The Black Duck® Detect for Azure DevOps plugin is architected to seamlessly integrate Black Duck® SCA with Azure DevOps build and release pipelines. Black Duck® Detect makes it easier to set up and scan code bases using a variety of languages and package managers.
The Detect plugin for Azure DevOps supports native scanning in your Azure DevOps environment to run Software Composition Analysis (SCA) on your code.
As a Detect and Azure DevOps user, Detect Extension for Azure DevOps enables you to:
Run a component scan in an Azure DevOps job and create projects and releases in Black Duck SCA through the Azure DevOps job.
After a scan is complete, the results are available on the Black Duck SCA server (for SCA).
Using the Detect Extension for Azure DevOps together with Black Duck SCA enables you to use Azure DevOps to automatically create Black Duck SCA projects from your Azure DevOps projects.
Invoking Detect
It is recommended to invoke Detect from the CI (build) pipeline. Scanning during CI enables Detect to break your application build, which is effective for enforcing policies like preventing the use of disallowed or vulnerable components.
Basic workflow
Using Detect to analyze your code in Azure involves the following basic steps:
Make sure you satisfy system and other requirements.
Download and configure the Detect extension in Azure.
Configure build agent and pipeline.
Configure Black Duck SCA connection.
Configure Detect arguments.
Run pipeline and invoke scan.
Examine the analysis results.