Rorix Security Scanner for Azure DevOps

Rorix is a .NET supply chain security tool that provides vulnerability scanning, SBOM generation, and license compliance enforcement for NuGet packages. This extension adds a native pipeline task so you can run Rorix without manual CLI installation steps.

The task uses the Azure Pipelines Node20_1 handler on Windows, Linux, and macOS agents. It installs the pinned public Rorix.Cli 0.1.2 release into the agent's temporary directory and passes the masked API key only through the child-process environment.

Pipeline Examples

Vulnerability Scan

steps:
  - task: RorixScan@0
    inputs:
      apiKey: $(RORIX_API_KEY)
      command: scan
      format: sarif

Policy Enforcement

steps:
  - task: RorixScan@0
    inputs:
      apiKey: $(RORIX_API_KEY)
      command: policy
      policyFile: .rorix.yml

SBOM Generation

steps:
  - task: RorixScan@0
    inputs:
      apiKey: $(RORIX_API_KEY)
      command: sbom
      format: cyclonedx

Inputs

Input	Required	Default	Description
`apiKey`	Yes	—	Rorix API key (starts with `rxk_`). Store as a secret variable.
`command`	No	`scan`	Command to run: `scan`, `sbom`, or `policy`.
`format`	No	`table`	Scan: `table`, `json`, or `sarif`. SBOM: `cyclonedx` or `spdx`. Not used with `policy`.
`policyFile`	No	—	Path to `.rorix.yml` policy file.
`path`	No	`.`	Path to .NET project or directory.

Documentation

For full documentation, visit rorix.io/docs.

Rorix Security Scanner

Authaz