Axivion Azure DevOps Extension

The Axivion Azure DevOps Extension enables you to review the results of the code analyses performed separately by any of the following products of Axivion:

• Axivion Suite C/C++,
• Axivion Static Code Analysis C/C++,
• Axivion Static Code Analysis Pro C/C++, or
• Axivion Architecture Suite C/C++.

These products of Axivion include various static code analysis strategies and tools:

• static defect analysis
• architecture verification
• clone detection and management
• coding guidelines as MISRA C:2004, MISRA C:2012, MISRA C++:2008, AUTOSAR C++14, CERT, C Secure Coding, CWE ...
• software metrics
• cycle detection
• dead code analysis

For more information about Axivion Suite C/C++, licensing information, or a free demo, please visit our website.

Features

The job summary includes warnings when new issues are found.

The new "Axivion Report" tab provides information about found issues.

The status check can prevent pull requests from merging.

Pull requests are annotated with issue information comments. A summary comment is posted if configured.

Prerequisites

This extension asks for build scope permission to fetch build artifacts (Axivion Json Reports).

Contribute to Pull Requests Permission

To allow the extension to annotate pull requests with comments about found issues, the <project> Build Service (<organization>) user needs the Contribute to pull requests permission (Project Settings > Repositories > Security > Users).

It could also be the Project Collection Build Service (<organization>) user in your organization. The build user needs to have access to the System.AccessToken variable.

Branch Policies

Make sure that your branches have configured a Build Validation (Project Settings > Repositories > Project > Policies > Build Validation) step where the pipeline including the Axivion-CommentPullRequest task will be run.

Optional: Status Check

The Axivion-CommentPullRequest task publishes a status check Axivion/NoNewIssues which is an optional merge requirement.

To make this status check required in your workflow, visit Project Settings > Repositories > Project > Policies > Branch Policies, choose a branch and add a new status check with Axivion/NoNewIssues as the exact name.

Configurating the pipeline

This is an example pipeline showing how to upload Axivion Json results and use the Axivion-CommentPullRequest task.

trigger:
  - main # trigger analysis when pushing to branch

pr:
  - main # trigger analysis when merging to branch from pull request

pool:
# ...

steps:
  # ... tasks to build and analysis and produce Json output
  - task: PublishBuildArtifacts@1 # Upload the Json results
    name: AxivionJsonResults # Name for the pipeline step
    inputs:
      pathtoPublish: "$(Pipeline.Workspace)/s/results.json" # path to a json report by Axivion CI or Axivion WebUI
      artifactName: AxivionJsonResults # Use this exact name for the artifact

  - task: Axivion-CommentPullRequest@0 # Annotate changed files in pull requests
    inputs:
      contributeStatusCheck: true # optional status check, can be made required in the branch policies
      postSummaryComment: true # post a summary comment with all new issues
      postIssueComments: true # post a comment per new issue found
      deletePreviousComments: true # delete comments from previous pipeline runs

The Axivion extension supports json results from axivion_analysis runs or from the Axivion WebUI's /issues endpoints.

Known limitations

• We currently do not support the PublishPipelineArtifact task. Please use the PublishBuildArtifacts@1 task.