Azure Pipelines integration

Overview

Snyk enables security across the Microsoft Azure ecosystem, including for Azure Pipelines, automatically finding and fixing application and container vulnerabilities.

Ready-to-use tasks for Azure Pipelines can be quickly inserted directly from the Azure interface, enabling you to customize and automate your pipelines with no extra coding. Amongst the tasks included is the Snyk task.

You can include the Snyk task in your pipeline to test for security vulnerabilities and licensing issues as part of your routine work; in this way, you can test and monitor your application dependencies and container images for security vulnerabilities. Once tested, you can review and work with results directly from the Azure Pipelines output, as well as from the Snyk interface.

Snyk support

Our Snyk Security Scan task is available for all languages supported by Snyk and Azure DevOps.

Azure Pipelines: how it works

Once the Snyk Security Scan task has been added to a pipeline, each time the pipeline runs, the Snyk task does the following:

Scan

Scans application dependencies or container images for vulnerabilities and licensing issues and lists them.
If Snyk finds vulnerabilities, it does one of the following (based on your configuration):
- Fails the pipeline
- Lets the pipeline complete the build

Monitor

Optionally, if the pipeline continues (the Snyk task completes successfully) and monitorOnBuild is set to true in the task, then Snyk saves a snapshot of the project dependencies on snyk.io, where you can see the dependency tree with all of the issues and be alerted if and when new issues are found in the dependencies.

Install the Snyk extension for your Azure pipelines

To start using our task as part of your pipeline build, first install the extension on your Azure DevOps instance per organization, from the Marketplace.

Prerequisites:

Create a Snyk account.
Ensure you are an owner of or an administrator for this account.

Steps:

Access your Snyk account.
For free plans, go to your General Account Settings and find, copy and save your personal API authentication token on the side.
For paid plans, navigate to the organization you’d like to integrate with, and then go to Settings to create a new service account token. Copy and save it on the side.
Access your Azure DevOps account and navigate to Extensions -> Browse marketplace.
Search for the Snyk Security Scan extension, click Get it free .
Create a new Service Connection in your project via Project Settings —> Pipelines —> Service Connections
Select "Snyk Authentication" service connection:
In the Snyk Authentication service connection form, enter the Server URL and the Snyk API Token along with a Service connection name:
Click on Save, ensuring the new service connection appears in your list of service connections.

Add the Snyk Security Task to your pipelines

Prerequisites

Ensure you have a pipeline within the repository for the code you’d like to test.
If you created a pipeline with the Azure Repos wizard, this file is called azure-pipelines.yml.
If this repository has multiple service connections, check with your Snyk admin which to use for your pipeline.
If you want to add your Dockerfile for additional base image data when testing your container, ensure the image has first been built.

Steps:

Add the Snyk Security Scan task when you create your pipeline or while editing an existing one. See the Azure Pipelines documentation for more information Azure Pipelines and tasks.
From Azure, access the pipeline that you’d like to scan for vulnerabilities, open it for editing and ensure that a Build step is included just before the point at which you’d like to insert the Snyk task.
Open the assistant, search for the Snyk Security Scan task and click it. The configuration panel opens on top of the assistant.
Complete the fields in the configuration. Find full details about the parameters in this article: Snyk Security Scan task parameters and values.

Warning

If the Fail build if Snyk finds issue option is checked, then if the build fails, the pipeline will not be pushed to Snyk even if the Run Snyk monitor after test? option is selected.

If you remove the checkmark from the Fail build if Snyk finds issue option, the Snyk task tests for vulnerabilities, but does not cause the pipeline job to fail.

Tip

When testing a container image, you can specify the path to the Dockerfile with the dockerfilePath property in order to receive additional information about issues in your base image.

To add your Dockerfile for additional base image data when testing your container, ensure the image has first been built.
Place your cursor inside the pipeline, ensuring you place it before a deployment step, such as npm publish or docker push.

Tip

You can have multiple instances of the Snyk Security Scan task within your pipeline. This might be useful, for example, if you have multiple project manifest files you want to test or if you want to test both the application and the container images.
From the configuration panel, click Add. The task is inserted to your pipeline where your cursor was placed, appearing similar to the following:
```
- task: SnykSecurityScan@0
  inputs:
    testType: 'app'
    monitorOnBuild: true
    failOnIssues: true
```
Once included in your pipeline, the task runs each time the pipeline runs, and the results appear in the Azure Pipelines output view - similar to the following:

Note

If the Snyk task fails the build, an error message appears in the results indicating that the build failed due to snyk test.

