41.472Z","avatar_url":"https://github.com/anchore.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Anchore Azure DevOps Task Plugins\n\n_**Warning**: Anchore Inline Scan, which is utilized for this integration, is deprecated. Please update your integrations to use [Grype](https://github.com/anchore/grype) for CI-based vulnerability scanning or [Syft](https://github.com/anchore/syft)._\n\n_**After Jan 10, 2022**: users should be transitioned to [Grype](https://github.com/anchore/grype) or Grype-based integrations._ \n\nAnchore Task Extensions for Azure DevOps Pipelines\n\n---\n\nThis is an Azure DevOps Pipeline task for scanning locally built images using\n[Anchore Engine][1]. It is used to scan container images and will return the\nvulnerabilities found, a software bill of materials, and the result of a policy\nevaluation. The task can be provided a custom policy which can be used to fail\nthe pipeline if so desired.\n\n**No data is sent to a remote service to execute the scan, and no credentials\nare required**\n\nThe vulnerability data comes from sources such as RedHat, Debian, Alpine, etc.\nAll of this vulnerability data is packaged with the Anchore container that is\nused in the Anchore task. This means no external connections are required to\nsync vulnerability data when Anchore runs. The only external connection that\nis needed will be the connection to pull the Anchore image itself.\n\n## Task usage\n\n#### Getting the results only\n\nBy default, the Anchore task will simply scan a local image using Anchore\nEngine and will provide files that contain a list of all the contents in the\nimage as well as a list of all the vulnerabilities detected by Anchore. Both\nof these files will be output as pipeline variables along with the result of\nthe policy evaluation. Under default behavior, the pipeline will not fail when\nthe container does not pass the Anchore policy scan. The fail result will be\npublished as a variable in the pipeline and can be used in subsequent tasks.\n\n*Note: While the dockerfile option is not required, it is recommended if the\nDockerfile is available as it adds metadata for Anchore Engine.*\n\nExample yaml:\n\n```\n- task: Anchore@0\n  inputs:\n    image: 'localbuild/imagename:tag'\n    dockerfile: 'Dockerfile'\n```\n\n\n### Failing the pipeline when Anchore Policy scan fails\n\nBy default, the Anchore task will not fail the pipeline if the policy scan\nreturns a `fail` result. This is by design; however if you wish to stop the\npipeline when Anchore detects severe vulnerabilities or the container does not\npass policy then set the `failBuild` option to `true`.\n\nExample yaml:\n\n```\n- task: Anchore@0\n  inputs:\n    image: 'localbuild/imagename:tag'\n    dockerfile: 'Dockerfile'\n    failBuild: true\n```\n\nIf this option is set and the container does not pass policy, the build will\nfail and the following variables will be published:\n * `billOfMaterials` - the path to the bill of materials json file\n * `vulnerabilities` - the path to the vulnerabilities json file\n * `policyCheck` - the result (pass/fail) of the Anchore policy scan\n\n\n### Scanning Application and OS Packages in the Container\n\nBy default, the Anchore task uses an image which will only find vulnerabilities\nin OS packages (rpms, dpkg, apk, etc). This version of the Anchore image is\nmuch smaller and therefore results in a faster scan. If you wish to find\nvulnerabilities in application packages (npm, gems, pip, etc) then set the\n`includeAppPackages` input to `true`. The resulting scan will take longer, but\nit will produce a more thorough output of the vulnerabilities in the container.\n\nExample yaml:\n\n```\n- task: Anchore@0\n  inputs:\n    image: 'localbuild/imagename:tag'\n    dockerfile: 'Dockerfile'\n    failBuild: true\n    includeAppPackages: true\n```\n\n### Scanning with a Custom Policy\n\nWhen the Anchore task runs, it will use a default policy that is bundled with\nthe scanner. If you wish to use your own custom policy then simply use the\n`customPolicyPath`. Supply the `customPolicyPath` input with the path to your\npolicy and Anchore will use it to scan your image.\n\nExample yaml:\n\n```\n- task: Anchore@0\n  inputs:\n    image: 'localbuild/imagename:tag'\n    dockerfile: 'Dockerfile'\n    failBuild: true\n    customPolicyPath: '.anchore/policy.json'\n```\n\n\n## Inputs Description\n\n| Input Name | Description | Required | Default Value |\n|------------|-------------|:--------:|---------------|\n| image | The image to scan | :heavy_check_mark: | N/A |\n| dockerfile | Path to the dockerfile used to build `image`. Adds metadata for the policy evaluation | | |\n| failBuild | Fail the build if policy evaluation returns a fail. | | false |\n| customPolicyPath | Path to a local policy bundle. | | |\n| debug | More verbose logging output from the scanner. | | false |\n| timeout | Set the scan timeout. | | |\n| includeAppPackages | Include application packages for vulnerability matches. Requires more vuln data and thus scan will be slower but better results. | | false |\n| anchoreVersion | An optional parameter to specify a specific version of anchore to use for the scan. | | v0.8.1 |\n| printVulnerabilityReport | Print the vulnerability report to the screen. | | true |\n\n\n## Outputs Description\n\n| Output Name     | Description                                                      | Type   |\n|-----------------|------------------------------------------------------------------|--------|\n| billOfMaterials | Path to a json file with the list of packages found in the image | string |\n| vulnerabilities | Path to a json file with list of vulnerabilities found in image  | string |\n| policyCheck     | Policy evaluation status of the image, either 'pass' or 'fail'   | string |\n\n\n## Example azure-pipelines.yaml\n\nThis example builds a local image and runs an Anchore scan on the image. It\nprovides a custom Anchore policy which it assumes is contained in the root of\nthe repository under the `.anchore/` directory. It will also fail the build if\nthe Anchore policy scan returns a `fail` result.\n\n```\ntrigger:\n- dev\n\nstages:\n- stage: Staging\n  displayName: Build and push to staging registry\n  jobs:\n  - job: Staging\n    displayName: Staging\n    steps:\n    - script: |\n        docker build -t localbuild/testimage:ci -f Dockerfile .\n\n    - task: Anchore@0\n      inputs:\n        image: 'localbuild/testimage:ci'\n        customPolicyPath: '.anchore/policy.json'\n        dockerfile: Dockerfile\n        failBuild: true\n\n    - script: |\n        echo $(policyStatus)\n\n        echo $(billOfMaterials)\n        cat $(billOfMaterials)\n\n        echo $(vulnerabilities)\n        cat $(vulnerabilities)\n```\n\n## Contributing\n\nWe love contributions, feedback, and bug reports. For issues with the invocation of this action, file [issues][3] in this repository.\n\nFor contributing, see [Contributing][4].\n\n\n## More Information\nFor documentation on Anchore itself, including policy language and capabilities see the [Anchore Documentation][5]\n\nConnect with the anchore community directly on [slack][6].\n\n\n[1]: https://docs.anchore.com/current/docs/engine/\n[2]: https://docs.microsoft.com/en-us/azure/devops/extend/develop/add-build-task?view=azure-devops\n[3]: https://github.com/anchore/azure-devops-task/issues\n[4]: https://github.com/anchore/azure-devops-task/blob/master/CONTRIBUTING.rst\n[5]: https://docs.anchore.com\n[6]: https://anchore.com/slack\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fanchore%2Fazure-devops-task","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fanchore%2Fazure-devops-task","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fanchore%2Fazure-devops-task/lists"}