{"id":20445890,"url":"https://github.com/rapid7/insightappsec-azure-devops-extension","last_synced_at":"2025-06-24T01:06:49.260Z","repository":{"id":42653019,"uuid":"207851040","full_name":"rapid7/insightappsec-azure-devops-extension","owner":"rapid7","description":"Rapid7 InsightAppSec Extension for Azure DevOps","archived":false,"fork":false,"pushed_at":"2025-02-04T13:43:25.000Z","size":1061,"stargazers_count":10,"open_issues_count":7,"forks_count":7,"subscribers_count":62,"default_branch":"master","last_synced_at":"2025-04-13T00:44:42.006Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"mit","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/rapid7.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":".github/CONTRIBUTING.md","funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2019-09-11T15:54:22.000Z","updated_at":"2025-02-04T13:43:25.000Z","dependencies_parsed_at":"2024-02-26T12:29:01.740Z","dependency_job_id":"85fda51e-886f-4c05-8a6b-438156c31cf3","html_url":"https://github.com/rapid7/insightappsec-azure-devops-extension","commit_stats":null,"previous_names":[],"tags_count":20,"template":false,"template_full_name":null,"purl":"pkg:github/rapid7/insightappsec-azure-devops-extension","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rapid7%2Finsightappsec-azure-devops-extension","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rapid7%2Finsightappsec-azure-devops-extension/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rapid7%2Finsightappsec-azure-devops-extension/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rapid7%2Finsightappsec-azure-devops-extension/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/rapid7","download_url":"https://codeload.github.com/rapid7/insightappsec-azure-devops-extension/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/rapid7%2Finsightappsec-azure-devops-extension/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":261583821,"owners_count":23180671,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2024-11-15T10:15:36.575Z","updated_at":"2025-06-24T01:06:49.163Z","avatar_url":"https://github.com/rapid7.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Rapid7 InsightAppSec Extension\n\nThe Rapid7 InsightAppSec Extension for Azure DevOps is a TypeScript-based project that leverages the Rapid7\nInsightAppSec RESTful API to automate the scanning and gating of Dynamic Application Security Testing (DAST) as part of\nan Azure DevOps build or release pipeline.  The project utilizes the [tfx-cli](https://www.npmjs.com/package/tfx-cli)\nnode-based utility for interacting with Azure DevOps and follows the standard development framework as\n[documented](https://docs.microsoft.com/en-us/azure/devops/extend/get-started/node?view=azure-devops).\n\nMore information about InsightAppSec can be found here: https://www.rapid7.com/products/insightappsec/\n\nIf you would like to start using the InsigtAppSec Extension for Azure DevOps today, it can be found on the Visual Studio\nMarketplace: https://marketplace.visualstudio.com/items?itemName=rapid7.rapid7-insightappsec-extension\n\n\n## GETTING STARTED\n\nThe details provided in this README are for those maintaining the extension.  For details on Getting Started using the\npublished extension, either reference the [extension listing](https://marketplace.visualstudio.com/items?itemName=rapid7.rapid7-insightappsec-extension)\non Visual Studio Marketplace or the included [Overview](overview.md).  To get started developing the Rapid7\nInsightAppSec Extension for Azure DevOps, an Azure DevOps organization is required.\n\n### Prerequisites\n\nThe below prerequisites must first be installed on the development environment in order to get started with local\ndevelopment and testing:\n\n  - [Visual Studio Code](https://code.visualstudio.com/) was used in the course of its development and is recommended as an IDE\n  - [Azure DevOps organization](https://azure.microsoft.com/en-us/services/devops/) with permissions to install extensions\n  - [Visual Studio Marketplace publisher account](https://marketplace.visualstudio.com/manage/publishers)\n  - Installation of [Node.js](https://nodejs.org/en/)\n  - Installation of node development dependencies\n\n### Initializing Project\nEnsure the necessary node development dependencies are installed prior to making modifications or packaging the\nextension.  From within the project, run:\n```\n\u003e npm install -g tfx-cli@0.9.3\n\u003e npm install -g typescript@5.3.3\n\u003e cd tasks/InsightAppSec\n\u003e npm install\n```\n\n### Local Testing\nPrior to publishing the extension to Visual Studio for testing within Azure DevOps, ensure it has been tested\nlocally.  There are several parameters that must be supplied to correctly execute the logic contained within. This is\nbecause parameters are traditionally pulled by the extension from the user-entered values in the Azure DevOps UI, and\nthose will not exist in local testing.