Zero-X Security for Azure DevOps

Secure your Azure DevOps CI/CD pipelines with Zero-X Security.

The Zero-X Security Scan task (ZeroXSecurity@1) runs a Zero-X Security scan for your repository as a pipeline step, reports the findings in the pipeline, and can fail the build when findings reach a severity you choose.

What it does

• Starts a Zero-X scan for the repository and branch being built, using the scan types enabled for it in Zero-X.
• Waits for the scan to finish, with a configurable timeout.
• Shows finding counts by severity in the log and on the run's summary page.
• Fails the pipeline when findings are at or above your threshold.
• Writes a SARIF 2.1.0 report and publishes it as a pipeline artifact.

Key capabilities

• Scanners: vulnerabilities (vulnerability), infrastructure as code (iac), static analysis (sast), malware (malware), SBOM (sbom) and secrets (secrets). Run all or a subset; scan types disabled in Zero-X are skipped with a warning.
• Azure Repos and GitHub: works with repositories connected to Zero-X through an Azure DevOps organization or GitHub.
• Severity gate: none, low, medium, high or critical.
• Clear failure reasons: the log states whether the task failed because of findings, authentication, a scan or API failure, a missing repository setup, or a timeout.
• Pipeline aware: repository, branch, commit and pull request details are read automatically.
• Output variables for later steps: outcome, scan IDs and finding counts.

Installation

1. Install Zero-X Security from the Visual Studio Marketplace into your Azure DevOps organization.
2. In Zero-X Cloud, connect the repository as a datasource and enable the scan types you want. For Azure Repos, also enable scanning for the repository.
3. In Zero-X Cloud, create a Platform API key under Settings → API Keys.
4. In Azure DevOps, store the key as a secret pipeline variable (for example ZEROX_API_KEY) or in a secret variable group.

Quick start

trigger:
  - main

pool:
  vmImage: ubuntu-latest

variables:
  - group: zero-x # contains ZEROX_API_KEY (secret)

steps:
  - checkout: self

  - task: ZeroXSecurity@1
    displayName: 'Zero-X Security Scan'
    inputs:
      zeroxApiKey: '$(ZEROX_API_KEY)'
      failOnSeverity: 'high'

Configuration

Security

• Keep the API key in a secret variable or secret variable group. The task also registers it as a secret, so it is masked in logs.
• The key is sent only to your zeroxUrl, only over HTTPS, in the api-key header. Redirects are not followed.
• The task never runs commands that come from API responses.

Scan results

The log shows totals by severity:

Findings: 12
  Critical: 0
  High:     2
  Medium:   5
  Low:      5

The run's Extensions tab shows a summary with the most severe findings. Later steps can use these output variables (give the task a name: to reference them): ZeroXOutcome, ZeroXScanIds, ZeroXFindingsTotal, ZeroXFindingsCritical, ZeroXFindingsHigh, ZeroXFindingsMedium, ZeroXFindingsLow, ZeroXSarifFile.

Failure policy

With failOnSeverity: high:

Scan and API failures, and incomplete Zero-X setup (no scan type enabled, or an Azure Repos repository not enabled for scanning), always fail the task, whatever the threshold. Individual disabled scan types only produce a warning. The log states the reason, for example Failure reason: Zero-X authentication failed. or Failure reason: Security findings exceeded the configured severity threshold.

SARIF

The SARIF 2.1.0 report includes rules, severity levels, messages and, where Zero-X provides them, file and line locations. With publishSarifArtifact: true it is published as the CodeAnalysisLogs artifact, which the Microsoft DevLabs SARIF SAST Scans Tab extension displays on the run page.

Support

Report problems and request features at github.com/Zero-X-Security/zero-x-azure-devops-actions/issues. Include the pipeline log with system.debug: true. Secret values are masked.

License

MIT