Code Scanning a GitHub Repository using GitHub Advanced Security within an Azure DevOps Pipeline by Kevin Alwell

GitHub Advanced Security now supports the ability to analyze your code for semantic vulnerabilities from within your third-party CI pipelines. Previously, this capability was available exclusively with GitHub Actions. In this post, I will walk you through a simple implementation of GitHub Advanced Security Code Scanning in an Azure DevOps CI pipeline with a node application using the YAML editor. The Code Scanning results will resurface after the scan back in your GitHub repository under the Security tab for your developers to review and remediate.If your organization does not have GitHub Advanced Security enabled, you will not see “Code scanning alerts” or “Detected secrets”.

Rather than leveraging the native GitHub Actions workflow with the standard “Set Up Workflow” experience we are going to use an Azure DevOps pipeline.

Navigate to your Azure DevOps pipeline to begin integrating CodeQL.

The Azure Pipelines Agent I am using is ephemeral so I install....

Author

Magdalena Jarzębska

• BlogMay 2, 2022Lupo - Malware IOC Extractor and Debugging module for Malware Analysis Automation
• BlogMay 2, 2022DDexec - a technique to run binaries filelessly and stealthily on Linux using dd to replace the shell with another process
• BlogApril 28, 2022ADReaper - A fast enumeration tool for Windows Active Directory Pentesting written in Go
• BlogApril 27, 2022Shhhloader - SysWhispers Shellcode Loader