Configure an Azure DevOps build for ASP.NET applications

You can configure the Veracode Azure DevOps Extension in Visual Studio to scan ASP.NET applications as part of your Azure DevOps build process.

Before you begin:

• You have precompiled your ASP.NET application and generated a PUBXML file according to the instructions in the packaging requirements. You can see an example .NET project that has a precompilation on line 25 in this example: https://github.com/veracode/verademo-dotnet/blob/main/azure-pipelines.yml.
• The Azure DevOps Build configuration task requires that you use Visual Studio as your integrated development environment.

To complete this task:

1. Open the ASP.NET application in Visual Studio.
2. Add the veracode.pubxml file that contains Veracode-specific settings to the PublishProfiles folder.
3. View the veracode.pubxml file to verify your configuration. Veracode uses the information in this file to generate the necessary artifacts for scanning an application.
4. Check in the changes to your repository.
5. In Azure DevOps, open your Azure DevOps project.
6. Select the Build tab and navigate to your build definition.
7. Select the Build solution task.
8. In the MSBuild Arguments field, enter the path of your application PUBXML file. For example, /p:PublishProfile=veracode.pubxml
9. Complete the Azure DevOps build configuration for Static Analysis.