{"id":51694398,"url":"https://github.com/stackitcloud/azure-devops-stackit-service-connection-extension","last_synced_at":"2026-07-16T04:04:18.055Z","repository":{"id":369711406,"uuid":"1270885492","full_name":"stackitcloud/azure-devops-stackit-service-connection-extension","owner":"stackitcloud","description":"Azure DevOps extension to use STACKIT Service Connections to login in Azure Pipelines","archived":false,"fork":false,"pushed_at":"2026-07-06T14:49:51.000Z","size":81,"stargazers_count":0,"open_issues_count":0,"forks_count":0,"subscribers_count":0,"default_branch":"main","last_synced_at":"2026-07-06T16:10:54.970Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":null,"language":"TypeScript","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"apache-2.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/stackitcloud.png","metadata":{"files":{"readme":"README.md","changelog":"CHANGELOG.md","contributing":"CONTRIBUTING.md","funding":null,"license":"LICENSE","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":null,"support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null,"notice":null,"maintainers":null,"copyright":null,"agents":null,"dco":null,"cla":null}},"created_at":"2026-06-16T06:18:20.000Z","updated_at":"2026-07-06T14:49:03.000Z","dependencies_parsed_at":null,"dependency_job_id":null,"html_url":"https://github.com/stackitcloud/azure-devops-stackit-service-connection-extension","commit_stats":null,"previous_names":["stackitcloud/azure-devops-stackit-service-connection-extension"],"tags_count":1,"template":false,"template_full_name":null,"purl":"pkg:github/stackitcloud/azure-devops-stackit-service-connection-extension","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stackitcloud%2Fazure-devops-stackit-service-connection-extension","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stackitcloud%2Fazure-devops-stackit-service-connection-extension/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stackitcloud%2Fazure-devops-stackit-service-connection-extension/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stackitcloud%2Fazure-devops-stackit-service-connection-extension/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/stackitcloud","download_url":"https://codeload.github.com/stackitcloud/azure-devops-stackit-service-connection-extension/tar.gz/refs/heads/main","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/stackitcloud%2Fazure-devops-stackit-service-connection-extension/sbom","scorecard":null,"host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":286080680,"owners_count":35529753,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2026-05-26T15:22:16.424Z","status":"online","status_checked_at":"2026-07-16T02:00:06.687Z","response_time":83,"last_error":null,"robots_txt_status":"success","robots_txt_updated_at":"2025-07-24T06:49:26.215Z","robots_txt_url":"https://github.com/robots.txt","online":true,"can_crawl_api":true,"host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2026-07-16T04:04:17.235Z","updated_at":"2026-07-16T04:04:18.042Z","avatar_url":"https://github.com/stackitcloud.png","language":"TypeScript","funding_links":[],"categories":[],"sub_categories":[],"readme":"# STACKIT Azure DevOps Service Connection Extension\n\nAzure DevOps extension to authenticate with STACKIT cloud platform using either **Workload Identity Federation (WIF)** or **Key Flow** (JSON credentials). This extension provides a secure service connection type and an authentication task that sets up environment variables and can perform CLI login when explicitly enabled.