azure-pipelines.yml

# Example Continuous Delivery Pipeline with Fortify on Premise (SCA/SSC) and/or Fortify on Demand (FOD) support

trigger:
  batch: true
  branches:
    include:
    - main
    - features/*
    - releases/*
    exclude:
    - experimental/*
  paths:
    exclude:
    - InsecureProductService/
    - InsecurePaymentService/
    - InsecureShippingService/
    - README.md
    - bin/*
    - lib/*
    - etc/*
    - media/*

pr:
  branches:
    include:
    - main
  paths:
    exclude:
    - InsecureProductService/
    - InsecurePaymentService/
    - InsecureShippingService/
    - README.md
    - bin/*
    - lib/*
    - etc/*
    - media/*
  
variables:
  #
  # In order for the Pipeline to execute successfully you should create the following variables in the Pipeline UI (or uncomment and hard-code here)
  # 
  # ADOBaseURL: 'Your Azure DevOps Base URL'
  # ADOPAT: 'Your Azure DevOps Personal Access Token'
  # ADOProject: 'IWA.NET'
  # AppUrl: 'URL of deployed application'
  # AzureDBServer: 'Hostname of database server'
  # AzureDBName: 'Database Name'
  # AzureDBUser: 'Database User Login'
  # AzureDBPassword: ' Database Password'
  # FoDApplicationName: 'IWA.NET'
  # FoDBaseUrl: 'https://api.emea.fortify.com'
  # FoDBugTrackerVersion: '4.2'
  # FoDClientId: 'Your FoD API Client Id'
  # FoDClientSecret: 'You FoD API Client Secret'
  # FoDParentRelease: 'main'
  # FoDReleaseId: 'Your FOD Release Id'
  # FoDUsername: 'You FoD username'
  # FoDTenant: 'Your FoD tenant'
  # ScanCentralCtrlUrl: 'Your ScanCentral Controller URL'
  # ScanCentralClientToken: 'Your ScanCentral Client Token'
  # ScanCentralNotificationEmail: 'Your Email Address'
  # ScanCentralDASTApiUrl: 'Your ScanCentral DAST API URL'
  # ScanCentralDASTCICDAuthToken: 'Your ScanCentral DAST CICD Authentication Token'
  # ScanCentralDASTCICDIdentifier: 'Your ScanCentral DAST CICD Identifier'
  # SSCUrl: 'Your SSC URL'
  # SSCApplicationName: 'IWA.NET'
  # SSCApplicationVersion: 'Your SSC application version'
  # SSCAuthToken: 'Your SSC CI Authentication Token'
  # ScanCentralVersion: 'The version of ScanCentral being used'

  solution: '**/*.sln'
  vsDevCmd: 'C:\Program Files\Microsoft Visual Studio\2022\Enterprise\Common7\Tools\VsDevCmd.bat' # location of visual studio VsDevCmd batch file on Agent
  buildConfiguration: 'Debug'
  publishProfile: 'iwanet - Web Deploy'
  fortifyUploadDir: 'fod' # directory to be created containing all dependencies uploaded to FOD for static analysis
  FoDConnection: 'FODAzureDevOps' # the name of Fortify on Demand service connection configured in Project Settings
  SSCConnection: 'SSCAzureDevOps' # the name of the Fortify SSC "generic" connection configured in Project Settings
  ScanCentralLogsDir: 'C:\Users\VssAdministrator\AppData\Local\Fortify\scancentral-$(ScanCentralVersion)\log' # where ScanCentral logs will be written to

  # get the source branch name
  ${{ if startsWith(variables['Build.SourceBranch'], 'refs/heads/features/') }}:
    branchName: $[ replace(variables['Build.SourceBranch'], 'refs/heads/', '') ]
  ${{ if startsWith(variables['Build.SourceBranch'], 'refs/heads/releases/') }}:
    branchName: $[ replace(variables['Build.SourceBranch'], 'refs/heads/', '') ]
  ${{ if startsWith(variables['Build.SourceBranch'], 'refs/pull/') }}:
    branchName: $[ replace(variables['System.PullRequest.TargetBranch'], 'refs/heads/', '') ]
  ${{ if eq(variables['Build.SourceBranch'], 'refs/heads/main') }}:
    branchName: 'main'
  isPR: $[startsWith(variables['Build.SourceBranch'], 'refs/pull/')]
  isMaster: $[eq(variables['Build.SourceBranch'], 'refs/heads/main')]

stages:

