Connecting to Azure Devops
Connecting the Seal platform to an Azure Devops repository enables it to automatically sync with your projects, detect vulnerable packages, and possibly open pull requests to replace vulnerable packages with fully-compatible sealed versions.
After you clicked Skip on the onboarding you will land on our welcome screen. There you should click on the Projects tab at the top of the screen, and then click Import from Azure.
The first time you open it a Link to Azure window will appear. In it you should put the URL to your organization on Azure Devops, and a personal access token with the requisite permissions.
Generating the personal access token on Azure Devops
In the Azure Devops organization screen, open the user settings menu and click on Personal access tokens.
Click on the New Token button.
Give access to all of your organizations or the particular organization you want to connect. Set the expiration to one year. Give the token full access or Code Read & Write.
Create the token, and copy it to the relevant field in the Link to Azure window shown above.
Enabling automatic scanning when new code is merged
When new code is merged to the main branch it can introduce new vulnerabilities or fix existing ones (either through using a sealed version, upgrading the vulnerable package, or removing it altogether as a dependency). Therefore, in order to give an up-to-date picture of your vulnerable dependencies, the Seal app needs to rescan whenever a pull request is merged to the main branch.
For the Seal app to know new code was pushed, it must be granted permissions on a project-by-project (where by "project" here we mean an Azure Devops project, not a project on the Seal app).
To give the Seal app access to the relevant webhooks follow these steps:
Go to the Project settings of the relevant project on Azure Devops.
Under General you will find Service hooks. Click on the + to create a new one.
Choose the type Web Hooks and click Next.
Choose the trigger "Code pushed" and click Next. There's no need to change the other fields in this form.
In the URL fill
https://api.sealsecurity.io/azure_devops/webhookand click Finish.
The Seal app will now receive a webhook whenever a pull request is merged to the main branch, allowing it to rescan the code as necessary and remain up-to-date.
Adding projects
After you've configured the connection to Azure Devops, you'll need to connect to the relevant code projects. Each project maps to an individual dependency file, for example package-lock.json.
You can either choose from a list of automatically detected projects, or add your projects manually.
To add a project manually just click on the New project button in the Projects tab, choose a friendly and easily recognizable project name, and set the URL to the project's dependency file.
The Project ID field is used to identify the project when communicating with the artifact server. It is meant to be used by machines, and it won't be edittable later.
Last updated
