targetfilePath
File, directory, or checked-out repository path to scan.
- Required
- true
- Default
$(Build.SourcesDirectory)
Azure DevOps Task Reference
This page is generated from azure-devops/tasks/PicketScanV1/task.json.
Task name: PicketScan
Version: 1.0.5
Inputs
Section titled “Inputs”picketPathstring
Path to the Picket executable or command name available on PATH.
- Required
- true
- Default
picket
configfilePath
Optional configuration path. A custom config replaces Picket's embedded native default rules; extend.useDefault restores only the Gitleaks defaults.
- Required
- false
- Default
- -
profilepickList
Scan profile. Use gitleaks only when strict compatibility behavior is desired.
- Required
- true
- Default
picket
rulePacksstring
Optional comma-separated built-in rule packs: picket-strict and picket-experimental.
- Required
- false
- Default
- -
reportFormatsstring
Comma-separated report formats: json, jsonl, sarif, html, csv, junit, gitlab, toon. JSONL is added internally when omitted so task outputs and annotations stay accurate.
- Required
- true
- Default
sarif,jsonl,html
reportDirectoryfilePath
Directory where task reports are written.
- Required
- true
- Default
$(Build.ArtifactStagingDirectory)/picket
failOnpickList
Task failure policy. Scanner execution errors always fail the task; never only suppresses finding-based failure.
- Required
- true
- Default
findings
baselinePathfilePath
Optional baseline report used to suppress known findings.
- Required
- false
- Default
- -
ignorePathfilePath
Optional .picketignore path containing native stable finding fingerprints or content hashes.
- Required
- false
- Default
- -
resultsstring
Optional comma-separated validation states to keep before reports and failure enforcement.
- Required
- false
- Default
- -
onlyVerifiedboolean
Keep only offline structurally valid findings and live active findings.
- Required
- true
- Default
false
redactstring
Redaction percentage from 0 through 100.
- Required
- true
- Default
100
verifyboolean
Enable opt-in live provider verification.
- Required
- true
- Default
false
annotationsboolean
Emit safe Azure DevOps log issues for findings with source locations.
- Required
- true
- Default
true
annotationLimitstring
Maximum number of log issues emitted by the task. Use 0 to disable annotation output.
- Required
- true
- Default
50
publishSarifboolean
Publish the SARIF report as a build artifact when it exists.
- Required
- true
- Default
true
publishJsonlboolean
Publish the native JSONL report as a build artifact when it exists.
- Required
- true
- Default
true
publishHtmlboolean
Publish the HTML report as a build artifact when it exists.
- Required
- true
- Default
true
cacheboolean
Pass a native Picket scan cache directory to the CLI.
- Required
- true
- Default
true
cacheModepickList
Cache storage mode. Use raw only in trusted private jobs.
- Required
- true
- Default
secret-hash-only
cachePathfilePath
Cache directory passed to the CLI.
- Required
- true
- Default
$(Pipeline.Workspace)/.picket/cache
maxTargetMegabytesstring
Optional positive maximum file size in decimal MB for content rules.
- Required
- false
- Default
- -
maxArchiveDepthstring
Optional maximum nested archive traversal depth.
- Required
- false
- Default
- -
maxArchiveEntriesstring
Optional maximum number of files extracted from archives.
- Required
- false
- Default
- -
maxArchiveMegabytesstring
Optional maximum decompressed archive payload in decimal MB.
- Required
- false
- Default
- -
maxArchiveRatiostring
Optional maximum archive expansion ratio.
- Required
- false
- Default
- -
timeoutstring
Optional scan timeout in seconds. Use 0 to disable.
- Required
- false
- Default
- -
azureDevOpsOrganizationstring
Optional organization name or URL for remote Azure DevOps enumeration.
- Required
- false
- Default
- -
azureDevOpsEndpointstring
Optional endpoint override for Azure DevOps Server.
- Required
- false
- Default
- -
azureDevOpsTokenEnvstring
Environment variable containing the PAT or job token. The token value is not passed on the command line.
- Required
- false
- Default
- -
azureDevOpsTokenKindpickList
Credential transport: pat for personal access tokens or bearer for job and Entra tokens.
- Required
- true
- Default
pat
azureDevOpsProjectstring
Optional project filter.
- Required
- false
- Default
- -
azureDevOpsRepositorystring
Optional repository filter.
- Required
- false
- Default
- -
azureDevOpsBranchstring
Optional branch name.
- Required
- false
- Default
- -
azureDevOpsPullRequeststring
Optional pull request ID to scan.
- Required
- false
- Default
- -
azureDevOpsIncludeWikisboolean
Include Azure DevOps wiki backing repositories.
- Required
- true
- Default
false
azureDevOpsBuildIdstring
Build ID used when scanning build artifacts or build logs.
- Required
- false
- Default
- -
azureDevOpsIncludeArtifactsboolean
Include build artifact contents for the selected build.
- Required
- true
- Default
false
azureDevOpsIncludeLogsboolean
Include build logs for the selected build.
- Required
- true
- Default
false
azureDevOpsReleaseIdstring
Classic release ID used when scanning release build artifacts.
- Required
- false
- Default
- -
azureDevOpsIncludeReleaseArtifactsboolean
Include build artifact contents referenced by the selected classic release.
- Required
- true
- Default
false
azureDevOpsIncludePackagesboolean
Include the latest NuGet package versions from readable Azure Artifacts feeds.
- Required
- true
- Default
false
azureDevOpsFeedstring
Optional feed name or ID filter.
- Required
- false
- Default
- -
azureDevOpsPackagestring
Optional exact NuGet package name filter.
- Required
- false
- Default
- -
azureDevOpsPackageVersionstring
Optional exact NuGet package version. Requires an exact package name.
- Required
- false
- Default
- -
azureDevOpsMaxArtifactMegabytesstring
Positive per-artifact archive download cap.
- Required
- false
- Default
- -
azureDevOpsMaxLogMegabytesstring
Positive per-log download cap.
- Required
- false
- Default
- -
azureDevOpsMaxPackageMegabytesstring
Positive per-package archive download cap. Requires Azure Artifacts package scanning.
- Required
- false
- Default
- -
allowNonPublicSourceEndpointsboolean
Permit private, loopback, link-local, or otherwise non-public endpoint addresses.
- Required
- true
- Default
false
allowInsecureSourceEndpointsboolean
Permit HTTP source endpoints for trusted local tests or explicitly accepted self-hosted environments.
- Required
- true
- Default
false
extraArgsmultiLine
Additional CLI arguments appended after validated task inputs, one argument per line.
- Required
- false
- Default
- -
Outputs
Section titled “Outputs”exitCodeOutput
Raw scanner exit code before task failure enforcement.
findingsOutput
Number of emitted native JSONL finding records after filters.
sarifPathOutput
Absolute path to the SARIF report when enabled.
jsonlPathOutput
Absolute path to the JSONL report when enabled.
htmlPathOutput
Absolute path to the HTML report when enabled.
annotationsOutput
Number of Azure DevOps log issues emitted.