Allow Direct Path Specification for Bicep Files in MicrosoftSecurityDevOps@1 Task
Nobody has claimed this yet.
Assessment
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Newbie friendliness
- 45/100
Research direction
Start from the MicrosoftSecurityDevOps@1 task input handling and its IaC/Bicep scan entry point. Trace how checked-out files are selected, then define the requested direct-path input using the pipeline's bicepFile parameter. Done means the task can scan one specified Bicep file without scanning unrelated checked-out files.
Written by the indexing model from the issue text.
Description
I am using the MicrosoftSecurityDevOps@1 task in my Azure pipeline to scan Infrastructure as Code (IaC) files. My repository contains multiple Bicep modules, each located in their own subfolders. Here is a snippet of my pipeline configuration:
parameters:
- name: serviceConnection
type: string - name: resourceGroup
type: string - name: bicepFile
type: string - name: parametersFile
type: string
jobs:
- job:
displayName: "Scan IaC Templates"
pool:
vmImage: windows-latest
steps:- checkout: azure.infra.bicep
- task: MicrosoftSecurityDevOps@1
displayName: MSDO IAC
inputs:
categories: 'IaC'
The folder structure of my repository is as follows:
repo_name/
└── modules/
└── module-name/
└── module-name.bicep
Issue: Currently, there is no option to specify a direct path to a specific Bicep file within the MicrosoftSecurityDevOps@1 task. As a result, the tool attempts to scan absolutely all files being checked out, while I need to scan only the Bicep file specified in my parameters. This limitation makes it challenging to target individual Bicep files for scanning in repositories with complex structures and multiple modules.
Proposal: Introduce an option to specify a direct path to a specific Bicep file in the MicrosoftSecurityDevOps@1 task. This feature would allow for more targeted scanning of individual Bicep files.
- Dominant language
- TypeScript
- Stars
- 86
- Forks
- 22
- PR merge metrics
- No merged PRs in 30d
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
More from microsoft/security-devops-azdevops
-
Difficulty 1/5 Under an hour Newbie friendliness 68/100
-
area:task area:tools status:waiting-on-author type:docs type:question
microsoft/security-devops-azdevops#169 · 1 comment · 1 assignee ·
-
Which Defender CLI binary should be used in CI/CD pipelines — `aka.ms` or the DevOps CDN endpoint? Open
Difficulty 5/5 Over a week Newbie friendliness 35/100
microsoft/security-devops-azdevops#166 · 2 comments · 1 reaction ·
-
area:task area:tools status:team-review type:feature
microsoft/security-devops-azdevops#164 · 2 reactions · 2 assignees ·
-
area:task area:tools status:team-review type:docs type:feature
microsoft/security-devops-azdevops#163 · 17 comments · 1 assignee ·
All issues in microsoft/security-devops-azdevops
Similar issues
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
safetrustcr/dApp-SafeTrust#426 ·
-
area:workflow bug ready-for-agent
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
fil-donadoni/tolaria#4409 ·
-
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
Fission-AI/OpenSpec#1960 ·
-
Add dependabot Open
Difficulty 2/5 1-3 hours Newbie friendliness 70/100
-
Difficulty 2/5 1-3 hours Newbie friendliness 75/100
corsairdev/corsair#1764 ·