Azure Pipelines

Azure Pipelines is a cloud CI/CD service that is used to automatically build and test code projects. It combines continuous integration (CI) and continuous delivery (CD) to test and build your code and ship it to any target.

This how-to will provide a basic understanding of how add the Relyance Source Code inspector (SCI) into a typical build job.

Prerequisites:

1. A source code repository needs to be available.
2. The relyance.yaml file needs to be in the source code root directory.
3. Docker needs to be available in the scanning environment.
4. Grab the command line code from Step 2 of the Relyance Source Code Integration settings from your Relyance instance.

See more info about the SCI commands here.

Steps:

1. Login to your Azure DevOps account.
2. Go to your project or create a new one.
3. Click on Pipelines in the left-hand navigation menu.
4. Click the New pipeline button in the upper right-hand corner. It is recommended to create a new pipeline in order not to impact other CI/CD build functions.
5. Choose the source code repository you will be scanning.
6. Click on the Empty job link to start without a template.
7. Ensure your job Agent has Docker installed. It is recommended to use a Linux environment for either the private or hosted job agents.
8. At this point, if your source code needs to be built, run your build commands before doing the Relyance scan.
9. Click the + beside the agent name and add the Command line task.
10. Paste the Step 2 command line from the prerequisites into the script box.
11. The entire Azure Pipelines YAML file should look something like this:

pool:
name: Azure Pipelines
steps:
- task: DockerInstaller@0
displayName: 'Install Docker 17.09.0-ce'

- script: |
docker pull gcr.io/relyance-ext/compliance_inspector:release && docker run --rm -v `pwd`:/repo --env "API_KEY=example:abcdefg0123456789abcdefg0123456789abcdefg"  gcr.io/relyance-ext/compliance_inspector:release
displayName: 'Run Relyance AI'

12. Once done, click on the Save & queue dropdown and select Save.
13. Click Queue to run the pipeline.
14. If there are no errors, you should start to see SCI results in your Relyance tenant.

Appendix:

Source Code Integration Step 2 info:

Example Step 2 Command

1. This command pulls the latest version of the Relyance Source Code Inspector.
2. This command initiates the Relyance Source Code Inspector within a local Docker container, establishing a shared folder and providing the necessary tenant API credentials.