microsoft / microsoft/security-devops-azdevops
Microsoft security DevOps task is breaking when we use 3rd party modules/private repositories.
Nobody has claimed this yet.
- Dominant language
- TypeScript
- Stars
- 86
- Forks
- 22
- PR merge metrics
- No merged PRs in 30d
Description
Configured microsoft security DevOps task but it is breaking when we use 3rd party modules/private repositories.
Below is the Yaml i was using.
- task: MicrosoftSecurityDevOps@1
displayName: 'Microsoft Security DevOps'
inputs:
categories: 'IaC'
publish: true
artifactName: CodeAnalysisLogs
Tried with a private repository and it is breaking with the below error. Is there a way to skip for 3rd party modules?
module "lz_vending" {
source = "Azure/lz-vending/azurerm"
version = "3.1.0"
}
Error
Error running terrascan job: 1 of 1Microsoft Security DevOps | |
-- | -- | --
| GuardianErrorExitCodeException: terrascan completed with an Error exit code: 2. Unexpected exit code. Please check https://docs.accurics.com/projects/accurics-terrascan/en/latest/ for more information.Microsoft Security DevOps | |
| Error running tool 1 of 2: terrascanMicrosoft Security DevOps | |
| Error running terrascan job: 1 of 1Microsoft Security DevOps | |
| GuardianErrorExitCodeException: terrascan completed with an Error exit code: 2. Unexpected exit code. Please check https://docs.accurics.com/projects/accurics-terrascan/en/latest/ for more information.Microsoft Security DevOps | |
| BreakException: Guardian detected one or more breaking results.
Is there a way to fix or skip this?
Any help is appreciated.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start by reproducing the Azure DevOps pipeline using the shown MicrosoftSecurityDevOps@1 YAML and a private Terraform module such as Azure/lz-vending/azurerm. Investigate how the IaC Terrascan job handles third-party or private modules and define whether the expected result is successful scanning or an explicit skip without a breaking error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- azure, terraform, typescript
- Domain
- devops, infrastructure, security
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 30/100