Project 03: Shifting Security Left with SAST in Azure Pipelines

The mission: recurring vulnerability assessment across C# and TypeScript codebases, enforced automatically — a PR with a new critical finding cannot merge. No security review meetings, no spreadsheets.

#Pipeline Flow

 PR opened ──▶ build ──▶ unit tests ──▶ SONAR SCAN
                                            │
                              quality gate PASS? ── no ──▶ ✖ MERGE BLOCKED
                                            │                (finding linked
                                           yes                in the PR)
                                            ▼
                                     ✔ MERGE ALLOWED ──▶ CD stages

#Step 1 — The Scan Stage

 1
 2
 3
 4
 5
 6
 7
 8
 9
10
11
12
13
14
15
16
17

stages:
  - stage: Analyze
    jobs:
      - job: SAST
        steps:
          - task: SonarCloudPrepare@1
            inputs:
              SonarCloud: "sonarcloud-conn"
              organization: "corrupted-glitch"
              scannerMode: "MSBuild"
              projectKey: "billing-api"
          - script: dotnet build --configuration Release
          - script: dotnet test --collect:"XPlat Code Coverage"
          - task: SonarCloudAnalyze@1
          - task: SonarCloudPublish@1
            inputs:
              pollingTimeoutSec: "300"   # wait for the verdict

#Step 2 — Make the Gate a Wall

A scan that only reports is decoration. Two switches make it enforcement:

1. SonarCloud quality gate: new_critical_violations = 0, coverage on new code ≥ 80%.
2. Azure DevOps branch policy: the Analyze stage is a required status check on main.

#Step 3 — Kill the Noise in Week One

The first scan on a real codebase produces hundreds of findings. Triage them once, aggressively:

// Exclusions are a security decision — document each one
sonar.exclusions = "**/migrations/**, **/*.generated.cs, **/vendor/**"
sonar.cpd.exclusions = "**/dto/**"        // DTOs duplicate by design
sonar.issue.ignore.multicriteria = "e1"   // reviewed 2026-03: false positive

#Results