Enable RenovateBot for Azure Pipelines
Tags: github, azuredevopspipelines, azuredevops, security
Published: 2023-03-02 10:48:22

---
title: Enable RenovateBot for Azure Pipelines
published: true
date: 2023-01-09 20:59:24 UTC
tags: GitHub,AzureDevOpsPipelines,AzureDevOps,Security
canonical_url: https://jessehouwing.net/azure-pipelines-enable-renovatebot/
---

![Cover image showing robots](https://jessehouwing.net/content/images/size/w2000/2023/01/7856293086_018138dfed_k.jpg)

In my report on the Security state of the Azure DevOps Marketplace I came to the unfortunate conclusion that about 40% of the extensions contain vulnerabilities. One of the recommendations for both Azure DevOps administrators and pipeline authors was to keep the Azure Pipelines Tasks up-to-date.

Unfortunately, it's hard to do that. The old UI based pipelines only show a minimal indicator and in YAML there is no indication at all. **Until today.** That is, _if you are a RenovateBot user_, use YAML pipelines and have enabled the new Azure Pipelines Preview feature:

![Enable RenovateBot for Azure Pipelines](https://jessehouwing.net/content/images/2023/01/image-2.png)
_RenovateBot telling me to update my SnykSecurityScan task to v1_

[As of version 34.92.0, Renovate now automatically suggests updates for tasks installed through the Azure DevOps Marketplace](https://github.com/renovatebot/renovate/releases/tag/34.92.0) for all _ **public** _ extensions. And the suggestions are updated weekly on Sunday.

## Installation

### GitHub

If your sources are stored in GitHub, you can install the Renovate app and grant it access to your repositories. Once you've done that you can configure Renovate through the `renovate.json` file in your repository, or by [putting a central configuration in your `.github` repository](https://github.com/jessehouwing/.github/blob/main/renovate-config.json).

For now you must explicitly activate the Azure Pipelines support:

```
{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:base"
  ],
  
  // To enable Azure Pipelines support add:
  "azure-pipelines": {
    "enabled": true
  },
  
  // If you only want to get pull requests for updates from @1 to @2 add:
  "packageRules": [ 
    {
      // Only extract major versions for Pipeline Tasks
      "matchDatasources": ["azure-pipelines-tasks"],
      "extractVersion": "^(?<version>\\d+)"
    }
  ]
}
```

_Explicitly enable Azure-Pipelines support in .github/renovate.json_

### Azure Repos

As with GitHub, you must enable the Azure Pipelines support in the config file. You must store it in the root of each repository that contains the pipelines you want to service:

```
{
  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
  "extends": [
    "config:base"
  ],
  "azure-pipelines": {
    "enabled": true
  }
}
```

_Explicitly enable Azure-Pipelines support in /renovate.json_

If your sources are stored in Azure Repos you have two options:

#### RenovateMe Extension

You can [use the RenovateMe extension](https://marketplace.visualstudio.com/items?itemName=jyc.vsts-extensions-renovate-me) from an Azure Pipeline to run Renovate against your repositories. The steps to enable RenovateMe are explained in the extension's documentation.

#### Calling renovate yourself

Or you can call Renovate from an Azure Pipeline explicitly:

```
  - bash: |
      git config --global user.email 'bot@renovateapp.com'
      git config --global user.name 'Renovate Bot'
      npx --userconfig .npmrc renovate
    env:
      TOKEN: $(System.AccessToken)
```

[All the steps to setup the pipeline are explained here](https://docs.renovatebot.com/modules/platform/azure/).

## How does it work?

The support for Azure Pipelines consists of 2 parts. One takes care of the built-in tasks, the other of the tasks from the Azure DevOps marketplace.

The built-in tasks were already supported by Renovate. [There is a job that runs weekly](https://github.com/renovatebot/renovate/blob/main/tools/static-data/generate-azure-pipelines-tasks.mjs) that scans the [microsoft/azure-pipelines-tasks](https://github.com/microsoft/azure-pipelines-tasks) repository and adds all the versions it finds there to a static datafile.

I've added a new job that indexes the Azure DevOps Marketplace by downloading [every public vsix ever published and extracting the relevant version information](https://github.com/jessehouwing/renovate-azure-devops-marketplace). The result of this job is [another static datafile that is added to renovate on a weekly basis](https://github.com/renovatebot/renovate/blob/main/tools/static-data/generate-azure-pipelines-marketplace-tasks.mjs).

[These static datafiles are released with Renovate and are used to suggest updates for your Azure DevOps Pipelines](https://github.com/renovatebot/renovate/blob/main/lib/modules/datasource/azure-pipelines-tasks/index.ts).

## What next?

Next I'll be looking to add [a datasource for Azure Pipelines that retrieves the available versions straight from your Azure DevOps organization](https://github.com/renovatebot/renovate/issues/19725). That would enable updates of **private** extensions as well as tasks that were installed directly into the organization using `tfx build tasks upload`.

If you want to support me, please consider:

- 💗 [Sponsoring me on GitHub](https://github.com/sponsors/jessehouwing).
- ⭐ [Starring the Renovate project](https://github.com/renovatebot/renovate).
- ⭐ [Starring the Renovate Azure DevOps Marketplace project](https://github.com/jessehouwing/renovate-azure-devops-marketplace)