  #
  # Build and Unit Test the application components
  #
- stage: BuildAndUnitTest
  displayName: 'Build and Unit Test'
  pool:
    # use Azure DevOps provided agent
    vmImage: 'ubuntu-latest'
  jobs:
    # Build web application component
  - job: Web
    steps:   
    - task: UseDotNet@2
      inputs:
        version: '6.x'
    - task: DotNetCoreCLI@2
      displayName: 'dotnet build'
      inputs:
        command: 'build'
        configuration: $(buildConfiguration)
        projects: '$(solution)'
        
    - task: PublishPipelineArtifact@1
      inputs:
        targetPath: '$(build.artifactStagingDirectory)'
        artifact: 'InsecureWebApp-Web'
        publishLocation: 'pipeline'    

#
# Static Application Security Testing with ScanCentral SAST (on premise)
#
- stage: ScanCentral_SAST
  displayName: 'ScanCentral SAST'
  condition: eq(variables['UseScanCentralSAST'], 'true')
  dependsOn: BuildAndUnitTest
  pool:
    # use Azure DevOps provided agent
    vmImage: 'windows-2022'
    # or uncomment to use a local Agent pool named 'Fortify' with Fortify software installed
    # name: Fortify
  jobs:
  - job: UploadAndScan
    displayName: 'Upload and Scan'
    steps:
    - task: UseDotNet@2
      inputs:
        version: '6.0.202'

    - task: DotNetCoreCLI@2
      displayName: 'dotnet build'
      inputs:
        command: 'build'
        configuration: $(buildConfiguration)
        projects: '$(solution)'

    - task: BatchScript@1
      displayName: 'Set Visual Studio environment'
      inputs:
        filename: "$(vsDevCmd)"
        modifyEnvironment: true

    - task: FortifyScanCentralSAST@7
      inputs:
        scanCentralCtrlUrl: '$(ScanCentralCtrlUrl)'
        scanCentralClientToken: '$(ScanCentralClientToken)'
        sscUrl: '$(SSCUrl)'
        sscCiToken: '$(SSCAuthToken)'
        uploadToSSC: true
        applicationName: '$(SSCApplicationName)'
        applicationVersion: '$(SSCApplicationVersion)'
        buildTool: 'msbuild'
        buildFile: 'IWA.NET.sln'
        email: '$(ScanCentralNotificationEmail)'
        block: true
        outputFile: 'IWA.NET.fpr'
        logFile: 'IWA.NET.log'
        overwrite: true
    - task: PublishPipelineArtifact@1
      inputs:
        targetPath: '$(Build.SourcesDirectory)/IWA.NET.fpr'
        artifact: 'Fortify Results (FPR)'
        publishLocation: 'pipeline'

#
# Static Application Security Testing with Fortify on Demand
#
- stage: FoD_SAST
  displayName: 'FoD SAST'
  condition: eq(variables['UseFoD'], 'true') 
  dependsOn: BuildAndUnitTest
  pool:
    # use Azure DevOps provided agent
    vmImage: 'windows-2022'
    # or uncomment to use a local Agent pool named 'Fortify'
    #name: Fortify
  jobs:
  - job: UploadAndScan
    displayName: "Upload and Scan"
    steps:
     - task: UseDotNet@2
      displayName: 'Set DotNet environment'
      inputs:
        version: '6.0.202'
    - task: DotNetCoreCLI@2
      inputs:
        command: build
        projects: '$(solution)'
        configuration: '$(buildConfiguration)'     

    - task: JavaToolInstaller@0
      inputs:
        versionSpec: "11"
        jdkArchitectureOption: x64
        jdkSourceOption: PreInstalled
    - task: BatchScript@1
      displayName: 'Set Visual Studio environment'
      inputs:
        filename: "$(vsDevCmd)"
        modifyEnvironment: true

