Overview:

In this blog I will demonstrate how to integrate the GitHub Advance Security Code scanning capability into the Azure DevOps pipelines. I will provide example of the Repository that can guide you or your developer working to integrate code scanning into Azure DevOps . I will walk you through a simple implementation of GitHub Advanced Security Code Scanning in an Azure DevOps CI pipeline with a node application using the YAML editor. The Code Scanning results will be available in your GitHub Repository under the security tab for your developer to review.

Note: If your organization does not have GitHub Advanced Security enabled, you will not see “Code scanning alerts” .

Steps to Do :

1. Download the latest CodeQL dependencies on your Agent.
2. Give CodeQL Access to your Repository.
3. Initialize the CodeQL and create a Database.
4. Scan your Application.
5. Upload results to GitHub.
6. Review the results.

Downloading the latest CodeQL Dependencies for you Agent.

Using Wget and targeting the latest Linux release I can download all necessary files to a new Codeql directory . I also change permission for the downloaded file before I run it . I added following script to the bottom of my pipeline.

– script: |

wget https://github.com/github/codeql-action/releases/download/codeql-bundle-20200826/codeql-runner-linux

chmod +x codeql-runner-linux

displayName: ‘Get latest CodeQL package. Install on Agent.’

Give the Access to your Repository

Create a Personal Access Token or use GitHub Apps for authentication. I am using a PAT and saving it as a pipeline variable as $GITHUB_PAT. Initialize the CodeQ Executable and create a CodeQL database for the language detected. I added the following script to the bottom of my pipeline.

– script: |

./codeql-runner-linux init

–repository CanarysPlayground/ScanGHfromAzDO

–github-url https://github.com

–github-auth $(GITHUB_PAT)

–config-file .github/codeql/codeql-config.yml

displayName: ‘Initialize CodeQL Executable and create a CodeQL database’

Now I want to populate the CodeQL runner databases, analyze them, and upload the results to GitHub. I added the following script to the bottom of my pipeline

– script: |

./codeql-runner-linux analyze

–repository CanarysPlayground/ScanGHfromAzDO

–github-url https://github.com

–github-auth $(GITHUB_PAT)

–commit $(BUILD_SOURCEVERSION)

–ref $(Build.SourceBranch)

displayName: ‘Populate the CodeQL runner databases, analyze them, and upload the results to GitHub.’

If successful, you should be able to navigate back to your repository security tab under code scanning to view the results of your scan.

Conclusion:

This blog will help you integrating the GitHub Advanced Security Code Scanning capability into your Azure DevOps pipeline and the Code Scanning results will be available in your GitHub Repository under the security tab for your developer to review.