Azure Pipelines

This page explains how to integrate HoundDog.ai’s code scanner with Azure DevOps Pipelines.

Defining the Required Secret Variables

First, follow the steps in API Keys to generate a HoundDog.ai organization API key. Then follow the instructions in the Azure documentation to create a variable group in the Azure DevOps Library with a secret variable named HoundDogApiKey using the value of your key.

Defining the Scan Step in azure-pipelines.yml

Next, add a new step in the azure-pipelines.yml file at the root of your repository. Here is an example which scans your repository and uploads the results to the HoundDog.ai Cloud Platform (replace hounddog-variables with the name of your variable group):

azure-pipelines.yml

trigger:
  - main

pool:
  vmImage: ubuntu-latest

variables:
  - group: hounddog-variables

steps:
  - checkout: self
    displayName: Checkout repository

  - script: git checkout -B "${BUILD_SOURCEBRANCH#refs/heads/}"
    displayName: Re-attach HEAD to the source branch

  - script: >
      docker run --pull=always --rm -t -v .:/data
      -e HOUNDDOG_API_KEY=$(HoundDogApiKey)
      hounddogai/hounddog hounddog scan --ci azure-pipelines
    displayName: Run HoundDog.ai Scan

Azure Pipelines checks out a detached HEAD, which makes the scanner record the branch as HEAD. The git checkout -B step re-attaches HEAD to the real branch before the scan. Strip the refs/heads/ prefix from Build.SourceBranch as shown rather than using Build.SourceBranchName, which returns only the last path segment (feature/tools becomes tools) and is merge on pull request builds.

Azure Pipelines is not auto-detected by the scanner, so pass --ci azure-pipelines explicitly.

Blocking the Pipeline Upon Detecting Vulnerabilities

By default the scanner exits with code 0 (success) even when risky dataflows are found. To halt the pipeline upon detecting vulnerabilities, provide the --fail-severity-threshold option to the hounddog scan command:

azure-pipelines.yml

trigger:
  - main

pool:
  vmImage: ubuntu-latest

variables:
  - group: hounddog-variables

steps:
  - checkout: self
    displayName: Checkout repository

  - script: git checkout -B "${BUILD_SOURCEBRANCH#refs/heads/}"
    displayName: Re-attach HEAD to the source branch

  # Fail if a risky dataflow with severity "medium" or higher is detected.
  - script: >
      docker run --pull=always --rm -t -v .:/data
      -e HOUNDDOG_API_KEY=$(HoundDogApiKey)
      hounddogai/hounddog hounddog scan --ci azure-pipelines --fail-severity-threshold=medium
    displayName: Run HoundDog.ai Scan

The scan results still upload to the Cloud Platform before the step fails, so the platform always reflects the latest scan.

To view all available command-line options for the hounddog scan command, see Scanner Configuration.