task.json

{
  "$schema": "https://raw.githubusercontent.com/Microsoft/azure-pipelines-task-lib/master/tasks.schema.json",
  "id": "e8d96bd3-5afb-4e3c-b219-b681a8fed9c2",
  "name": "ggshield",
  "friendlyName": "ggshield - Secret Scan",
  "description": "Scan for hardcoded secrets using ggshield. Credentials are read from a Generic service connection.",
  "helpUrl": "https://docs.gitguardian.com/ggshield-docs/integrations/cicd-integrations/azure-pipelines",
  "category": "Build",
  "author": "GitGuardian",
  "version": {
    "Major": 0,
    "Minor": 4,
    "Patch": 1
  },
  "instanceNameFormat": "ggshield - $(scanScope)",
  "inputs": [
    {
      "name": "gitguardianConnection",
      "type": "connectedService:Generic",
      "label": "GitGuardian service connection",
      "required": true,
      "helpMarkDown": "Generic service connection that stores the ggshield API key (Password field) and, optionally, the GitGuardian dashboard URL (Server URL field, e.g. `https://dashboard.gitguardian.com` for SaaS US, `https://dashboard.eu1.gitguardian.com` for SaaS EU, or your self-hosted dashboard URL). ggshield derives the API URL from the dashboard URL."
    },
    {
      "name": "scanScope",
      "type": "pickList",
      "label": "Scan scope",
      "defaultValue": "changes",
      "required": false,
      "options": {
        "changes": "changes (commits that triggered the pipeline)",
        "repository": "repository (current state of the checkout)"
      },
      "helpMarkDown": "`changes` scans the commits that triggered this run. \n\n`repository` scans the checked-out working tree. It honors the repository's `.gitignore`. Use it for a periodic full-repository scan, and keep `changes` on pull request validation."
    }
  ],
  "execution": {
    "Node20_1": {
      "target": "index.js"
    }
  }
}