...

The Azure DevOps Pipelines native integration is enabled via the WhiteSource Mend for Azure DevOps extension. It enables you to do the following:

...

• The extension maps an Azure DevOps Organization to a specified WhiteSource Mend Organization.

• The extension maps an Azure DevOps Project (and all of its pipelines which are integrated with WhiteSourceMend) to a specified WhiteSource Mend Product. In order to map between an Azure DevOps Pipeline Build and a WhiteSource Mend Product, it is recommended to use the Unified Agent integration.

...

• Your Azure DevOps organization is connected to an Azure AD via Organization Settings > Azure Active Directory.

• An activation key for this Azure DevOps integration is available via the WhiteSource the Mend application's Integrate tab.

• The New Version alerts setting is enabled via Admin > Alert Settings. When disabled, no information is displayed in the Outdated Libraries tab of the Open source risk report.

• If you are using a self-hosted build agent, note that running it behind a web proxy is not currently supported.

• The relevant package manager used by your project is installed.

• Make sure to whitelist the URL that is used by the extension to download the Unified Agent: https://downloads.whitesourcesoftware.com/wss-unified-agent.jar

...

To install the extension, do as follows:

1. Click here. The WhiteSource Mend for Azure DevOps page is displayed.

2. Click Get and follow the installation procedure.

...

1. After installing the extension, navigate to Organization Settings > Extensions > WhiteSource Mend within your Azure DevOps organization.

2. An activation form for connecting to your WhiteSource Mend account is displayed. Enter the following details:

   • First name

   • Last name

   • Work email

   • Company name

   • Country

   • Activation key - navigate to Integrate > Azure DevOps Integration in the WhiteSource Mend application. Click the Generate Activation Key, and copy-paste the activation key. NOTE: If you are not a WhiteSource Mend administrator, you will need to get the activation key from the administrator.

3. Click Connect Account. Your extension is now connected to your WhiteSource Mend account.

Configuring Organizational Settings

After completing the activation process, you can define the WhiteSource Mend mapping resolution; whether to map each Azure DevOps pipeline to a WhiteSource Mend project (which is the default behavior) or to map each run/build of the pipeline to a WhiteSource Mend project. This setting will be applied to all of your organization’s pipelines.

To define the WhiteSource Mend mapping resolution, do as follows:

1. Navigate to Organization Settings > Extensions > WhiteSourceMend.

2. Select the Map Azure DevOps Pipelines to WhiteSource Mend Projects checkbox if you want each Azure DevOps pipeline to be mapped to a WhiteSource Mend project (by default, it is selected).
   -Or-
   Clear the checkbox to map only each run/build of the pipeline to a WhiteSource Mend project.

3. Click Save.

Configuring Project Settings

The default WhiteSource Mend Product that will be associated with your specific Azure DevOps Project, is AZDO_<PROJECT_NAME>. To change the mapped WhiteSource Mend Product, there are two available options:

• Defining a new WhiteSource Mend Product

• Selecting an existing WhiteSource Mend Product

Defining a New

...

Mend Product

To define a new WhiteSource Mend product to be created and associated with your Azure DevOps project, do as follows:

1. Ensure that you followed the procedures in Activating the Extension.

2. Navigate to your Azure DevOps Project.

3. Navigate to Project Settings > Extensions > WhiteSource Mend of the specific project.

4. Enter the desired WhiteSource Mend product name in the Product name field. As you enter the name, it will simultaneously appear under the input field; click that name below.

   

5. In the Add a new Product dialog box, click Add.

6. Under the Product name box click Save.

The new product will be created in the WhiteSource Mend application. Any build that will run in the specific Azure DevOps project will have results appear in the WhiteSource Mend application under the provided product name.

Selecting a Product From a List of Existing

...

Mend Products

To select a product from a list of existing WhiteSource Mend products, do as follows:

1. Ensure that you followed the procedures in Activating the Extension.

2. Navigate to your Azure DevOps Project.

3. Navigate to Project Settings > Extensions > WhiteSourceMend.

4. Click the input field of the Product name to display the list of the existing WhiteSource Mend products.

5. Select a product from the list. Once selected, it should be displayed in the input field. Click Save.

Any build that will run in the specific Azure DevOps project will have results appear in the WhiteSource Mend application under the provided existing WhiteSource Mend product.

