Azure DevOps

Integrate netbobr firewall rule analysis into Azure DevOps Pipelines. A non-zero CLI exit code fails the step:

• 2 when findings reach your --fail-on threshold (or a flow is DENY)
• 1 when the analysis could not complete

Basic Pipeline

A minimal azure-pipelines.yml that fails on high or critical findings:

trigger:
  - main

pool:
  vmImage: 'ubuntu-latest'

steps:
  - task: NodeTool@0
    inputs:
      versionSpec: '20.x'
    displayName: 'Install Node.js'

  - script: npx --yes @netbobr/cli@2 analyze firewall-rules.json --fail-on high
    displayName: 'Analyze Firewall Rules'

Azure DevOps treats any non-zero exit code as a failure. The pipeline stops on high or critical findings and DENY verdicts (exit 2), and on errors such as a missing file, an invalid config or an invalid flow (exit 1).

With SARIF Output

Generate a SARIF report, publish it as a build artifact, and still gate the pipeline:

trigger:
  - main

pool:
  vmImage: 'ubuntu-latest'

steps:
  - task: NodeTool@0
    inputs:
      versionSpec: '20.x'
    displayName: 'Install Node.js'

  - script: npx --yes @netbobr/cli@2 analyze firewall-rules.json --fail-on high --output sarif --output-file $(Build.ArtifactStagingDirectory)/results.sarif
    displayName: 'Analyze Firewall Rules (SARIF)'

  - task: PublishBuildArtifacts@1
    inputs:
      pathToPublish: '$(Build.ArtifactStagingDirectory)/results.sarif'
      artifactName: 'CodeAnalysisLogs'
    displayName: 'Publish SARIF Report'
    condition: succeededOrFailed()

• --output-file writes the report before netbobr sets its exit code, so continueOnError is not needed.
• The analysis step fails on findings or errors, and condition: succeededOrFailed() still publishes the report.
• To publish findings without ever failing on them, use --fail-on none: errors still fail the step.

With Configuration and PDF Report

Load a netbobr session saved in the web app and generate a PDF compliance report:

  - script: |
      npx --yes @netbobr/cli@2 analyze rules.json \
        --config netbobr-config.json \
        --fail-on none \
        --output pdf \
        --output-file $(Build.ArtifactStagingDirectory)/report.pdf
    displayName: 'Generate PDF Report'

  - task: PublishBuildArtifacts@1
    inputs:
      pathToPublish: '$(Build.ArtifactStagingDirectory)/report.pdf'
      artifactName: 'compliance-report'
    displayName: 'Publish PDF Report'
    condition: succeededOrFailed()

The session applies zones and zone policies, custom rules, zone attributes and disabled rules. A flow between zones whose policy is Deny, or one matched by a custom rule with a DENY override, fails the gate at any --fail-on level except none.

To override the default risk score weights or thresholds, add flat weights and thresholds keys to the config file (see Thresholds). A session's old riskWeights block is ignored with a warning. An invalid config fails the step with exit code 1.

Export your configuration from the netbobr web app using Session Control > Save and commit the JSON file to your repository.

Severity Gating

Control which severity levels fail the pipeline using --fail-on:

  # Fail only on critical findings (or DENY verdicts)
  - script: npx --yes @netbobr/cli@2 analyze rules.json --fail-on critical
    displayName: 'Analyze (critical only)'

  # Fail on high or critical findings (or DENY verdicts)
  - script: npx --yes @netbobr/cli@2 analyze rules.json --fail-on high
    displayName: 'Analyze (high+)'

  # Fail on any LOW-or-higher finding
  - script: npx --yes @netbobr/cli@2 analyze rules.json --fail-on low
    displayName: 'Analyze (low+)'

Cloud exports and Terraform source are analyzed with --cloud-format aws-sg, azure-nsg, gcp-fw, tf-plan, tf-hcl, k8s-netpol or auto.

Exit Code Reference

--fail-on takes info, low, medium (the default), high, critical or none. none is report-only: it never exits 2, and errors still exit 1.