Integrating Dependency-Track into Azure DevOps Pipelines

Welcome to the final post in this Dependency-Track series! We've covered what Dependency-Track is and why we started using it, how to deploy it on Azure Container Apps, and how to configure OIDC authentication with Microsoft Entra ID. Now it's time to put it all together by integrating Dependency-Track into our Azure DevOps CI/CD pipelines.

In this post, I'll show you how to automatically generate Software Bill of Materials (SBOMs and upload them to Dependency-Track, By the end, you'll have a fully automated vulnerability management workflow that provides continuous visibility into your software supply chain.

CI/CD architecture

We adopted the following approach for integrating Dependency-Track in our CI/CD architecture:

During the CI phase we generate an SBOM as part of the build process using language-specific tools and store it among the other build artifacts

During the CD phase, the code is rolled out in multiple environments with approval checks between each environment. When we deploy to a specific environment, we upload the SBOM to Dependency-Track via its REST API.   This gives us exact insights on which vulnerabilities can be found in which application for which environment.

Create a service connection

First, we need an API key for Azure DevOps to communicate with Dependency-Track:

1. Log into Dependency-Track with an admin account
2. Navigate to Administration → Access Management → Teams
3. Select the Automation team (or create a new team for CI/CD integration)
4. Set the following permissions: BOM_UPLOAD, PORTFOLIO_MANAGEMENT, PROJECT_CREATION_UPLOAD, VIEW_PORTFOLIO
5. Click on API Keys tab
6. Click Create API Key
7. Give it a descriptive name like "Azure DevOps Pipeline"
8. Copy the generated API key immediately (you won't be able to see it again)

Important: This API key has the same permissions as the team it belongs to. I’ve used the built-in Automation team, but you can also create a separate team with permissions to:

• Create/update projects
• Upload BOM files
• View vulnerabilities and policy violations

Now we can switch to Azure DevOps to add this as a new service connection:

1. Log into your Azure DevOps instance
2. Navigate to Project Settings→ Service connections
3. Click on New service connection
4. Choose Generic and click on Next
5. Enter the Dependency-Track URL as the  Server URL, the API key as the token and set a Service connection name.
6. Click on Save

OK, we are good to go.

Configure the CI phase

As I mentioned in the beginning, we use the CI phase to generate and store the SBOM as part of our build artifacts.

Depending on the technology stack, you can use different tools to generate the SBOM.

.NET / C# Projects

For .NET projects, we use the CycloneDX .NET tool:

By generating the SBOM in the artifactstagingdirectory, it will automatically be uploaded together with the other build artifacts.

Angular Projects

For Angular projects, we use the CycloneDX npm tool:

In both cases, we store the generated SBOM as part of our build artifacts.

By generating the SBOM in the artifactstagingdirectory, it will automatically be uploaded together with the other build artifacts.

Configure the CD phase

In our CD phase we go through multiple stages:

To upload the generated SBOM, we use the Dependency-Track Azure Devops extension from the Visual Studio marketplace:

 

We can specify the correct Dependency-Track project id or let the extension generate the project on the fly.

More information

Dependency Track - Visual Studio Marketplace

CycloneDX/cyclonedx-dotnet: Creates CycloneDX Software Bill of Materials (SBOM) from .NET Projects

CycloneDX/cyclonedx-node-npm: Create CycloneDX Software Bill of Materials (SBOM) from Node.js NPM projects.