\n\nThe following block of code contains the required parameters that must be set:\n\n```\n// Vars for testing locally\nvar appInput = \"Application Name/ID\";\nvar scanConfigInput = \"Scan Configuration Name/ID\";\n\nvar endpoint = \"https://us.api.insight.rapid7.com/ias/v1\";\nvar apiKey = \"your-api-key\";\n\nvar waitForCompletion = true;\nvar scanCheckInterval = 5;\nvar hasTimeout = true;\nvar scanTimeout = 60;\n\nvar hasScanGating = false;\nvar generateFindingsReport = true;\nvar debugMode = true;\nvar publishPipelineArtifactsBool = false;\nvar artifactPerReport = false;\n```\n\nWith all prerequisites and configurations in place, you can now compile the project and then test. Ensure that the terminal\nyou are running the following JS file in has the same node version as the one specified in this project, otherwise you \ncan miss errors. The node version this project runs on is specified in the file `tasks/InsightAppSec/task.json` under \n`execution`. It is recommended to use NVM to easily swap between installed node versions. Once this is done, you can \nproceed to execute the following :\n\n```\n\u003e cd tasks/InsightAppSec\n\u003e tsc task.ts --lib ES2017\n\u003e node task.js\n```\n\nIt is also highly recommended to not only test locally but to also test the extension integrated into an Azure Devops\npipeline before making the release public on the marketplace. The following section describes this \n[Testing privately on the marketplace](#Testing-privately-on-marketplace).\n\n## Testing privately on marketplace\nCreate a publisher account for your own personal user that you have an Azure devops organization linked to (either member\nor owner). https://learn.microsoft.com/en-us/azure/devops/extend/publish/overview?view=azure-devops#create-a-publisher\nThis should be an account separate to the Rapid7 publisher account.\n\nChange the `vss-extension.json` file for the following fields:\n  1. `\"public\": true` should be changed to `\"public\": false`\n  2. `\"publisher\": \"rapid7\"` should be changed to `\"publisher\": \"\u003cyour-newly-created-publisher-id\u003e\"`\n  3. `\"id\": \"rapid7-insightappsec-extension\"` should be changed to `\"id\": \"rapid7-insightappsec-extension-test\"`\n\nDO NOT MERGE OR COMMIT THESE CHANGES. These should be made locally only, and should be reverted to their original values\nprior to merging your PR.\nAfter performing an `npm install` as highlighted above in [Initializing project](#Initializing-Project), `cd` to the \nproject root directory and run the command:\n\n`tfx extension create --manifest-globs vss-extension.json`\n\nNavigate to the Extensions Marketplace logged in as your user that you created a publisher account for. Under Manage Publishers \u0026 Extensions,\nmake sure your private user publisher is selected. Follow the instructions in [Publishing Via Browser](#Publishing-Via-Browser)\nto upload the private version of your extension to test, ensuring to share it with your test Azure DevOps organization only.\n\nNavigate back to https://dev.azure.com/\u003cyour-organization-name\u003e/. Under Organization Settings -\u003e General -\u003e Extensions -\u003e\nShared. You should see your test version of the extension ready to install. Once you have installed, you can select it \nto run as a task in a pipeline as a final test before releasing as Rapid7.\n\n## PACKAGING\n\nAfter completing a checkout of the project from GitHub, open and build it in your IDE.\n\nAfter performing an `npm install` as highlighted above in [Initializing project](#Initializing-Project)\n\nVS Code was originally used in the development of this project. The following steps can be used in VS Code to build it:\n\n  1. Select `View`, then `Command Palette`\n  2. Select `Tasks: Run Build Task`\n  3. Choose the single tsconfig.json file\n\nIn a command prompt, `cd` to the project root directory and run the command:\n\n`tfx extension create --manifest-globs vss-extension.json`\n\nThis should create a .vsix file, which is a Visual Studio Extension file that will be uploaded to the Marketplace to share the extension. If this fails, there should be output in the CLI listing the errors.\n\n\n## UPLOADING \u0026 SHARING\n\nThe following steps can be used in uploading the extension to the Marketplace, and then sharing it with a specific organization. There are two options - uploading it manually via the website, or doing it via CLI.\n\n### Publishing Via Browser\n\n1. Navigate to the VS Marketplace at https://marketplace.visualstudio.com/manage/publishers\n\n2. Login with a publisher account\n\n3. Click the `+ New Extension` button and select Azure DevOps\n\n4. Navigate locally to select the .vsix file that was previously created\n\n5. Click Upload\n\n6. Right click the extension once it appears in the UI and select `Share/Unshare`\n\n7. Click `+ Organization` and enter the organization name\n\n8. Close the window and ensure the Share has saved\n\n### Publishing Via CLI\n\n1. Go to Security under your profile in your Azure DevOps organization\n\n2. Generate a new personal access token with the `All accessible organizations` option selected under the Organization field\n\n3. Save this token\n\n4. In the CLI, `cd` to the root project directory\n\n5. Use the command `tfx extension publish --token [token]` to package and publish the extension, replacing `[token]` with the personal access token that was previously generated\n\n### Publishing as rapid7\nAny new commits merged to master will result in a build of the extension and the attempt to publish it to the extension library. It is important to ensure that a new version is defined appropriate for the changes and that the version does not collide with a previous release version. Once merged, the following actions will be automatically performed by the GitHub Actions `publish` action:\n\n1. A tag is created\n\n2. A release is created\n\n3. Extension is compiled\n\n4. Extension is published to the rapid7 publisher account (public immediately)\n\nAfter publishing it's good practice to install the latest version of the plugin and validate functionality by running a job.