Badgr Pipeline Check for Azure Pipelines

Badgr Pipeline Check helps teams understand why Azure Pipelines fail.

It runs on every build, checks failed tasks, slow steps, risky commands, leaked secrets, and common YAML/config issues, then writes a clear report to the build summary or console.

Local rule-based checks run by default with no Badgr API key. AI is optional and only used when a build fails and the failure is ambiguous or low-confidence.

From AI Badgr.

What Badgr checks

Failure diagnosis Finds common Azure build failures such as missing packages, test failures, TypeScript errors, Docker errors, dependency conflicts, timeouts, and permission problems.

Pipeline health Flags slow steps, long install/test stages, retry patterns, and bottlenecks.

Security scan Looks for secret-like values, broad permissions, sudo usage, curl | bash, and --privileged flags.

Config audit Checks for missing timeouts, unpinned versions, :latest images, and hardcoded values in YAML.

Quick start

Rule-based checks run without any credentials:

- task: BadgrCI@1
  condition: always()
  displayName: Badgr Pipeline Check
  env:
    BADGR_OUTPUT_MODE: summary

Install modes

Minimal — rule-based checks only

No credentials needed. Badgr runs all four checks using available task metadata and build context:

- task: BadgrCI@1
  condition: always()
  displayName: Badgr Pipeline Check
  env:
    BADGR_OUTPUT_MODE: summary

With ci_token — richer logs and PR comments

Pass ci_token to fetch full Azure DevOps task logs and post PR thread comments. Badgr also auto-detects SYSTEM_ACCESSTOKEN when Azure exposes it.

- task: BadgrCI@1
  condition: always()
  displayName: Badgr Pipeline Check
  inputs:
    ci_token: $(System.AccessToken)
  env:
    BADGR_OUTPUT_MODE: summary

To enable: Pipeline → Edit → ⋯ → Triggers → Allow scripts to access the OAuth token

With BADGR_API_KEY — AI for ambiguous failures

Add BADGR_API_KEY to enable AI diagnosis when the failure pattern is unknown or low-confidence:

- task: BadgrCI@1
  condition: always()
  displayName: Badgr Pipeline Check
  env:
    BADGR_API_KEY: $(BADGR_API_KEY)
    BADGR_OUTPUT_MODE: summary

Full — richer logs, PR comments, and AI

- task: BadgrCI@1
  condition: always()
  displayName: Badgr Pipeline Check
  inputs:
    ci_token: $(System.AccessToken)
  env:
    BADGR_API_KEY: $(BADGR_API_KEY)
    BADGR_OUTPUT_MODE: summary

Self-hosted — no logs sent to aibadgr.com

- task: BadgrCI@1
  condition: always()
  displayName: Badgr Pipeline Check
  env:
    BADGR_API_URL: http://your-host:8000/v1
    BADGR_API_KEY: $(BADGR_INTERNAL_KEY)
    BADGR_OUTPUT_MODE: summary

How it works

On every build, Badgr runs four rule-based checks locally — no API calls:

AI is called only when:

• the build failed
• BADGR_API_KEY is configured
• the rule-based failure score is low-confidence or the failure pattern is unknown

Health, security, and audit checks are always rule-based — they never call AI. If the AI call fails, the rule-based report is still written.

Permissions

No BADGR_API_KEY: Runs local rule-based Pipeline Check only. No AI call.

No SYSTEM_ACCESSTOKEN: Runs best-effort Azure checks using available task metadata/context and any provided log or pipeline file.

With SYSTEM_ACCESSTOKEN: Badgr can fetch richer Azure task logs from Azure DevOps APIs and post/update PR thread comments.

With BADGR_API_KEY: Badgr can use AI only for ambiguous failed builds after logs are redacted.

Self-hosted: Point BADGR_API_URL at your internal Badgr container so logs are not sent to aibadgr.com.

Start free with local checks. Add Azure OAuth for richer logs. Add a Badgr key for AI on ambiguous failures. Use self-hosted for private environments.

Hosted and self-hosted

Hosted mode: Logs are redacted locally before any API call. AI is only contacted when needed.

Self-hosted mode: Run the Badgr Pipeline Check container inside your network. Logs are sent only to your own container and optionally your own model endpoint.

Output modes

If pr-comment or both is set but SYSTEM_ACCESSTOKEN is absent, Badgr warns and falls back to summary.

What Badgr does not do

• Does not auto-fix or modify your code
• Does not rerun pipelines or open/merge PRs
• Does not require changes to your existing tests

Example output

### Badgr Pipeline Check

**Failure:** Missing dependency `vite`
**Evidence:** `Cannot find module 'vite'`
**Suggested fix:** `npm install --save-dev vite`
**Confidence:** high

**Health:** Test step took 8m 42s
**Security:** No secrets found
**Audit:** Consider adding a timeout

FAQ

Does Badgr require an API key?

No. The default Pipeline Check runs local rule-based checks without a Badgr API key.

When is AI used?

AI is only used when a build failed, a Badgr API key or private provider is configured, and the local failure score is ambiguous or low-confidence.

Does Badgr send logs to AI Badgr every run?

No. Health, security, and audit checks are local. Known failures are handled locally. Logs are only sent for optional AI escalation when needed.

Does Badgr auto-fix code?

No. Badgr reports findings and suggested fixes. It does not modify code, rerun pipelines, or merge PRs.

Can I keep logs inside my network?

Yes. Use the self-hosted Badgr Pipeline Check container and set BADGR_API_URL to your internal endpoint.

Requirements

• Azure DevOps Services or Azure DevOps Server
• BADGR_API_KEY from aibadgr.com — optional; enables AI for ambiguous failures
• SYSTEM_ACCESSTOKEN — optional; enables richer log collection and PR thread comments

Support

• Documentation: github.com/michaelmanly/badgr-ci
• Email: support@aibadgr.com

License

Apache-2.0