A secure pipeline on Azure DevOps

variables:
  - group: payments-prod-secrets      # linked to Key Vault, protected resource

steps:
  - script: ./scripts/notify-release.sh
    env:
      STATUSPAGE_TOKEN: $(statuspage-token)   # only this step sees it

trigger:
  branches:
    include: [main]
# Azure Repos PR builds come from the branch policy's build validation, not from 'pr:'.

resources:
  repositories:
    - repository: templates
      type: git
      name: Platform/pipeline-templates
      ref: refs/tags/v2.3.0           # a reviewed, protected tag

extends:
  template: secure-pipeline.yml@templates
  parameters:
    appName: payments-api
    languages: javascript
    buildSteps:
      - task: NodeTool@0
        inputs:
          versionSpec: "22.x"
      - script: npm ci --ignore-scripts
        displayName: Install dependencies
      - script: npm test
        displayName: Unit tests

parameters:
  - name: appName
    type: string
  - name: languages
    type: string
    default: javascript
  - name: buildSteps
    type: stepList
    default: []

# Inside the Build job:
steps:
  - ${{ each step in parameters.buildSteps }}:
    - ${{ each pair in step }}:
        ${{ if and(eq(pair.key, 'task'), not(in(pair.value, 'NodeTool@0', 'UseDotNet@2', 'DotNetCoreCLI@2', 'Npm@1'))) }}:
          # An unexpected key fails compilation and shows this text as the error.
          'Task ${{ pair.value }} is not on the platform allowlist': error
        ${{ else }}:
          ${{ pair.key }}: ${{ pair.value }}
      target:
        commands: restricted          # no ##vso logging commands except a safe subset
        settableVariables: none       # caller steps cannot set pipeline variables

- stage: Build
  displayName: Build, test and scan
  jobs:
    - job: build
      pool:
        vmImage: ubuntu-24.04
      timeoutInMinutes: 30
      steps:
        - checkout: self
          fetchDepth: 1

        - task: AdvancedSecurity-Codeql-Init@1
          inputs:
            enableAutomaticCodeQLInstall: true
            languages: ${{ parameters.languages }}
            querysuite: security-extended
            buildtype: None              # interpreted languages: no build needed

        # caller's build steps, guarded as shown above

        - task: AdvancedSecurity-Dependency-Scanning@1
        - task: AdvancedSecurity-Codeql-Analyze@1

        - script: |
            mkdir -p "$(Build.ArtifactStagingDirectory)/sarif"
            docker run --rm \
              -v "$(Build.SourcesDirectory):/src:ro" \
              -v "$(Build.ArtifactStagingDirectory)/sarif:/out" \
              aquasec/trivy:0.74.0 config /src \
                --severity CRITICAL,HIGH --exit-code 1 \
                --format sarif --output /out/trivy-iac.sarif
          displayName: IaC scan (Trivy, blocking)

        - task: AdvancedSecurity-Publish@1
          condition: succeededOrFailed()    # publish findings even when the scan failed
          inputs:
            SarifsInputDirectory: $(Build.ArtifactStagingDirectory)/sarif
            Category: trivy-iac

- script: |
    docker run --rm -v "$(Build.SourcesDirectory):/src:ro" \
      ghcr.io/gitleaks/gitleaks:v8.30.1 dir /src --redact
  displayName: Secrets (gitleaks)

- script: |
    docker run --rm -v "$(Build.SourcesDirectory):/src:ro" -w /src \
      semgrep/semgrep:1.179.0 semgrep scan --config p/default --severity ERROR --error
  displayName: SAST (Semgrep)

- script: |
    docker run --rm -v "$(Build.SourcesDirectory):/src:ro" \
      ghcr.io/google/osv-scanner:v2.5.1 scan source -r /src
  displayName: SCA (OSV-Scanner)

- stage: Package
  dependsOn: Build
  condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
  jobs:
    - job: image
      pool:
        vmImage: ubuntu-24.04
      variables:
        image: contosoacr.azurecr.io/${{ parameters.appName }}
      steps:
        - checkout: self

        - task: Docker@2
          displayName: Log in to ACR
          inputs:
            command: login
            containerRegistry: acr-contoso

        - task: Docker@2
          displayName: Build
          inputs:
            command: build
            repository: ${{ parameters.appName }}
            containerRegistry: acr-contoso
            tags: $(Build.SourceVersion)

        - script: |
            docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
              aquasec/trivy:0.74.0 image \
                --severity CRITICAL,HIGH --ignore-unfixed --exit-code 1 \
                "$(image):$(Build.SourceVersion)"
          displayName: Image scan (release gate)

        - script: |
            mkdir -p "$(Build.ArtifactStagingDirectory)/sbom"
            docker run --rm -v /var/run/docker.sock:/var/run/docker.sock \
              -v "$(Build.ArtifactStagingDirectory)/sbom:/out" \
              anchore/syft:v1.54.1 "docker:$(image):$(Build.SourceVersion)" \
                -o spdx-json=/out/sbom.spdx.json
          displayName: Generate SBOM

        - task: Docker@2
          displayName: Push
          inputs:
            command: push
            repository: ${{ parameters.appName }}
            containerRegistry: acr-contoso
            tags: $(Build.SourceVersion)

        - script: |
            ref=$(docker inspect --format '{{index .RepoDigests 0}}' "$(image):$(Build.SourceVersion)")
            echo "##vso[task.setvariable variable=digest;isOutput=true]${ref#*@}"
          name: resolve
          displayName: Resolve digest

        - task: Notation@0
          displayName: Install Notation
          inputs:
            command: install
            version: "1.3.2"

        - task: Notation@0
          displayName: Sign the digest
          inputs:
            command: sign
            artifactRefs: $(image)@$(resolve.digest)
            plugin: azureKeyVault
            akvPluginVersion: "1.2.1"
            azurekvServiceConection: sc-contoso-signing   # input name is spelled this way
            keyid: $(signingKeyId)
            selfSigned: false               # true only for a self-signed test certificate

        - publish: $(Build.ArtifactStagingDirectory)/sbom
          artifact: sbom

- stage: Deploy
  dependsOn: Package
  lockBehavior: sequential
  jobs:
    - deployment: production
      environment: production          # approvals and checks live on the environment
      pool:
        vmImage: ubuntu-24.04
      variables:
        digest: $[ stageDependencies.Package.image.outputs['resolve.digest'] ]
        imageRef: contosoacr.azurecr.io/${{ parameters.appName }}@$(digest)
      strategy:
        runOnce:
          deploy:
            steps:
              - checkout: templates      # trust policy comes from the platform repo

              - task: Docker@2
                inputs:
                  command: login
                  containerRegistry: acr-contoso

              - task: Notation@0
                inputs:
                  command: install
                  version: "1.3.2"

              - task: Notation@0
                displayName: Verify signature before deploy
                inputs:
                  command: verify
                  artifactRefs: $(imageRef)
                  trustPolicy: $(Build.SourcesDirectory)/notation/trustpolicy.json
                  trustStore: $(Build.SourcesDirectory)/notation/truststore/

              - task: AzureCLI@2
                displayName: Deploy the verified digest
                inputs:
                  azureSubscription: sc-contoso-prod   # workload identity federation
                  scriptType: bash
                  scriptLocation: inlineScript
                  inlineScript: |
                    az containerapp update \
                      --name ${{ parameters.appName }} \
                      --resource-group rg-payments-prod \
                      --image "$(imageRef)"