\n\n## Features\n\n- ✅ **Service Connection Type**: Secure credential storage for STACKIT authentication\n- ✅ **WIF Authentication**: Workload Identity Federation - minimal setup, just provide service account name\n- ✅ **OIDC Token Exchange**: Automatic Azure DevOps OIDC token → STACKIT access token conversion\n- ✅ **Environment Setup**: Sets required environment variables for STACKIT SDK\n- ✅ **Secret Masking**: Access tokens masked in pipeline logs\n- ✅ **Linux Support**: Task runs on Linux agents only\n\n## Authentication Methods\n\n### Important: Choose Exactly One\n\nWhen creating a STACKIT service connection, you **must provide exactly one authentication method**:\n\n| Method | Field | When to Use | What to Provide |\n|--------|-------|-------------|----------------|\n| **WIF** | Service Account Name | Recommended for Azure DevOps environments with federated identity setup | The STACKIT service account name (e.g., `my-terraform-account`) |\n| **Key Flow** | Service Account Credentials (JSON) | For local development or where WIF is unavailable | Full JSON file contents from STACKIT service account |\n\n### Configuration Rules\n\n- ✅ **Do this**: Fill EITHER the Service Account Name field OR the Credentials JSON field\n- ❌ **Don't do this**: Leave both fields empty\n- ❌ **Don't do this**: Fill both fields with values\n\nIf you misconfigure the connection (empty or both filled), the `stackit-authenticate` task will fail with a clear error message telling you which field to fix.\n\n## Installation\n\n### For Users\n\n1. **Install from Marketplace** (when published):\n   - Visit [Azure DevOps Marketplace](https://marketplace.visualstudio.com/items?itemName=stackitcloud.stackit-service-connection)\n   - Click \"Get it free\"\n   - Select your Azure DevOps organization\n\n2. **Local Development Install** (VSIX):\n   - Download the VSIX file from [Releases](https://github.com/stackitcloud/azure-devops-stackit-service-connection-extension/releases)\n   - Go to `https://dev.azure.com/{organization}/_settings/extensions`\n   - Click \"Upload extension\"\n   - Select the VSIX file\n\n### For Developers\n\n1. **Clone and Setup**:\n   ```bash\n   git clone https://github.com/stackitcloud/azure-devops-stackit-service-connection-extension.git\n   cd azure-devops-stackit-service-connection-extension\n   npm install\n   ```\n\n2. **Build**:\n   ```bash\n   npm run build\n   ```\n\n3. **Test**:\n   ```bash\n   npm test\n   ```\n\n4. **Package**:\n   ```bash\n   npm run package\n   ```\n\n## Usage\n\n### Creating a Service Connection\n\n#### WIF (Workload Identity Federation)\n\n1. In Azure DevOps, go to **Project Settings** → **Service connections**\n2. Click **New service connection** → **STACKIT**\n3. Choose **WIF** authentication scheme\n4. Enter:\n   - **Service Account Name**: Name of your STACKIT service account\n5. Test the connection\n6. Save\n\n#### Key Flow (JSON Credentials)\n\n1. In Azure DevOps, go to **Project Settings** → **Service connections**\n2. Click **New service connection** → **STACKIT**\n3. Choose **Generic** authentication scheme\n4. Paste the full JSON credentials from your STACKIT service account\n5. Test the connection (optional)\n6. Save\n\n### Using in Pipelines\n\n#### Example: WIF Authentication\n\n```yaml\ntrigger:\n  - main\n\npool:\n  vmImage: 'ubuntu-latest'\n\nsteps:\n  - task: StackitAuthenticate@1\n    inputs:\n      serviceConnection: 'My STACKIT Connection (WIF)'\n    displayName: 'Authenticate with STACKIT (WIF)'\n\n  - script: |\n      echo \"Service Account: $STACKIT_SERVICE_ACCOUNT_EMAIL\"\n    displayName: 'Verify STACKIT Authentication'\n```\n\n#### Example: Key Flow Authentication\n\n```yaml\ntrigger:\n  - main\n\npool:\n  vmImage: 'ubuntu-latest'\n\nsteps:\n  - task: StackitAuthenticate@1\n    inputs:\n      serviceConnection: 'My STACKIT Connection (Key Flow)'\n    displayName: 'Authenticate with STACKIT (Key Flow)'\n\n  - script: |\n      # For Key Flow, credentials are available via STACKIT_SERVICE_ACCOUNT_KEY_PATH\n      stackit