ReARM CLI Tasks for Azure DevOps

This extension provides pipeline tasks to download and use the ReARM CLI tool.

Prerequisites

For full functionality (branch synchronization and change detection), configure your pipeline checkout step with:

steps:
  - checkout: self
    fetchDepth: 0

• fetchDepth: 0 - Fetches full git history, required for accurate change detection between releases

Without these settings, the tasks will still work but branch sync will be skipped, builds will always be triggered and commit history will not be uploaded to ReARM properly.

Tasks

RearmCliInstall

Downloads and installs the ReARM CLI.

• Downloads from CloudFront CDN
• Supports both Windows and Linux agents
• Automatically detects the agent OS and downloads the appropriate binary
• Adds ReARM CLI to PATH
• Sets RearmCli output variable with the full path to the executable

Using RearmCli in Bash Scripts:

To use the RearmCli variable in subsequent bash tasks, you must give the task a name and reference the variable using that name:

steps:
  - task: RearmCliInstall@1
    name: RearmCliInstall  # Required to reference output variables

  - bash: |
      echo "RearmCli path: $(RearmCliInstall.RearmCli)"
      "$(RearmCliInstall.RearmCli)" --version
    displayName: 'Use ReARM CLI'

RearmReleaseInitialize

Synchronizes branches, checks for changes since last release, and initializes a pending release with ReARM. Sets DO_BUILD variable to indicate if a build is needed.

• If version is provided, uses addrelease command with the specified version
• If version is not provided, uses getversion command to obtain version from ReARM
• Exposes REARM_FULL_VERSION and REARM_SHORT_VERSION variables for use in subsequent tasks

RearmReleaseFinalize

Finalizes a release in ReARM with deliverable metadata and artifacts. Supports:

• Deliverable metadata (container images, binaries, etc.)
• Source code entry artifacts (SCE artifacts)
• Release artifacts (release notes, security reports)
• Deliverable artifacts (SBOMs, attestations)

When the lifecycle is ASSEMBLED, the ReARM backend finalizes the release natively — no separate finalizer call is made by the task.

RearmAddMultiRelease

Submits several ReARM releases in one all-or-nothing batch via rearm addreleases. Unlike calling the single-release flow once per component, the backend fires product auto-integration only once per affected feature set for the whole batch (deduped) — use this when a CI run builds several component releases at once and you want a single product auto-integrate.

This is a standalone task: it derives nothing from the pipeline context and builds no metadata for you — you hand it the complete batch JSON. Provide the batch as inline releases JSON or point infile at a file on disk (if both are set, infile wins). Each element is shaped exactly like the single-release addrelease input (ReleaseInputProg) — component (or vcsUri + repoPath), branch, version, lifecycle, optional sourceCodeEntry, outboundDeliverables, artifacts, plus per-release flags such as rebuildRelease and createComponentIfMissing. Artifacts reference local files via their filePath field (resolved relative to workingDirectory); the CLI reads and uploads each file — you do not embed file bytes in the JSON.

Usage

Install ReARM CLI

steps:
  - task: RearmCliInstall@1

  - script: |
      rearm --version
    displayName: 'Run ReARM CLI'

Initialize Release

steps:
  - task: RearmCliInstall@1

  - task: RearmReleaseInitialize@1
    inputs:
      rearmApiKey: '$(REARM_API_KEY)'
      rearmApiKeyId: '$(REARM_API_KEY_ID)'
      rearmUrl: 'https://your-rearm-server.com'
      repoPath: '.'
      # version: '$(GitVersion.SemVer)'  # Optional - if not provided, version is obtained from ReARM

  - script: |
      echo "Version: $(REARM_FULL_VERSION)"
      echo "Short Version: $(REARM_SHORT_VERSION)"
      echo "Building..."
    condition: eq(variables['DO_BUILD'], 'true')
    displayName: 'Build (only if changes detected)'

Finalize Release

steps:
  - task: RearmCliInstall@1

  - task: RearmReleaseInitialize@1
    inputs:
      rearmApiKey: '$(REARM_API_KEY)'
      rearmApiKeyId: '$(REARM_API_KEY_ID)'
      rearmUrl: 'https://your-rearm-server.com'

  # ... your build steps (use $(REARM_FULL_VERSION) or $(REARM_SHORT_VERSION) for tagging) ...

  - task: RearmReleaseFinalize@1
    inputs:
      rearmApiKey: '$(REARM_API_KEY)'
      rearmApiKeyId: '$(REARM_API_KEY_ID)'
      rearmUrl: 'https://your-rearm-server.com'
      lifecycle: 'ASSEMBLED'
      odelId: 'myregistry.azurecr.io/myapp'
      odelType: 'CONTAINER'
      odelDigests: '$(DOCKER_SHA_256)'
      odelPurl: 'pkg:oci/myapp@sha256:abc123'
      odelArtsJson: '[{"bomFormat":"CYCLONEDX","type":"BOM","filePath":"./sbom.json"}]'
      sceArts: '[{"bomFormat":"CYCLONEDX","type":"BOM","filePath":"./source-sbom.json"}]'
      releaseArts: '[{"displayIdentifier":"release-notes","type":"RELEASE_NOTES","storedIn":"REARM","filePath":"./CHANGELOG.md"}]'

Add Multiple Releases

Use RearmAddMultiRelease as a standalone task to submit several releases in one all-or-nothing batch. You hand it the complete batch JSON — either inline via releases or as a file via infile — and the task passes it through to rearm addreleases. Unlike the single-release flow, the backend fires product auto-integration once per affected feature set for the whole batch.

