Conviso AST

Scan your applications for vulnerabilities with Conviso AST and assess the results in Conviso Platform. One pipeline task covers six scan types:


SAST — application code	SCA — dependencies	IaC — infrastructure code
SBOM — component inventory	Secret — leaked credentials	Container — image layers

Quick start

Store your Conviso API key as a secret pipeline variable, then add the task:

trigger:
  batch: true
  branches:
    include:
      - staging
      - main

pr: none

pool:
  vmImage: ubuntu-latest

variables:
  - name: CONVISO_COMPANY_ID
    value: '<<FILL_IT_HERE>>'

steps:
  - checkout: self
    fetchDepth: 0

  - task: ConvisoAST@1
    displayName: Conviso AST
    inputs:
      apiKey: $(CONVISO_API_KEY)
      companyId: $(CONVISO_COMPANY_ID)

The task resolves the branch, the sources directory and the output location from the pipeline itself — including in pull request builds, where Azure's own branch variables are unusable. So the two inputs above are all it needs.

Everything around the task is a starting point — adjust it to how your team works:


`CONVISO_COMPANY_ID`	Replace `<<FILL_IT_HERE>>` with your company ID from Conviso Platform, or drop the `variables` block and take it from a variable group.
`trigger.branches.include`	The branches worth scanning. `staging` and `main` are an example — use your own.
`batch: true`	Runs one scan at a time per branch and collapses the commits queued behind it. Remove it to scan every push.
`pr: none`	No scan on pull request builds. Remove it to scan PRs too — the task files those findings under the PR's source branch.
`fetchDepth: 0`	Full history. Only incremental scans need it; without `baselineRef` the default shallow clone is enough.

Requirements

A Linux x64 agent with Docker, such as vmImage: ubuntu-latest. If the agent already has the conviso-ast CLI and its scanner binaries installed, the task uses them directly and no Docker is required.

Inputs

Input	Required	Default	Description
`apiKey`	yes	—	Conviso API key. Always pass a secret variable.
`companyId`	yes	—	Company ID in Conviso Platform.
`baseUrl`	no	—	Leave empty to use the public instance. For a dedicated or on-premise instance.
`assetId`	no	(auto)	Pins the scan to one asset.
`scanTypes`	no	(all)	`sast`, `sca`, `iac`, `sbom`, `secret`, `container`.
`imageName`	no	—	Image for the container scanner.
`path`	no	`$(Build.SourcesDirectory)`	Directory to scan.
`branch`	no	(auto)	Overrides the resolved branch.
`baselineRef`	no	—	Branch to diff against, for incremental scans.
`outputPath`	no	`$(Agent.TempDirectory)/conviso-ast-$(Build.BuildId).zip`	Session archive location.
`imageRepository`	no	`convisoappsec/convisoast_v2`	Mirror or private registry.
`imageTag`	no	`latest`	Pin for reproducible builds.
`dryRun`	no	`false`	Runs the scanners without writing to the platform.

Common configurations

Only some scanners

  - task: ConvisoAST@1
    inputs:
      apiKey: $(CONVISO_API_KEY)
      companyId: $(CONVISO_COMPANY_ID)
      scanTypes: sast,secret

Incremental scan against main — requires fetchDepth: 0, or the scan silently covers everything:

steps:
  - checkout: self
    fetchDepth: 0

  - task: ConvisoAST@1
    inputs:
      apiKey: $(CONVISO_API_KEY)
      companyId: $(CONVISO_COMPANY_ID)
      baselineRef: main

Scanning a container image you just built

  - task: ConvisoAST@1
    inputs:
      apiKey: $(CONVISO_API_KEY)
      companyId: $(CONVISO_COMPANY_ID)
      scanTypes: sast,container
      imageName: myorg/app:$(Build.BuildId)

Keeping the session archive — the zip holds every scanner's raw output and the debug log, and is the first thing Conviso support asks for:

  - task: PublishBuildArtifacts@1
    condition: always()
    inputs:
      pathToPublish: $(Agent.TempDirectory)/conviso-ast-$(Build.BuildId).zip
      artifactName: conviso-ast

Good to know

Findings never fail the build. The task fails only when a scan or an upload fails. Use continueOnError: true if you do not want even that to stop the pipeline.
Your API key never reaches the build log. It is registered as a secret before anything else runs, and it is passed to the scanner by variable name, never on a command line.
Pull request builds are handled. Azure reports refs/pull/42/merge as the branch, which is not a branch name at all. The task records the pull request's source branch, so its findings are not filed under main.

Also available for GitHub Actions

The equivalent action is published on the GitHub Marketplace.