Read-only analysis codemod that scans Azure Pipelines YAML for external task steps without an explicit literal major version and emits security metrics.
Read-only analysis codemod for unpinned external Azure Pipelines task versions.
It scans Azure Pipelines YAML definitions for task: steps that reference extension-qualified tasks without an explicit literal major version such as Publisher.Task@1.
The codemod does not rewrite source files. It emits structured findings and these metrics:
azure_pipelines_unpinned_external_task_occurrences keyed by taskIdentifier
azure_pipelines_unpinned_external_task_files keyed by filePath
azure_pipelines_unpinned_external_task_reason keyed by reason
azure_pipelines_unpinned_external_task_namespace keyed by publisherNamespace
azure_pipelines_unpinned_external_task_template_context keyed by contextType
Each finding includes file path, YAML path, line and column, raw task value, normalized task identifier, publisher namespace, reason category, and remediation guidance.
Installation
bash
codemod run @codemod/azure-pipelines-pin-external-task-version
# Or run the local workflow against a target repo
codemod run -w workflow.yaml
Usage
The workflow scans repository YAML files with the YAML parser and reports findings for external-style task identifiers in task: fields under Azure Pipelines steps collections.
Flagged examples:
task: MyPublisher.MyTask
task: Publisher.Task@
task: Publisher.Task@$(TaskVersion)
task: Publisher.Task@${{ parameters.version }}
task: Publisher.Task@latest
Not flagged:
task: MyPublisher.MyTask@1
task: Bash@3
bash: echo hi
script: npm test
Strings outside a task: field
Remediation guidance:
Pin the external task to an explicit literal major version, e.g. Publisher.Task@1, after validating the intended supported version from the publisher documentation or marketplace listing.
Run locally:
bash
pnpm dlx codemod@latest workflow run -w workflow.yaml -t /path/to/repo
Development
bash
# Run fixture tests
pnpm test
# Type-check the package
pnpm run check-types
# Validate the workflow file
pnpm dlx codemod@latest workflow validate -w workflow.yaml
License
MIT
Ready to evolve your codebase?
Build tailored, compiler-aware skills to assess, plan, and automate complex codebase changes.