Adding a

...

Mend Build Task to Your Pipeline

After completing the relevant settings, all is set for adding a WhiteSource Mend build task to the pipeline. Do as follows:

1. Go to the relevant Azure DevOps project for which you want WhiteSource Mend to run.

2. Inside your Azure DevOps project, from the sidebar, click Pipelines. The Pipelines page is displayed.

3. Click the relevant pipeline. The specific pipeline page is displayed.

4. Click Edit. Do one of the following procedures:

   • Adding a Build Task to a YAML Pipeline

   • Adding a Build Task to a Classic Pipeline

This activates the WhiteSource Mend integration on your build pipeline.

NOTE: Adding a pre-step build task is not necessary in order for WhiteSource Mend to successfully scan the build repository. WhiteSource Mend by default runs a pre-step command as part of the WhiteSource Mend task.

Adding a Build Task to a YAML Pipeline

1. In the pipeline edit page, from the right side, click Show assistant. The Tasks sidebar is displayed.

2. In the search bar, enter whitesource Mend. The WhiteSource Mend task is displayed.

3. Click the WhiteSource Mend task.

4. From the bottom right corner, click Add. The WhiteSource Mend task is added to the pipeline.

   Code Block
   - task: WhiteSource@21

5. (Optional) To specify the name of the WhiteSource Mend project to be created, add the following to the WhiteSource Mend task. In the following example, replace New_Project_Name with the name you want to give your WhiteSource Mend project:
   NOTE: When the Overwrite projects with latest build data checkbox from the Organization Settings > Extensions >WhiteSource>Mend is selected, you will be unable to change the project name after the first build run.

   Code Block
   - task: WhiteSource@21 inputs: cwd: '$(System.DefaultWorkingDirectory)' projectName: 'New_Project_Name'

6. (Optional) To specify custom Unified Agent Configuration parameters, add all parameters in the WhiteSource Mend Configuration field (ensure each parameter along with its value are provided on a separate line). In the following example, under configuration, provide all relevant parameters.
   NOTE: The parameters used here overwrite the default configuration parameters. Configuration parameters that were not provided will use the default values as described here.

   Code Block
   - task: WhiteSource@21 inputs: cwd: '$(System.DefaultWorkingDirectory)' configuration: | npm.resolveDependencies=true maven.resolveDependencies=true

7. Click Save & queue.

NOTE: The WhiteSource Mend task can be moved to other locations within the steps section, depending on your preferences.

...

1. To add a task to the Agent Job, click the plus (“+”) sign next to the agent job section. The Add Tasks section is displayed.

2. In the search bar, enter whitesource Mend. The WhiteSource Mend task is displayed.

3. Click the WhiteSource Mend tab, and then click Add. The WhiteSource Mend task is added to the pipeline.

4. (Optional) To specify the name of the WhiteSource Mend project to be created, enter the name in the Project name field.
   NOTE: When the Overwrite projects with latest build data checkbox from Organization Settings > Extensions > WhiteSourceMend is selected, you will be unable to change the project name after the first build run.

5. (Optional) To specify custom Unified Agent Configuration parameters, add all parameters in the WhiteSource Mend Configuration field (ensure each parameter name along with its value are provided on a separate line).
   NOTE: The parameters used here overwrite the default configuration parameters. Configuration parameters that were not provided will use the default values as described here.

6. Click Save & queue.

NOTE: The WhiteSource Mend task can be moved to other locations within the steps section, depending on your preferences.

...

• excludes=**/*sources.jar **/*javadoc.jar **/tests/**

Viewing the

...

Mend Report

The WhiteSource Mend report comprises of four tabs: Inventory, Outdated Libraries, Security Vulnerabilities, and License Risks. You can view the WhiteSource Mend report by following these steps:

1. Ensure that you followed the procedures in Activating the Extension and Adding a WhiteSource Mend Build Task to Your Pipeline.

2. Go to the specific build’s results page for your project, and click the WhiteSource Mend tab. The WhiteSource Mend open-source Risk Report is displayed.

...

...

...

...

• The License Distribution chart displays the distribution of licenses across the inventory.

• The License Risk Distribution chart breaks down the number of licenses by their risk level. Unknown risk level means the license risk was not analyzed by WhiteSourceMend.