Pipeline

Introduction There’s always that situation where we need to use the same elements, or code, in several places and we want to avoid copying and pasting those elements everywhere because we like to keep it DRY (Don’t Repeat Yourself). That’s where pipeline templates come in handy when facing this dilemma while working with Azure Pipelines. What are Pipeline Templates? Pipeline templates help us define reusable blocks that can be used across as many pipelines as we need, making maintenance easier and less prone to errors. ...

Introduction Shifting-left security is applying security validations to our software development process as soon as possible. Let’s say we have a development process with different steps that run from left to right consecutively. Those steps are: writing the code, creating a build, releasing it to a QA environment, releasing it to a Stage environment, releasing it to the production environment to be consumed by the end-users, and constantly monitoring the app, and the process repeats indefinitely. That’s a common and simple development cycle. ...

Introduction Using Key Vault secrets to store sensitive data is essential to keep it safe. By using secrets we can control who has access to see and manipulate the data stored in them, making sure only the correct people have the appropriate level of access. It is very common to have a pipeline that needs a key, a password, a connection string, or any other type of data that can be considered sensitive and we don’t want anyone seeing or manipulating its value. For these scenarios, most of the time the best solution is to use Key Vault secrets. ...

Introduction Static code analysis is very useful to detect security issues and bad code practices in our projects. SonarCloud is a great static code analysis tool that can be easily integrated into Azure DevOps. It can be used for free in public Azure DevOps projects. Without further ado, let’s get started. Assuming we already have an Azure DevOps organization and a SonarCloud account, the first step is to associate our Azure DevOps organization with SonarCloud. For this, we need to create a Personal Access Token (PAT) in Azure DevOps. ...

Introduction Containerized apps have been on everyone’s lips for a while now, and it’s no surprise, they can be very useful. This article will show you how to build and deploy your Dockerized app seamlessly into an Azure App Service. For this guide I have created a demo environment where the Dockerfile is already set up and ready to go, an Azure Container Registry (ACR) has been created (Basic SKU for this demo), I’ll use ACR; however, there are multiple options for container registries that can be used. And the project’s code is allocated in a private Azure DevOps repo. ...

Introduction Classic pipelines are set up using a UI and clicking around, moving through tabs, and choosing between the options the UI shows you. The same definition applies to release pipelines, the difference is that the former are used generally to build applications and the latter to deploy them. On the other hand, YAML pipelines are set up using code on, you guessed it, a YAML file. Azure DevOps has a task assistant that helps you find the tasks you need and add them to the YAML file. ...