Purplemet Azure DevOps Extension

Purplemet: Proactive Web Attack Surface Management. Discover real-time security insights with Purplemet's Web ASM platform.

Run Purplemet security analyses directly in your Azure DevOps pipelines.

Quick Start

trigger:
  - main

pool:
  vmImage: 'ubuntu-latest'

steps:
  - task: PurplemetAnalyze@1
    inputs:
      apiToken: $(PURPLEMET_API_TOKEN)
      targetUrl: 'https://your-app.example.com'
      failSeverity: 'high'

Prerequisites

1. Create a Purplemet API token at cloud.purplemet.com
2. Install the extension from the Azure DevOps Marketplace
3. Add PURPLEMET_API_TOKEN as a secret pipeline variable:
   • Edit pipeline → Variables → New variable
   • Check Keep this value secret

Usage

YAML Pipeline

steps:
  - task: PurplemetAnalyze@1
    inputs:
      apiToken: $(PURPLEMET_API_TOKEN)
      targetUrl: 'https://your-app.example.com'
      failSeverity: 'high'

Classic Pipeline

1. Add the Purplemet Security Analysis task
2. Configure the API token (use a secret variable)
3. Set the target URL and severity threshold

With Docker (Without Extension)

The ppmsupport/purplemet-cli Docker image includes the shared analyze.sh script which reads all PURPLEMET_* variables automatically:

steps:
  - script: |
      docker run --rm \
        -e PURPLEMET_API_TOKEN=$(PURPLEMET_API_TOKEN) \
        -e PURPLEMET_TARGET_URL=https://your-app.com \
        -e PURPLEMET_FAIL_SEVERITY=high \
        --entrypoint /usr/local/share/purplemet/analyze.sh \
        ppmsupport/purplemet-cli
    displayName: 'Purplemet Security Analysis'

With Binary Installation

Uses the shared install.sh and analyze.sh scripts for consistent behavior across all platforms:

steps:
  - script: |
      curl -sSLf https://github.com/purplemet/cli/releases/latest/download/install.sh -o /tmp/install.sh
      curl -sSLf https://github.com/purplemet/cli/releases/latest/download/analyze.sh -o /tmp/analyze.sh
      chmod +x /tmp/install.sh /tmp/analyze.sh
      source /tmp/install.sh && purplemet_install
      /tmp/analyze.sh
    displayName: 'Purplemet Security Analysis'
    env:
      PURPLEMET_API_TOKEN: $(PURPLEMET_API_TOKEN)
      PURPLEMET_TARGET_URL: 'https://your-app.com'
      PURPLEMET_FAIL_SEVERITY: 'high'

All PURPLEMET_* variables from the configuration reference are supported.

Inputs

Required

General

Security Gates

When using the Docker or binary methods (without the extension), all of the above are exposed as PURPLEMET_* environment variables (e.g. PURPLEMET_FAIL_ON_KEV, PURPLEMET_FAIL_CVSS).

Output Variables

Access in subsequent steps:

- task: PurplemetAnalyze@1
  name: analysis
  inputs:
    apiToken: $(PURPLEMET_API_TOKEN)
    targetUrl: 'https://your-app.com'

- script: |
    echo "Rating: $(analysis.PurplemetRating)"
    echo "Issues: $(analysis.PurplemetIssues)"
  displayName: 'Check Results'

Viewing the Report

Formats json, sarif, human

The task automatically uploads the analysis output as a build artifact named purplemet-report. No extra step required.

After the run completes:

• Open the pipeline run → Summary tab
• Scroll to Published (or Related in newer UIs)
• Download the purplemet-report artifact

Format html

With format: html, the CLI writes purplemet-report.html to the pipeline workspace (not stdout). Add a PublishPipelineArtifact step to surface it:

- task: PurplemetAnalyze@1
  inputs:
    apiToken: $(PURPLEMET_API_TOKEN)
    targetUrl: 'https://your-app.example.com'
    format: 'html'
    failSeverity: 'high'

- task: PublishPipelineArtifact@1
  condition: always()   # publish even if the gate fails
  inputs:
    targetPath: '$(System.DefaultWorkingDirectory)/purplemet-report.html'
    artifact: 'purplemet-report-html'
    publishLocation: 'pipeline'

Download from Summary → Published, then open the file locally in a browser. Azure DevOps does not render HTML inline — use the HTML Report Publisher extension if you want a dedicated tab inside the run.

Exit Codes

Complete Example

trigger:
  - main

pool:
  vmImage: 'ubuntu-latest'

stages:
  - stage: Build
    jobs:
      - job: BuildAndTest
        steps:
          - script: make build && make test

  - stage: Security
    dependsOn: Build
    jobs:
      - job: Analyze
        steps:
          - task: PurplemetAnalyze@1
            inputs:
              apiToken: $(PURPLEMET_API_TOKEN)
              targetUrl: 'https://staging.example.com'
              failSeverity: 'high'
              timeout: '600000'

  - stage: Production
    dependsOn: Security
    # Deploy only if Security passed AND we are on main
    condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
    jobs:
      - deployment: Prod
        environment: production
        strategy:
          runOnce:
            deploy:
              steps:
                - script: ./deploy.sh production

Troubleshooting

Documentation

See the full Azure DevOps integration guide for advanced examples, security gates, and detailed troubleshooting.