    - task: FortifyOnDemandStatic@8
      # Carry out a Fortify on Demand static assessment
      inputs:
        FortifyProjects: '.'
        FodConnection: '$(FoDConnection)'
        ReleaseOptions: '0'
        ReleaseId: $(FoDReleaseId)
        EntitlementSelection: '1'
        EntitlementPreference: '1'
        OverrideScanSettings: '2'
        InProgressScanActionType: '2'
        RemediationScanPreference: '2'
        BuildType: 'msbuild'
        BuildFile: 'IWA.NET.sln'
        PolicyFailAction: '0'
        PollingInterval: 5

# 
# Deploy the application
#
- stage: DeployToAzure
  condition: eq(variables.isMaster, true)
  #condition: always()
  dependsOn: 
    - BuildAndUnitTest
    - ScanCentral_SAST
    - FoD_SAST
  displayName: 'Deploy to Azure'
  pool:
    # use Azure DevOps provided agent
    vmImage: 'windows-2019'
    # use local Agent pool named 'Fortify'
    #name: Fortify
  jobs: 
  - job: DownloadAndDeploy
    displayName: 'Download and Deploy'
    steps:    
    - task: DownloadPipelineArtifact@2
      inputs:
        buildType: 'current'
        artifactName: 'InsecureWebApp-DB'
        itemPattern: '**/*'
        targetPath: '$(Pipeline.Workspace)'    
    - task: SqlAzureDacpacDeployment@1
      inputs:
        azureSubscription: 'iwa-arm'
        AuthenticationType: 'connectionString'
        ConnectionString: 'Data Source=tcp:$(AzureDBServer),1433;Initial Catalog=$(AzureDBName);User Id=$(AzureDBUser);Password=$(AzureDBPassword)'
        deployType: 'SqlTask'
        SqlFile: '$(Pipeline.Workspace)/InsecureWebApp.sql'
        IpDetectionMethod: 'AutoDetect'
    - task: DownloadPipelineArtifact@2
      inputs:
        buildType: 'current'
        artifactName: 'InsecureWebApp-Web'
        itemPattern: '**/*'
        targetPath: '$(Pipeline.Workspace)'    
    - task: AzureRmWebAppDeployment@4
      inputs:
        ConnectionType: 'AzureRM'
        azureSubscription: 'iwa-arm'
        appType: 'webApp'
        WebAppName: 'iwanet'
        packageForLinux: '$(Pipeline.Workspace)/InsecureWebApp.zip'
        #JSONFiles: 'appsettings.json'

#
# Dynamic Application Security Testing with ScanCentral DAST (on-premise)
#        
- stage: ScanCentral_DAST
  displayName: 'ScanCentral DAST'
  condition: eq(variables['UseScanCentralDAST'], 'true')
  dependsOn: DeployToAzure
  pool:
    # use Azure DevOps provided agent
    vmImage: 'windows-2019'
    # use local Agent pool named 'Fortify'
    #name: Fortify
  jobs:
  - job: RunScan
    displayName: 'Run Scan'
    steps:   
    - task: FortifyScanCentralDAST@7
      inputs:
        scanCentralDastApiUrl: '$(ScanCentralDASTApiUrl)'
        scanCentralCiCdToken: '$(ScanCentralDASTCICDIdentifier)'
        sscCiToken: '$(ScanCentralDASTCICDAuthToken)'

#        
# Dynamic Application Security Testing with Fortify on Demand
#        
- stage: FoD_DAST
  displayName: 'FoD DAST'
  # renamed from UseFOD because we have not tested FOD DAST currently
  condition: eq(variables['UseFODXXX'], 'true')
  dependsOn: DeployToAzure
  pool:
    # use Azure DevOps provided agent
    vmImage: 'windows-2019'
    # use local Agent pool named 'Fortify'
    #name: Fortify
  jobs:
  - job: RunScan
    displayName: 'Run Scan'
    steps:   
    - task: FortifyOnDemandDynamic@7
      # renamed from UseFOD because we have not tested FOD DAST currently
      condition: eq(variables['UseFODXXX'], 'true')
      inputs:
        APIUrl: '${FoDBaseUrl}'
        ReleaseId: '${branchName}'
        APIAuthenticationType: '1'
        APIKey: '${FoDClientId}'
        APISecret: '${FoDClientSecret}'
        EntitlementPreference: '2'
        PurchaseEntitlements: false
        PreferRemediation: false