Microsoft Security Code Analysis build tasks will fail ONLY if the tool fails to run That way, your build canįinish and post results before running static analysis tools.Īlways check the 'Continue on Error' option of secure development build tasks.Įven if 1 tool fails, the others can run there are no interdependencies. Tasks after the Publish Build Artifacts step of your build. To run analysis after your build, place the Microsoft Security Code Analysis build See Post-Processing build tasks below for more details on these three tasks. Should you wish to inject a build break (a build task failure) based on security findings by one of the tools, you will need ot add the Post-Analysis build task. And perhaps most importantly, understand that when a security tool finds an issue the build does You will also want to add up to three helpful post-processing tasks after all other tool tasks complete, to produce a summary report of the issues found by the tools you runĪnd to preserve tool log files to the Azure DevOps Server or to a file share. Save tool output log files locally on the build agent. Sanitize and convert user input into (often complex) command-line arguments, and then launch the tool on the build agent. The task will provide defaults where possible.ĭownload the latest (or selected) version of the tool from a restricted nuget feed to the build agent.

Prompt the user for a minimal list of options related to the source and binaries that are to be scanned.

Microsoft security scanner download