azure-pipelines-example.yml

trigger:
- main

pr:
- main

pool:
  vmImage: 'ubuntu-latest'

stages:
- stage: Test
  jobs:
  - job: SecurityScan
    steps:
    - checkout: self

    - script: |
        wget -c https://downloads.nightvision.net/binaries/latest/nightvision_latest_linux_amd64.tar.gz -O - | tar -xz
        sudo mv nightvision /usr/local/bin/
        python -m pip install semgrep --user
      displayName: 'Install NightVision and dependencies'

    - script: |
        nightvision swagger extract ./ -t $NIGHTVISION_TARGET --lang spring || true
        if [ ! -e openapi-spec.yml ]; then
          cp backup-openapi-spec.yml openapi-spec.yml
        fi
      displayName: 'Extract API documentation from code'
      env:
        NIGHTVISION_TOKEN: $(NIGHTVISION_TOKEN)
        NIGHTVISION_TARGET: 'javaspringvulny-api'
        NIGHTVISION_APP: 'javaspringvulny-api'
        NIGHTVISION_AUTH: 'javaspringvulny-api'

    - script: |
        docker-compose up -d
        sleep 10
      displayName: 'Start the app'

    - script: |
        nightvision scan -t $NIGHTVISION_TARGET -a $NIGHTVISION_APP --auth $NIGHTVISION_AUTH > scan-results.txt
        nightvision export sarif -s "$(head -n 1 scan-results.txt)" --swagger-file openapi-spec.yml
      displayName: 'Scan the API'
      env:
        NIGHTVISION_TOKEN: $(NIGHTVISION_TOKEN)
        NIGHTVISION_TARGET: 'javaspringvulny-api'
        NIGHTVISION_APP: 'javaspringvulny-api'
        NIGHTVISION_AUTH: 'javaspringvulny-api'

    # Download and prepare nightvision_azure_importer script
    - script: |
        wget -O nightvision_azure_importer.py https://raw.githubusercontent.com/jxbt/nightvision_azure_importer/main/nightvision_azure_importer.py
        wget -O nightvision_azure_importer_requirements.txt https://raw.githubusercontent.com/jxbt/nightvision_azure_importer/main/requirements.txt
        sudo apt-get update
        sudo apt-get install -y python3-pip
        python3 -m pip install -r nightvision_azure_importer_requirements.txt
      displayName: 'Prepare Python Script and Dependencies'

    # Execute the Python script to import SARIF into Azure DevOps work items
    - script: |
        python3 nightvision_azure_importer.py --organization $organization --project $project --patoken $pa_token --sarif results.sarif
      displayName: 'Import SARIF to Azure DevOps'
      env:
        organization: $(ORGANIZATION_NAME)
        project: $(PROJECT_NAME)
        pa_token: $(PERSONAL_ACCESS_TOKEN)