Which Defender CLI binary should be used in CI/CD pipelines — `aka.ms` or the DevOps CDN endpoint?
还没有人认领这个 Issue。
评估
调研方向
从 MicrosoftDefenderCLI@2 任务以及链接的 Defender CLI 安装、语法和 CI/CD 文档开始，然后将文档中说明的 aka.ms 二进制文件与 cli.dfd.security.azure.com 端点进行比较。完成的标准是确定 CDN 是否受支持且稳定、这些二进制文件是否属于独立产品，以及 Azure DevOps 管道应使用哪一个。
由索引模型根据 Issue 内容生成。
描述
We're integrating Defender for Cloud image scanning into our Azure DevOps pipelines. Rather than using the MicrosoftDefenderCLI@2 task (which emits ##[error] for any findings regardless of the break setting), we're invoking the CLI binary directly so we can control exit code handling and surface findings as warnings.
We've discovered there are two different CLI binaries available:
Official (aka.ms) |
DevOps CDN | |
|---|---|---|
| URL | https://aka.ms/defender-cli_linux-x64 |
https://cli.dfd.security.azure.com/public/v2/latest/Defender_linux-x64 |
| Size | ~126 MB | ~24 MB |
| Version | v2.0.3334.114 (as of May 2026) | Unknown — no --version output tested |
| Break flag | --defender-break (critical only) |
--fail-on <severity> (configurable threshold) |
| Documented | Yes — Install, Syntax, CI/CD | No |
| Auth | Token-based (client ID/secret) or connector | Auto-detects SYSTEM_ACCESSTOKEN |
| SHA-256 | 79F4F1EDC1DD2F99193BFFC47464023A450CFEFA03F362D7716A5E51D357B0C1 |
CD31528812D19142DC58DEEA0475E2610F5CC4E4D036F78EAB2FF1243CC5BB3A |
Observations
-
The CDN binary appears purpose-built for CI/CD use. It's significantly smaller (24 MB vs 126 MB), supports a configurable severity threshold (
--fail-on low|medium|high|critical), and auto-detects Azure DevOps pipeline authentication viaSYSTEM_ACCESSTOKEN. The URL pattern (cli.dfd.security.azure.com/public/v2/latest/) suggests it's the same binary theMicrosoftDefenderCLI@2task downloads internally. -
The
aka.msCLI is the documented standalone CLI. It's referenced in the official CI/CD integration guide for non-ADO platforms (GitHub Actions, Jenkins, etc.). Its--defender-breakflag only exits non-zero for "critical issues" with no configurable threshold. -
The
--helpoutputs are completely different. The CDN binary exposes flags like--fail-on,--baseline,--severity,--suppress,--quiet, and--timeoutthat don't exist in theaka.msbinary, and vice versa (e.g.--defender-debug,--defender-outputonly inaka.ms). -
Neither binary's
scan imageflags match the documented CLI reference exactly. The docs list--defender-breakand--defender-outputas global options, which align with theaka.msbinary but not the CDN one.
Questions
-
Is the CDN endpoint (
cli.dfd.security.azure.com) a supported, stable distribution channel? Can we rely on it in production pipelines, or is it an internal implementation detail of the ADO task that could change without notice? -
Are these intended to be two separate products, or are they converging? The feature sets (especially
--fail-onvs--defender-break) suggest they may be independently developed. -
For Azure DevOps pipelines where we need to bypass the task wrapper (to avoid
##[error]on non-critical findings), which binary is recommended?
- 主要语言
- TypeScript
- 星标
- 86
- 派生
- 22
- PR 合并指标
- 30 天内没有已合并 PR
环境准备
这个项目没有提供开发容器、Dockerfile 或贡献指南，环境需要你自己搭建：先看它的 README，通用步骤见我们的新手贡献指南。
从这里开始
- 先读完整个 Issue，再读项目的贡献指南。
- 在 Issue 下留言说明你要接手 —— 这能避免两个人做同样的事。
- Fork 仓库，在一个分支上完成修改。
- 提交 Pull Request，并在描述里引用这个 Issue 编号。
microsoft/security-devops-azdevops 的其他 Issue
-
难度 1/5 1 小时以内 新手友好度 68/100
-
Checkov's SoftFail not documented, working, and ignored by MSDO可能重新可做 @DimaBir 于 123 天前认领，目前没有进行中的 PR。 未关闭area:task area:tools status:waiting-on-author type:docs type:question
microsoft/security-devops-azdevops#169 · 1 条评论 · 已指派 1 人 ·
-
Spec: Promote CKV_AZUREPIPELINES_* severity from note to warning可能已有人在做 @DimaBir 于 140 天前认领。 未关闭area:task area:tools status:team-review type:feature
microsoft/security-devops-azdevops#164 · 2 个 reaction · 已指派 2 人 ·
-
Checkov tool omits Azure Pipelines results可能重新可做 @DimaBir 于 142 天前认领，目前没有进行中的 PR。 未关闭area:task area:tools status:team-review type:docs type:feature
microsoft/security-devops-azdevops#163 · 17 条评论 · 已指派 1 人 ·
-
enhancement
难度 4/5 3-5 天 新手友好度 35/100
microsoft/security-devops-azdevops#152 · 2 条评论 ·
查看 microsoft/security-devops-azdevops 的全部 Issue
相似的 Issue
-
难度 2/5 1-3 小时 新手友好度 68/100
Doist/todoist-cli#576 ·
维护者通常 1 天内回复
-
🐛 Bug supabase/cli
难度 2/5 1-3 小时 新手友好度 84/100
维护者通常 1 天内回复
-
难度 1/5 1 小时以内 新手友好度 90/100
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 78/100
CopilotKit/aimock#491 ·
维护者通常 1 天内回复
-
难度 2/5 1-3 小时 新手友好度 86/100
agilepathway/label-checker#710 · 2 条评论 ·
维护者通常 1 天内回复