Conviso AST

Scan your applications for vulnerabilities with Conviso AST and assess the results in Conviso Platform. One pipeline task covers six scan types:


SAST — application code	SCA — dependencies	IaC — infrastructure code
SBOM — component inventory	Secret — leaked credentials	Container — image layers

Quick start

Store your Conviso API key as a secret pipeline variable, then add the task:

pool:
  vmImage: ubuntu-latest

steps:
  - checkout: self

  - task: ConvisoAST@1
    displayName: Conviso AST
    inputs:
      apiKey: $(CONVISO_API_KEY)
      companyId: '11'

That is the whole configuration. The task resolves the branch, the sources directory and the output location from the pipeline itself — including in pull request builds, where Azure's own branch variables are unusable.

Requirements

A Linux x64 agent with Docker, such as vmImage: ubuntu-latest. If the agent already has the conviso-ast CLI and its scanner binaries installed, the task uses them directly and no Docker is required.

Inputs

Input	Required	Default	Description
`apiKey`	yes	—	Conviso API key. Always pass a secret variable.
`companyId`	yes	—	Company ID in Conviso Platform.
`baseUrl`	no	`https://app.convisoappsec.com`	For a dedicated or on-premise instance.
`assetId`	no	(auto)	Pins the scan to one asset.
`scanTypes`	no	(all)	`sast`, `sca`, `iac`, `sbom`, `secret`, `container`.
`imageName`	no	—	Image for the container scanner.
`path`	no	`$(Build.SourcesDirectory)`	Directory to scan.
`branch`	no	(auto)	Overrides the resolved branch.
`baselineRef`	no	—	Branch to diff against, for incremental scans.
`outputPath`	no	`$(Agent.TempDirectory)/conviso-ast-$(Build.BuildId).zip`	Session archive location.
`imageRepository`	no	`convisoappsec/convisoast_v2`	Mirror or private registry.
`imageTag`	no	`latest`	Pin for reproducible builds.
`dryRun`	no	`false`	Runs the scanners without writing to the platform.

Common configurations

Only some scanners

  - task: ConvisoAST@1
    inputs:
      apiKey: $(CONVISO_API_KEY)
      companyId: '11'
      scanTypes: sast,secret

Incremental scan against main — requires fetchDepth: 0, or the scan silently covers everything:

steps:
  - checkout: self
    fetchDepth: 0

  - task: ConvisoAST@1
    inputs:
      apiKey: $(CONVISO_API_KEY)
      companyId: '11'
      baselineRef: main

Scanning a container image you just built

  - task: ConvisoAST@1
    inputs:
      apiKey: $(CONVISO_API_KEY)
      companyId: '11'
      scanTypes: sast,container
      imageName: myorg/app:$(Build.BuildId)

Keeping the session archive — the zip holds every scanner's raw output and the debug log, and is the first thing Conviso support asks for:

  - task: PublishBuildArtifacts@1
    condition: always()
    inputs:
      pathToPublish: $(Agent.TempDirectory)/conviso-ast-$(Build.BuildId).zip
      artifactName: conviso-ast

Good to know

Findings never fail the build. The task fails only when a scan or an upload fails. Use continueOnError: true if you do not want even that to stop the pipeline.
Your API key never reaches the build log. It is registered as a secret before anything else runs, and it is passed to the scanner by variable name, never on a command line.
Pull request builds are handled. Azure reports refs/pull/42/merge as the branch, which is not a branch name at all. The task records the pull request's source branch, so its findings are not filed under main.

Also available for GitHub Actions

The equivalent action is published on the GitHub Marketplace.