Skip to content

Commit

Permalink
Remove variable instructions from main snippet as they are separate now
Browse files Browse the repository at this point in the history
  • Loading branch information
armchairlinguist committed Jan 17, 2025
1 parent 0950db3 commit 5ed5dea
Showing 1 changed file with 0 additions and 17 deletions.
17 changes: 0 additions & 17 deletions src/components/code_snippets/_azure-semgrep-app-sast.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -23,20 +23,3 @@ steps:
env:
SEMGREP_APP_TOKEN: $(SEMGREP_APP_TOKEN)
```
### Setting environment variables in Azure Pipelines
Semgrep minimally requires setting the variable SEMGREP_APP_TOKEN in order to report results to the platform, and other variables may be helpful as well.
1. Set up a [variable group](https://learn.microsoft.com/en-us/azure/devops/pipelines/library/variable-groups?view=azure-devops&tabs=classic) called `Semgrep_Variables`.
2. Set `SEMGREP_APP_TOKEN` in the variable group, following the steps for [secret variables](https://learn.microsoft.com/en-us/azure/devops/pipelines/process/set-secret-variables?view=azure-devops&tabs=yaml%2Cbash#set-a-secret-variable-in-a-variable-group). The variable is mapped into the `env` in the provided config.
3. Optional: Add these environment variables to the group if you aren't seeing hyperlinks to the code that generated a finding, or if you are not receiving PR or MR comments. These variables are not sensitive and do not need to be secret variables. Review the use of these variables at [Environment variables for creating hyperlinks in Semgrep AppSec Platform](https://semgrep.dev/docs/semgrep-ci/ci-environment-variables#environment-variables-for-creating-hyperlinks-in-semgrep-appsec-platform).

* `SEMGREP_REPO_NAME`
* `SEMGREP_REPO_URL`
* `SEMGREP_BRANCH`
* `SEMGREP_COMMIT`
* `SEMGREP_JOB_URL`

4. Set variables for diff-aware scanning. The provided config sets `SEMGREP_PR_ID` to the system variable `System.PullRequest.PullRequestId` and `SEMGREP_BASELINE_REF` to `origin/master` within the `script` section of the config. The value of `SEMGREP_BASELINE_REF` is typically your trunk or default branch, so if you use a different branch than master, update the name accordingly. as `main` or `master`.
* If you prefer not to implement diff-aware scanning, you can skip setting these variables and remove the `elif` section of the `script` step.

0 comments on commit 5ed5dea

Please sign in to comment.