auth activate-service-account\n      stackit projects list\n    displayName: 'List STACKIT Projects'\n```\n\n### Task Inputs\n\n| Input | Type | Required | Description |\n|-------|------|----------|-------------|\n| `serviceConnection` | Service Connection | Yes | STACKIT service connection to use |\n\n\n### Environment Variables Set by Task\n\n| Variable | WIF | Key Flow | Description |\n|----------|-----|----------|-------------|\n| `STACKIT_SERVICE_ACCOUNT_EMAIL` | ✅ | ✅ | Service account name (WIF) or email (Key Flow) |\n| `STACKIT_SERVICE_CONNECTION_ID` | ✅ | ❌ | Azure DevOps service connection ID (used for OIDC token retrieval) |\n| `STACKIT_SERVICE_ACCOUNT_KEY_PATH` | ❌ | ✅ | Path to temporary file with JSON credentials (automatically cleaned up) |\n\n## Requirements\n\n- Azure DevOps Agent with Node.js 20+ (standard on modern agents)\n- STACKIT CLI installed on the agent (`stackit` command available)\n- For Key Flow: Valid STACKIT service account credentials in JSON format\n- For WIF: Configured Workload Identity Federation in STACKIT\n\n## Contributing\n\nSee [CONTRIBUTING.md](CONTRIBUTING.md) for guidelines on:\n- Setting up development environment\n- Running tests locally\n- Submitting pull requests\n- Code style and conventions\n\n## Security\n\nSee [SECURITY.md](SECURITY.md) for:\n- Reporting security vulnerabilities\n- Security considerations\n- Data privacy and credential handling\n\n## Publishing\n\n### Prerequisites\n\n- GitHub account with access to this repository\n- Azure DevOps Marketplace Publisher account\n- Marketplace Personal Access Token (PAT)\n\n### CI/CD Workflows\n\n- `ci.yml`: Build, test, package, and upload VSIX artifact on push/PR\n- `release.yml`: Build, test, package, publish (tag/manual), and attach VSIX to GitHub Release\n\n### Automatic Publishing (CI/CD)\n\n1. **Set GitHub Secrets** (in repository settings):\n   - `MARKETPLACE_PAT`: Your Azure DevOps Marketplace Personal Access Token\n\n2. **Publish** via GitHub Actions (`release.yml`):\n   - Push a tag: `git tag v1.0.1 \u0026\u0026 git push --tags`\n   - Or merge to `main` with version bump in `vss-extension.json`\n   - GitHub Actions will automatically build, test, and publish\n\n### Manual Publishing\n\n```bash\n# Build and package\nnpm run build\nnpm run package\n\n# Publish to marketplace\nnpm run package:publish\n```\n\n## Troubleshooting\n\n### Service Connection fails to save\n- Ensure you're using the correct authentication scheme (WIF vs Key Flow)\n- For Key Flow: validate JSON format is correct (copy directly from STACKIT UI)\n- Check that STACKIT API URL is reachable\n\n### Task fails with \"STACKIT CLI not found\"\n- Ensure STACKIT CLI (`stackit` command) is installed on the agent\n- Add CLI installation step before authentication task if needed\n\n### Variables not available in next steps\n- Verify the task ran successfully (check logs)\n- Use explicit environment variable reference in YAML if needed:\n  ```yaml\n  - task: StackitAuthenticate@1\n    name: StackitAuth\n  - script: echo $(STACKIT_SERVICE_ACCOUNT_EMAIL)\n  ```\n\n## License\n\n[Apache 2.0](LICENSE)\n\n## Support\n\nFor issues, feature requests, or questions:\n- GitHub Issues: [Report an issue](https://github.com/stackitcloud/azure-devops-stackit-service-connection-extension/issues)\n- Documentation: [GitHub Wiki](https://github.com/stackitcloud/azure-devops-stackit-service-connection-extension/wiki)\n\n---\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstackitcloud%2Fazure-devops-stackit-service-connection-extension","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fstackitcloud%2Fazure-devops-stackit-service-connection-extension","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fstackitcloud%2Fazure-devops-stackit-service-connection-extension/lists"}