\n\n\n### Installation\n\n The following steps can be used in installing the shared extension within an organization.\n\n1. Navigate to your organization (eg., dev.azure.com/orgName)\n\n2. Select `Organization Settings`\n\n3. Navigate to the Extensions section there\n\n4. Select the Rapid7 InsightAppSec extension\n\n5. When redirected to the extension's page in the Marketplace, select `Get it free` and follow the directions to complete the installation process\n\n\n###  Configuration\n\nThe following steps can be used in configuring the extension within a project's build or release pipeline. This is invaluable for doing any troubleshooting or testing within the actual product.\n\n\n#### Service Connection\n\nBefore configuring the build or release pipeline, we need to setup a custom service connection to allow for connection to the InsightAppSec API.\n\n1. Navigate to the desired project in Azure DevOps\n\n2. Select Project Settings \u003e Service Connections\n\n3. Select `+ New service connection`\n\n4. Select Rapid7 InsightAppSec as the type\n\n5. Enter the connection name, InsightAppSec region, and API key accordingly\n\n6. Save the connection and ensure it appears in the list of service connections for that project\n\n#### Pipeline Configuration\n\nThe following steps detail configuration within a build pipeline, though the same can be done for releases as well.\n\n1.  Click the icon at the top right of the page that contains account settings\n\n2.  Select Preview Features\n\n3.  Scroll down to the `New YAML pipeline creation experience` option and turn it off\n\n4.  Return to the main menu bar on the left and select `Builds` under the Pipelines section\n\n5.  Select `+ New` and choose the `New Pipeline Build` option\n\n6.  Select your repository and click Continue\n\n7.  Click the `Empty job` option at the top of the page to start a new build pipeline from scratch\n\n8.  Click the `+` on Agent job 1 to add a new task\n\n9. Search for InsightAppSec in the task window\n\n10. Select it and click `Add`\n\n11. Click on the task that's been added under the Agent job\n\n12. Enter required parameters as desired (see below for details on parameters)\n\n13. Select the `Save` option to save the build (`Save \u0026 queue` to immediately run it for your project)\n\nOnce the build completes, you're able to see whether the build succeeded or failed, as well as return to the build pipeline and edit your task as desired.\n\n------------------\n\n| Field    | Description                 | Required|\n|----------|------------------------------|---------|\n| Display name | The name of the task as it will appear in the pipeline. | true\n| InsightAppSec Connection | A service connection that allows for connection and authentication to the InsightAppSec API. Drop-down menu containing the connection that was shown configured in a previous step. | true\n| Application | A drop-down menu to select the InsightAppSec application that will be scanned. | true\n| Scan Configuration | A text field to input the InsightAppSec scan configuration that will be utilized in the scan. | true\n| Wait for scan completion? | Option used to determine whether the pipeline will continue to the next step after launching the scan, or whether it will wait for its completion. | false\n| Scan Status Interval | The frequency (in minutes) that the scan’s status will be checked upon and logged. Dependent on the option `Wait for scan completion` being checked. | false\n| Generate findings report? | Option used to generate a raw JSON report that contains all findings from a completed scan. | false\n| Fail scan on timeout? | Option used to determine whether the scan will be cancelled and marked as failed if it reaches the timeout limit (value set in minutes). Dependent on “Wait for scan completion” being checked. | false\n| Timeout | The timeout for the scan completion (in minutes). Dependent on the option `Fail scan on timeout` being checked. | false\n| Scan Gating| Option used to determine whether the build will fail if the provided query returns results. | false\n| Vulnerability Query | The query executed against the completed scan's findings to retrieve any matching vulnerabilities. Dependent on the option `Scan Gating` being checked. | false\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frapid7%2Finsightappsec-azure-devops-extension","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Frapid7%2Finsightappsec-azure-devops-extension","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Frapid7%2Finsightappsec-azure-devops-extension/lists"}