Each element of the array is shaped exactly like the single-release addrelease input (ReleaseInputProg). Two distinct paths are in play — do not conflate them: workingDirectory is the task input (the process directory the CLI runs from, where each artifact filePath resolves), whereas repoPath is a per-release JSON field that identifies each component inside a monorepo (paired with vcsUri). One batch can span many components, each with its own repoPath. For the exact JSON shape, refer to the ReARM CLI documentation.

Inline JSON — a monorepo batch with two components:

steps:
  - task: RearmCliInstall@1

  - task: RearmAddMultiRelease@1
    inputs:
      rearmApiKey: '$(REARM_API_KEY)'
      rearmApiKeyId: '$(REARM_API_KEY_ID)'
      rearmUrl: 'https://your-rearm-server.com'
      releases: |
        [
          {
            "vcsUri": "github.com/acme/monorepo",
            "repoPath": "services/widget",
            "branch": "main",
            "version": "$(VERSION_WIDGET)",
            "lifecycle": "ASSEMBLED",
            "rebuildRelease": true,
            "sourceCodeEntry": { "commit": "$(Build.SourceVersion)", "uri": "github.com/acme/monorepo", "type": "git" },
            "artifacts": [
              { "displayIdentifier": "widget-sbom", "type": "BOM", "bomFormat": "CYCLONEDX", "filePath": "./services/widget/sbom.cdx.json" }
            ]
          },
          {
            "vcsUri": "github.com/acme/monorepo",
            "repoPath": "services/gadget",
            "branch": "main",
            "version": "$(VERSION_GADGET)",
            "lifecycle": "ASSEMBLED",
            "rebuildRelease": true,
            "sourceCodeEntry": { "commit": "$(Build.SourceVersion)", "uri": "github.com/acme/monorepo", "type": "git" },
            "artifacts": [
              { "displayIdentifier": "gadget-sbom", "type": "BOM", "bomFormat": "CYCLONEDX", "filePath": "./services/gadget/sbom.cdx.json" }
            ]
          }
        ]

From a file (infile) — mixing an existing component (by UUID) with a new one auto-created from its vcsUri + repoPath, plus a container deliverable and its SBOM:

steps:
  - task: RearmCliInstall@1

  - task: Bash@3
    displayName: 'Write release batch'
    inputs:
      targetType: inline
      script: |
        mkdir -p reliza
        cat > reliza/batch.json <<'EOF'
        [
          {
            "component": "5a813e39-c453-444e-85cd-b618b7de6108",
            "branch": "main",
            "version": "1.4.0",
            "lifecycle": "ASSEMBLED",
            "rebuildRelease": true,
            "artifacts": [
              { "displayIdentifier": "widget-sbom", "type": "BOM", "bomFormat": "CYCLONEDX", "filePath": "./services/widget/sbom.cdx.json" }
            ]
          },
          {
            "vcsUri": "github.com/acme/monorepo",
            "repoPath": "services/gizmo",
            "branch": "main",
            "version": "0.1.0",
            "lifecycle": "ASSEMBLED",
            "createComponentIfMissing": true,
            "createComponentName": "gizmo",
            "createComponentVersionSchema": "semver",
            "outboundDeliverables": [
              {
                "displayIdentifier": "registry.acme.com/gizmo:0.1.0",
                "type": "CONTAINER",
                "softwareMetadata": { "packageType": "CONTAINER", "digests": ["sha256:abc123"] },
                "artifacts": [
                  { "displayIdentifier": "gizmo-image-sbom", "type": "BOM", "bomFormat": "CYCLONEDX", "filePath": "./services/gizmo/image-sbom.cdx.json" }
                ]
              }
            ]
          }
        ]
        EOF

  - task: RearmAddMultiRelease@1
    inputs:
      rearmApiKey: '$(REARM_API_KEY)'
      rearmApiKeyId: '$(REARM_API_KEY_ID)'
      rearmUrl: 'https://your-rearm-server.com'
      infile: 'reliza/batch.json'

Task Reference

RearmCliInstall Inputs

RearmReleaseInitialize Inputs

RearmReleaseInitialize Outputs

RearmReleaseFinalize Inputs

RearmAddMultiRelease Inputs

RearmAddMultiRelease — Per-Release Object Schema

Each element of the batch array is shaped exactly like the single-release addrelease input (ReleaseInputProg). The task passes the JSON through to rearm addreleases unchanged, so the authoritative field reference is the ReARM CLI documentation. Commonly used fields:

Notes:

• The whole batch is sent in one all-or-nothing call — if any release fails, none are created.
• Artifacts reference local files via their filePath field; the CLI reads and uploads each file. Do not embed file bytes in the JSON.

Support

For issues and feature requests, visit the GitHub repository.