Submit Azure Pipelines task dependencies to GitHub Dependency Graph for vulnerability scanning and Dependabot alerts.
- π Automatic Discovery: Detects
azure-pipelines.yml/yamland.azure-pipelines/*.yml/yamlfiles automatically - π Glob Pattern Support: Use glob patterns to specify custom pipeline file locations
- π Template Resolution: Resolves and includes tasks from pipeline templates
- π Azure DevOps Integration: Uses the Azure DevOps API to resolve task names/GUIDs to full identifiers with versions
- π Dependency Graph: Submits dependencies to GitHub's Dependency Graph for vulnerability scanning
- π Dependabot Integration: Get automated security alerts for vulnerable Azure Pipelines tasks
name: Submit Azure Pipelines Dependencies
on:
push:
branches: [main]
pull_request:
branches: [main]
permissions:
contents: write # Required for dependency submission
jobs:
submit-dependencies:
runs-on: ubuntu-latest
steps:
- name: Checkout
uses: actions/checkout@v4
- name: Submit Azure Pipelines Dependencies
uses: jessehouwing/azure-pipelines-dependency-submission@v1
with:
azure-devops-url: https://dev.azure.com/myorg
azure-devops-token: ${{ secrets.AZURE_DEVOPS_PAT }}- name: Submit Azure Pipelines Dependencies
uses: jessehouwing/azure-pipelines-dependency-submission@v1
with:
github-token: ${{ secrets.GITHUB_TOKEN }}
azure-devops-url: https://dev.azure.com/myorg
azure-devops-token: ${{ secrets.AZURE_DEVOPS_PAT }}
pipeline-paths: |
pipelines/**/*.yml
.azuredevops/*.yaml
custom-pipeline.yml
resolve-templates: true| Input | Required | Default | Description |
|---|---|---|---|
github-token |
No | ${{ github.token }} |
GitHub token with contents:write permission for dependency submission |
github-readonly-token |
No | '' |
GitHub token with contents:read permission for accessing private repositories when resolving templates. Falls back to github-token if not provided |
repository |
No | ${{ github.repository }} |
Repository to submit dependencies for (owner/repo format) |
azure-devops-url |
Yes | - | Azure DevOps organization URL (e.g., https://dev.azure.com/myorg) |
azure-devops-token |
Yes | - | Azure DevOps Personal Access Token with Agent Pools: Read, Build: Read, and Marketplace: Read permissions |
pipeline-paths |
No | '' |
Comma-separated or newline-separated list of glob patterns for pipeline files. Defaults to azure-pipelines.yml, azure-pipelines.yaml, and .azure-pipelines/*.yml |
resolve-templates |
No | true |
Whether to resolve and include dependencies from pipeline templates |
parse-templates-by |
No | action |
How to parse templates: action (local parsing) or server (Azure DevOps API). Server mode is slower but more accurate |
azure-devops-project |
No | '' |
Azure DevOps project name when using server mode. If not specified, queries all accessible projects |
| Output | Description |
|---|---|
dependency-count |
Number of dependencies submitted |
To use this action, you need to create a Personal Access Token (PAT) in Azure DevOps with the following permissions:
- Go to Azure DevOps β User Settings β Personal Access Tokens
- Click "New Token"
- Select the following scopes: Agent Pools (Read), Build (Read), and Marketplace (Read; required to query Azure DevOps Marketplace metadata)
- Copy the token and add it as a repository secret in GitHub
The GitHub token requires the following permission:
contents: write- Required to submit dependencies to the Dependency Graph
- Discovery: The action scans your repository for Azure Pipelines files using the specified patterns or default locations
- Parsing: Each pipeline file is parsed to extract task references, including tasks in templates
- Resolution: Task names and GUIDs are resolved to full identifiers (e.g.,
Microsoft.VisualStudio.Services.Cloud.TaskName) using the Azure DevOps API - Submission: Dependencies are submitted to GitHub's Dependency Graph in Package URL (purl) format
- Monitoring: GitHub's Dependabot monitors for vulnerabilities and creates alerts
The action automatically detects:
azure-pipelines.ymlazure-pipelines.yaml.azure-pipelines/*.yml.azure-pipelines/*.yaml
Or use custom glob patterns:
pipeline-paths: |
build/**/*.yml
deploy/*.yaml
**/azure-*.ymlWhen resolve-templates: true (default), the action follows template references
and includes tasks from:
extendstemplates- Step templates
- Job templates
- Stage templates
Example:
# azure-pipelines.yml
extends:
template: templates/base.yml
# templates/base.yml
steps:
- task: NodeTool@0
inputs:
versionSpec: '18.x'Both the main pipeline and template tasks are included as dependencies.
For more accurate dependency resolution, you can enable server-side parsing:
- name: Submit Azure Pipelines Dependencies
uses: jessehouwing/azure-pipelines-dependency-submission@v1
with:
azure-devops-url: https://dev.azure.com/myorg
azure-devops-token: ${{ secrets.AZURE_DEVOPS_PAT }}
azure-devops-project: MyProject
parse-templates-by: serverServer-side parsing provides more accurate results by:
- Expanding Templates: Fully resolves all template references, including nested templates
- Applying Decorators: Captures tasks injected by pipeline decorators installed in your organization
- Accurate Task Versions: Uses the exact task versions that would run in a real pipeline execution
- Find Build Definitions: Queries Azure DevOps to find build definitions that reference your pipeline files (only GitHub-backed definitions)
- Preview Run: Calls the Azure DevOps Preview Run API for each definition to expand templates and apply decorators
- Extract Tasks: Parses the expanded pipeline to extract all tasks that would actually execute
Server-side parsing is slower than action-side parsing because it:
- Makes additional API calls to query build definitions
- Calls the Preview Run API for each matching definition
- Processes the expanded pipeline results
Recommendation: Use server-side parsing in scheduled workflows rather than on every push/PR for better performance.
If no build definitions are found for a pipeline file, the action automatically falls back to action-side parsing for that file.
- Templates from external repositories are not currently resolved
- Only tasks are tracked as dependencies (not other resources)
- Requires access to the Azure DevOps organization to resolve task metadata
Contributions are welcome! Please feel free to submit a Pull Request.
MIT License - see the LICENSE file for details.
- actions-dependency-submission - Submit GitHub Actions dependencies