Hands-on exercises – Integrating security within the build phase
In this exercise, we will be integrating security within the build phase of our pipeline. We will practically integrate SAST, Software Composition Analysis (SCA), and secret scanning using several tools, such as GitHub Advanced Security (GHAS). We will also enable DevOps Security in Microsoft Defender for Cloud.
Below are the hands-on exercises:
- Exercise 1 – Integrating SAST, SCA, and secret scanning into the build process
- Exercise 2 – Onboarding your DevOps platforms to DevOps Security in Microsoft Defender for Cloud
Prerequisites
Before diving into the security tasks, let’s first create a test environment and service connections needed for our application to run.
Task 1 – Creating a test environment
- Navigate to your DevOps instance (https://dev.azure.com) and choose the organization you used in the previous chapter.
- Select the eShopOnWeb private...