Snyk Security Scan task parameters and values

This section describes:

The Snyk task parameters for Azure Pipelines integration, their parallel configuration fields (from the configuration panel in Azure Pipelines) and their valid values
An example of the Snyk task for npm
An example of the Snyk task for a container image

Parameters and values

The Snyk task parameters, their parallel configuration fields (from the configuration panel in Azure Pipelines) and their valid values are as detailed in the following table:

Configuration field

Parameter

Description

Required

Default

Type

Notes

Snyk API token

serviceConnectionEndpoint

The Azure DevOps service connection endpoint where your Snyk API token is defined. Your admin defines this within your Azure DevOps project settings, assigning it with a unique string in order to differentiate between different connections.

The configuration panel displays all available Snyk service connections from a dropdown list like the following:

If multiple Snyk service connections are available from the dropdown list, ask your administrator which to use for the pipeline you’re working with.

Yes

none

String / Azure Service Connection Endpoint of type SnykAuth / Snyk Authentication

What do you want to test?

testType

Determines which dynamic fields to display as described in the rest of this table.

Yes

"application"

string: "app" or "container"

Container Image Name

dockerImageName

The name of the container image to test.

Yes, if container image test

none

string

This dynamic field appears when What do you want to test is set to Container Imager

Path to Dockerfile

dockerfilePath

The path to the Dockerfile corresponding to the dockerImageName

Yes, if container image test

none

string

This dynamic field appears when What do you want to test is set to Container Imager

Custom path to manifest file to test

targetFile

Applicable to application type tests only. The path to the manifest file to be used by Snyk. Should only be provided if non-standard.

none

string

This dynamic field appears when What do you want to test is set to Application

Testing severity threshold

severityThreshold

The severity-threshold to use when testing. By default, issues of all severity types will be found.

No. If not cofigured, the default severity is set to Low.

"low"

string: "low" or "medium" or "high"

Run Snyk monitor after test?

monitorOnBuild

Whether or not to capture the dependencies of the application / container image and monitor them within Snyk.

Yes

true

boolean

Fail build if Snyk finds issues

failOnIssues

This specifies if builds should be failed or continued based on issues found by Snyk.

Yes

true

boolean

Project name in Snyk

projectName

A custom name for the Snyk project to be created on snyk.io

none

string

Organization name (or ID) in Snyk

organization

Name of the Snyk organisation name, under which this project should be tested and monitored

none

string

Test (Working) Directory

testDirectory

Alternate working directory. For example, if you want to test a manifest file in a directory other than the root of your repo, you would put in relative path to that directory.

none

string

Additional command-line args for Snyk CLI (advanced)

additionalArguments

Additional Snyk CLI arguments to be passed in. Refer to the Snyk CLI help page for information on additional arguments.

none

string

Use the Snyk CLI tool option syntax, as described in our CLI full reference.

Example of a Snyk task to test a node.js (npm) based application

This section displays examples of Snyk Security Scan task configurations and [parameters when testing a Node.js (npm) application.

The configuration panel appears as follows:

Click add and it is added to your pipeline as follows:

Simple Application Testing Example

- task: SnykSecurityScan@0
  inputs:
    serviceConnectionEndpoint: 'mySnykToken'
    testType: 'app'
    monitorOnBuild: true
    failOnIssues: true

Example of a Snyktask for a container image pipeline

The following is an example of the Snyk Security Scan task within the script for a container image pipeline.

When populated with the most common settings, the configuration panel in Azure appears similar to the following:

Following is an example of the same configuration once you've added it to your pipeline.

Simple Container Image Testing Example

- task: SnykSecurityScan@0
  inputs:
    serviceConnectionEndpoint: 'mySnykAuth'
    testType: 'container'
    dockerImageName: 'my-container-image-name'
    dockerfilePath: 'Dockerfile'
    monitorOnBuild: true
    failOnIssues: true

Articles in this section

Overview

Azure Pipelines: how it works

Install the Snyk extension for your Azure pipelines

Add the Snyk Security Task to your pipelines

Warning

Tip

Tip

Note

Snyk Security Scan task parameters and values