@codemod/azure-pipelines-pin-external-task-version
Read-only analysis codemod for unpinned external Azure Pipelines task versions.
It scans Azure Pipelines YAML definitions for task: steps that reference extension-qualified tasks without an explicit literal major version such as Publisher.Task@1.
The codemod does not rewrite source files. It emits structured findings and these metrics:
azure_pipelines_unpinned_external_task_occurrenceskeyed bytaskIdentifierazure_pipelines_unpinned_external_task_fileskeyed byfilePathazure_pipelines_unpinned_external_task_reasonkeyed byreasonazure_pipelines_unpinned_external_task_namespacekeyed bypublisherNamespaceazure_pipelines_unpinned_external_task_template_contextkeyed bycontextType
Each finding includes file path, YAML path, line and column, raw task value, normalized task identifier, publisher namespace, reason category, and remediation guidance.
Installation
Usage
The workflow scans repository YAML files with the YAML parser and reports findings for external-style task identifiers in task: fields under Azure Pipelines steps collections.
Flagged examples:
task: MyPublisher.MyTasktask: Publisher.Task@task: Publisher.Task@$(TaskVersion)task: Publisher.Task@${{ parameters.version }}task: Publisher.Task@latest
Not flagged:
task: MyPublisher.MyTask@1task: Bash@3bash: echo hiscript: npm test- Strings outside a
task:field
Remediation guidance:
Pin the external task to an explicit literal major version, e.g. Publisher.Task@1, after validating the intended supported version from the publisher documentation or marketplace listing.
Run locally:
Development
License
MIT