Azure Pipelines

You can test your applications with HawkScan in Azure Pipelines in one of the following ways:

1. Using the StackHawk HawkScan Azure extension (recommended):
   This is the recommended approach, as it is a native integration with Azure Pipelines.
2. Using the hawk CLI install script:
   Install and run the hawk CLI yourself in a script step.
3. Using Docker containers:
   You can use this approach if you prefer to run your application in Docker.

Azure-Extension on Ubuntu

The Azure Extension is tested regularly with the ubuntu-latest image. HawkScan 6.0.0+ bundles its own Java runtime — no JRE installation required. The Azure extension handles binary download automatically.

Azure Extension on Windows

The Azure Extension is tested regularly with the windows-latest image. HawkScan 6.0.0+ bundles its own Java runtime, so you don’t have to manage a JRE on Windows. The Azure extension handles binary download automatically.

Azure Extension on hosted Windows

More Experienced windows professionals may want to use the HawkScan Azure Extension on their own managed VM or Windows-Server instance. Hosted Windows environments may have different administration policies that influence how the pipeline is configured.

We suggest manually installing HawkScan once from the .msi installer on the build host, and then restarting their Azure-Pipelines agent. This will ensure hawk.exe is added and available on the path for use within Azure pipelines jobs.

Some additional suggestions:

Installing HawkScan on hosted Windows

• If your administration policy disables the msiserver Windows Installer service, then you cannot use the .msi installerType with HawkScanInstall.
• If your administration policy prohibits running powershell scripts, then you cannot use the .zip installerType with HawkScanInstall.
• If neither installerType works for running the HawkScanInstall task, you can optionally skip the task entirely, and maintain the HawkScan executable manually.

Running HawkScan on hosted Windows

• Consider increasing JVM memory if your scanned application is exceptionally large.

   - task: RunHawkScan@1
     inputs:
       configFile: "stackhawk.yml"
       version: "latest"
     env:
       HAWK_MEM: 2g

• If the web application is hosted from a staging environment, consider using the HawkScan docker container, if that’s acceptable.

• If neither installerType works for running the RunHawkScan task, please reach out; we want to help you run your web applications in Azure Pipelines.

Install Script Alternative

If you’d rather not use the extension, install the hawk CLI with the hawk CLI install script in a script step, and run the scan in the next step. The script installs the latest HawkScan release and checks its checksum. It doesn’t change the PATH, so the install step uses the ##vso[task.prependpath] logging command to add the install directory to the PATH of every later step.

trigger:
  - main
pool:
  vmImage: ubuntu-latest
steps:
  - bash: |
      # Optional: pin a version (6.0.0 or later). Leave it unset to install the latest release.
      # export HAWK_INSTALL_VERSION=6.6.0
      curl -fsSL https://download.stackhawk.com/hawk/install.sh | sh
      echo "##vso[task.prependpath]$HOME/.hawk/bin"
    displayName: Install HawkScan
  - bash: hawk --api-key="${HAWK_API_KEY}" scan stackhawk.yml
    displayName: Run HawkScan
    env:
      HAWK_API_KEY: $(hawk_api_key)

trigger:
  - main
pool:
  vmImage: windows-latest
steps:
  - powershell: |
      # Optional: pin a version (6.0.0 or later). Leave it unset to install the latest release.
      # $env:HAWK_INSTALL_VERSION = '6.6.0'
      irm https://download.stackhawk.com/hawk/install.ps1 | iex
      Write-Host "##vso[task.prependpath]$env:USERPROFILE\.hawk\bin"
    displayName: Install HawkScan
  - powershell: hawk --api-key="$env:HAWK_API_KEY" scan stackhawk.yml
    displayName: Run HawkScan
    env:
      HAWK_API_KEY: $(hawk_api_key)