Finite State Analysis Azure DevOps Extension

finitestate.io

Description

This extension adds three Finite State tasks to Azure DevOps pipelines:

• Analyze Binary
• Import SBOM (CycloneDX or SPDX)
• Import Third-Party Scan

These tasks upload artifacts to the Finite State Platform, create a project version when needed, and start the appropriate analysis or ingestion. The task output includes a direct link to the project version in the Finite State UI.

By default, the version’s release type is configurable. You can also choose to use the Azure Pipelines Build ID as the version by enabling “Use externalized ID as version.”

Task: Analyze Binary

Uploads a binary to Finite State and starts selected scans (e.g., SCA, SAST, Config, Vulnerability Analysis).

Inputs (Analyze Binary)

Task: Import SBOM

Uploads an SBOM file for ingestion. Supports CycloneDX and SPDX formats.

Inputs (Import SBOM)

Task: Import Third-Party Scan

Uploads a third-party scan report to Finite State for ingestion.

Inputs (Import Third-Party Scan)

Note: For the scanType field, you must use one of the supported identifiers listed below. The value must match exactly to ensure the scan is recognized and processed correctly.

Third-Party scanType values (exact identifiers)

Set Up Workflow

To start using this Extension, install it from the Azure DevOps Marketplace.

After it is installed, you can add the Finite State tasks to your pipeline by finding them in the Tasks panel:

You can customize the input parameters for each task:

Although you can write values directly in the input fields, we recommend storing sensitive values as secrets rather than hardcoding them in the pipeline YAML. At minimum, store the following as secrets:

• API token (obtained from the Finite State platform at Settings → API Tokens)

When you run the pipeline, the task logs will include a link to the created project version in the Finite State UI.

Generate a Comment on a PR with the Link to the Uploaded Artifact

If you want the tasks to automatically generate a PR comment with a link to the results on the Finite State Platform, make sure to give permissions to the Azure pipeline token System.AccessToken. Then, grant the necessary permissions to the associated token by going to Project Settings > Repositories > Security:

This allows the task to post a comment in the PR when prComment is enabled (true). After this step, you will get a comment in the PR with a link that points to the results in the Finite State Platform:

Build Policy

Configure a build policy over your main branch to automatically start a build when a PR targets it. This ensures each commit to a PR branch triggers the pipeline and, if configured, posts a PR comment.

To set up a policy, go to Project Settings > Repositories > [Select the repository] > Policies Tab. In the Branch Policies section, click on main branch:

On the Build Validation section, add a new build policy:

In the dialog, save the settings as follows:

After that, you will see a configuration similar to this:

Going forward, each commit to a branch associated with a PR targeting the main branch will trigger the pipeline automatically and execute the Finite State task:

The task logs will summarize the execution and include links to the created project version:

Action Debugging

All details pertaining to the execution of the tasks are recorded in the workflow logs. This is a helpful starting point if you encounter any errors during a run.

If you have any errors, enable System diagnostics when you run the pipeline to capture verbose logs:

Example output when System diagnostics is enabled:

Useful Links

• Azure DevOps: Install extensions — Microsoft Docs
• Finite State documentation — docs.finitestate.io