Chapter 7: Using Artifacts with Azure DevOps

In the previous chapter, we covered how to host build agents in Azure Pipelines. In this chapter, we are going to cover how to use artifacts with Azure DevOps. We will begin by explaining what artifacts are. Then, we will look at how to create them in Azure DevOps, as well as how to produce the artifact package from a built pipeline. Next, we are going to cover how to deploy the feed using a release pipeline. Then, we are going to cover how to set the feed permissions and how to consume the package in Visual Studio. Finally, we are going to cover how to scan for package vulnerabilities using WhiteSource Bolt.

The following topics will be covered in this chapter:

• Introducing Azure Artifacts
• Creating an artifact feed with Azure Artifacts
• Producing the package using a build pipeline
• Publishing the package to the feed from a build pipeline
• Configuring the feed permissions from the feed settings
• Consuming the package...

Technical requirements

To follow this chapter, you need to have an active Azure DevOps organization. The organization we'll be using in this chapter is the PartsUnlimited organization, which we created in Chapter 1, Azure DevOps Overview. You also need to have Visual Studio 2019 installed, which can be downloaded from https://visualstudio.microsoft.com/downloads/.

The source code for our sample application can be downloaded from https://github.com/PacktPublishing/Learning-Azure-DevOps---B16392/tree/master/Chapter%207.

Introducing Azure Artifacts

It is likely that every developer has used a third-party or open source package in their code to add extra functionalities and speed up the development process of their application. Using popular, pre-built components that have been used and tested by the community will help you get things done more easily.

Functionalities, scripts, and code that have been built by various teams in your organization are often reused by other teams and in different software development projects. These different artifacts can be moved into a library or package so that others can benefit from this.

There are different ways to build and host these packages. For instance, you can use NuGet for hosting and managing packages for the Microsoft Development platform or npm for JavaScript packages, Maven for Java, and more. Azure Artifacts offers features so that you can share and reuse packages easily. In Azure Artifacts, packages are stored in feeds. A feed is a container...

Creating an artifact feed with Azure Artifacts

In this demo, we are going to create an artifact feed in Azure Artifacts. Packages are stored in feeds, which are basically organizational constructs that allow us to group packages and manage their permissions. Every package type (NuGet, npm, Maven, Python, and Universal) can be stored in a single feed.

For this demonstration, we are going to use our PartsUnlimited sample project again and add a new artifact feed to the project. To do this, perform the following steps:

1. Open a web browser and navigate to https://dev.azure.com/.
2. Log in with your Microsoft account and from the left menu, select Artifacts. Then, click the + Create Feed button.
3. In the Create new feed dialog box, add the following values (make sure that Upstream sources is disabled; we are not going to use packages from remote feeds in this chapter):

   Figure 7.1 – Creating a new feed

4. Click the Create button.

With that, we have created a new...

Producing the package using a build pipeline

Now that we have created our feed, we are going to create a build pipeline that automatically creates a package during the build of the project. For this example, you can use the sample project provided in this book's GitHub repository. This sample project consists of all the models from the PartsUnlimited project. We are going to add all the models to a package and distribute it from Artifacts. This way, you can easily share the data model across different projects.

The first step is to import the GitHub repository into the PartsUnlimited organization in Azure DevOps.

Adding the sample project to the PartsUnlimited repository

To add the sample models project to the PartsUnlimited repository, perform the following steps:

1. Navigate to the PartsUnlimited project in Azure DevOps and go to Repos > Files.
2. Select Import repository from the PartsUnlimited dropdown:

   Figure 7.2 – Importing a repository

3. Enter...

Publishing the package to the feed from a build pipeline

Now that we've built the application and the package from our build pipeline, we can publish the package to the feed that we created in our first demo.

For this, we need to set the required permissions on the feed. The identity that the build will run under needs to have Contributor permissions on the feed. Once these permissions have been set, we can extend our pipeline to push the package to the feed.

Setting the required permissions on the feed

To set the required permissions, we need to go to the settings of our feed:

1. Log in with your Microsoft account and from the left menu, select Artifacts.
2. Go to the settings of the feed by selecting the Settings button from the top-right menu:

   Figure 7.9 – Opening the feed's settings

3. Then, click on Permissions from the top menu and click on + Add users/groups:

   Figure 7.10 – Feed permission settings

4. Add the build that has the same name...

Consuming the package in Visual Studio from the Artifacts feed

Now that our PartsUnlimited.Models package has been pushed to our feed in Artifacts, we can consume this package from Visual Studio. In this section, we are going to create a new console app in Visual Studio and connect to the feed from there.

Therefore, we need to perform the following steps:

1. Open Visual Studio 2019 and create a new .NET Core console application:

   Figure 7.14 – Creating a new console package

2. Once the application has been created, navigate to Azure DevOps and from the left menu, select Artifacts.
3. From the top menu, select Connect to feed:

   Figure 7.15 – Connect to feed

4. On the next screen, select Visual Studio from the list. We are going to use these settings to set up the machine in the next step:

   Figure 7.16 – Visual Studio machine setup

5. Navigate back to the console app in Visual Studio. Then, from the top menu, select Tools > NuGet package manager >...

Scanning for package vulnerabilities using WhiteSource Bolt

WhiteSource Bolt can be used to scan packages for vulnerabilities directly from the build pipeline. It is a developer tool for scanning for security vulnerabilities in application code, as well as open source applications and packages. It offers extensions that can be installed through the Azure DevOps marketplace and through GitHub. WhiteSource Bolt can be downloaded free of charge, but this version is limited to five scans per day, per repository.

Important Note

For more information about WhiteSource Bolt, you can refer to the following website: https://bolt.whitesourcesoftware.com/.

In this section, we are going to install the extension in our Azure DevOps project and implement the tasks that come with it into our existing build pipeline. Let's get started:

1. Open a browser and navigate to https://marketplace.visualstudio.com/.
2. Search for WhiteSource Bolt in the search box and select the WhiteSource...

Summary

In this chapter, we looked at Azure Artifacts in more depth. First, we set up a feed and created a new NuGet package using the model classes in the PartsUnlimited project. Then, we created a build pipeline where we packed and pushed the package to the feed automatically during the build process. Finally, we used the WhiteSource Bolt extension from the Azure marketplace to scan the package for vulnerabilities.

In the next chapter, we are going to focus on how to deploy applications in Azure DevOps using release pipelines.

Further reading

Check out the following links for more information about the topics that were covered in this chapter:

• What is Azure Artifacts?: https://docs.microsoft.com/en-us/azure/devops/artifacts/overview?view=azure-devops
• Get started with NuGet packages in Azure DevOps Services and TFS: https://docs.microsoft.com/en-us/azure/devops/artifacts/get-started-nuget?view=azure-devops