Description

Detects when no build validation policy is enforced on the default branch of an Azure DevOps repository. Without one, no pipeline has to succeed before a pull request completes, so code that fails to compile, fails its tests or fails a security check can reach the branch the organization releases from, and the failure is discovered after the merge rather than before it.

Detection Strategy

• Lists every project in the Azure DevOps organization and every Git repository inside each project

• Keeps only the policies that are enabled, blocking and not deleted, which are the ones that can stop a merge

• Matches the build validation policy by its type identifier rather than by its display name, since the same policy is named differently in the REST reference, the web interface and the command line

• Reports a vulnerability when none of those policies is a build validation policy; a branch with no enforcing policy at all is left to the branch policy check so that one setting does not produce two findings