ScanHive for Azure DevOps

The ScanHive Azure DevOps extension provides a service connection and pipeline task for uploading SARIF security scan results to ScanHive.

Features

• Store the ScanHive server URL and API key in an Azure DevOps service connection.
• Upload SARIF reports from build and release pipelines.
• Associate uploaded findings with a ScanHive project and scan type.
• Expose the resulting scan ID and finding count as pipeline variables.

Requirements

• A ScanHive instance that is reachable from the Azure Pipelines agent
• A ScanHive API key

Configure the service connection

In your Azure DevOps project:

1. Open Project settings > Service connections.
2. Select New service connection > ScanHive.
3. Enter the Org URL (your ScanHive instance's base URL) and a ScanHive API key.
4. Give the connection a recognizable name and save it.

The project you're uploading to is set per-task, not per-connection -- see "Use the pipeline task" below.

Service connections are scoped to an Azure DevOps project.

Use the pipeline task

Add the task to an Azure Pipelines YAML file:

- task: scanhive@0
  inputs:
    serviceConnection: "ScanHive Production"
    projectId: "my-app"
    scanType: "IaC"
    sarifFile: "$(Build.SourcesDirectory)/results.sarif"

projectId accepts either a project's name or its UUID. If you give a name that doesn't match an existing project, ScanHive creates one automatically (owned by the API key's user) instead of failing -- you don't need to create the project by hand before wiring up a pipeline. sarifFile may be a file path or minimatch pattern that resolves to one SARIF report.

Supported scan types are SAST, SCA, Secrets, Container Security, IaC, and DAST.

After a successful upload, the task sets these pipeline variables:

• ScanHive.ScanId: ID of the scan created in ScanHive
• ScanHive.Findings: number of findings reported by ScanHive