rorixrorix
sign in →

Azure DevOps

Public preview: install the Rorix Security Scanner from the Azure DevOps Marketplace. The published RorixScan@0 task installs Rorix.Cli 0.1.2 on the build agent.

CI gate warning: Rorix.Cli 0.1.2 can return exit code 0 for blocking findings or a missing manifest. The Marketplace task and manual CLI setup below should be advisory-only until a corrected public package is installed and failing-case Azure checks pass. Do not use the current task as a required security gate.

Run Rorix vulnerability scans as part of your Azure DevOps build and release pipelines.

Marketplace Extension

The supported integration path is the Rorix Security Scanner extension from the Azure DevOps Marketplace:

steps:
  - task: RorixScan@0
    inputs:
      apiKey: $(RORIX_API_KEY)
      command: scan
      format: sarif

The extension handles CLI installation and authentication automatically. Store RORIX_API_KEY as a secret variable and see the available inputs (command, format, policyFile, path) in the extension's marketplace listing.

Manual CLI Setup

If you prefer to install the CLI yourself, use the script-based approach below.

Basic Scan

trigger:
  - main
 
pool:
  vmImage: 'ubuntu-latest'
 
steps:
  - task: UseDotNet@2
    inputs:
      packageType: 'sdk'
      version: '9.x'
 
  - script: |
      dotnet tool install -g Rorix.Cli
      rorix login $(RORIX_API_KEY)
      rorix scan
    displayName: 'Rorix Vulnerability Scan'

Policy Enforcement

Use this example only after the corrected public CLI is installed and failing-case Azure checks pass.

trigger:
  - main
 
pool:
  vmImage: 'ubuntu-latest'
 
steps:
  - task: UseDotNet@2
    inputs:
      packageType: 'sdk'
      version: '9.x'
 
  - script: |
      dotnet tool install -g Rorix.Cli
      rorix login $(RORIX_API_KEY)
      rorix scan --policy .rorix.yml --exit-code
    displayName: 'Rorix Policy Check'

After those checks pass, --exit-code can make the pipeline step fail on policy violations. The current public 0.1.2 package does not reliably do so.

Setting Up the API Key

Store your Rorix API key securely using Azure DevOps Variable Groups:

  1. Go to Pipelines then Library in your Azure DevOps project
  2. Create a new Variable Group or use an existing one
  3. Add a variable named RORIX_API_KEY
  4. Click the lock icon to mark it as a secret
  5. Link the Variable Group to your pipeline:
variables:
  - group: 'Rorix'

SBOM Generation

Generate an SBOM artifact as part of your build:

steps:
  - script: |
      dotnet tool install -g Rorix.Cli
      rorix login $(RORIX_API_KEY)
      rorix sbom --format cyclonedx --output $(Build.ArtifactStagingDirectory)/sbom.json
    displayName: 'Generate SBOM'
 
  - task: PublishBuildArtifacts@1
    inputs:
      pathToPublish: '$(Build.ArtifactStagingDirectory)/sbom.json'
      artifactName: 'sbom'
GitHub ActionsDocker