Azure DevOps Server Setup for Local Code Scanning

​

Prerequisites

• Personal Access Token (PAT): Create one in your CybeDefend profile and store it as CYBEDEFEND_PAT in Azure DevOps.
• Agent Permissions: Ensure your self-hosted agent can install or run the CybeDefend CLI.
• Azure DevOps Access: Sufficient rights to modify your pipeline definition.

​

Example azure-pipelines.yml

trigger:
  - main

pool:
  vmImage: 'ubuntu-latest'

steps:
  - checkout: self
  - script: |
      curl -L https://github.com/CybeDefend/cybedefend-cli/releases/download/v1.0.0/cybedefend-linux-amd64 -o cybedefend
      chmod +x cybedefend
      sudo mv cybedefend /usr/local/bin/
    displayName: 'Install CybeDefend CLI'

  - script: |
      cybedefend scan --dir . \
        --ci \
        --project-id $(CYBEDEFEND_PROJECT_ID)
    displayName: 'Run CybeDefend Scan'
    env:
      CYBEDEFEND_PAT: $(CYBEDEFEND_PAT)

​

Explanation

1. checkout: self
   Ensures your code is present on the build agent.
2. Download & Install
   Grabs the CLI binary, grants permissions, and moves it to /usr/local/bin.
3. Run the Scan
   The --ci flag keeps the output minimal. We rely on environment variables for the API key and project ID.

​

Viewing Scan Results

1. CLI Output
   The console output shows a summary of detected issues.
2. CLI “results”
   If you want more detail in the pipeline logs, add a step:
   - script: |
       cybedefend results --project-id $(CYBEDEFEND_PROJECT_ID) --all --output sarif
     displayName: 'Fetch Results in SARIF'
   
3. CybeDefend Dashboard
   Login to your CybeDefend account to see a full vulnerability breakdown.