Skip to content
AppArch AppArch Docs

Azure DevOps

Azure DevOps is connected with a personal access token (PAT). Only Azure DevOps Services (dev.azure.com) is supported; Azure DevOps Server is not.

Creating a PAT

Section titled “Creating a PAT”

In Azure DevOps open User settings → Personal access tokens → New Token, pick the organisation and grant:

  • Code (Read & Write)
  • Pull Request Threads (Read & Write) - for ArchPilot’s PR comments.

Code (Read) alone is enough for read-only use; ArchPilot then cannot comment. Azure DevOps shows the token only once.

Connecting

Section titled “Connecting”
  1. Credentials → Add credential → Azure DevOps.
  2. Enter the organisation slug only - the part after dev.azure.com/ (e.g. myorg). AppArch adds dev.azure.com/ itself.
  3. Paste the PAT. A project name is optional and narrows the repository list to one project.
  4. Save - the connection is tested against dev.azure.com.

Azure DevOps has no endpoint for reading a token’s scopes or expiry, so the connection test is the only check, and no expiry date is shown on the credential.

CI (Azure Pipelines)

Section titled “CI (Azure Pipelines)”
trigger: none
pr: ['*']
pool: { vmImage: ubuntu-latest }
steps:
  - checkout: self
    fetchDepth: 0   # the target branch is then in the clone: the change's own files and its merge base
  - script: |
      echo "$(APPARCH_INSTALLATION_KEY)" | docker login hub.apparch.io -u "$(APPARCH_INSTALLATION_ID)" --password-stdin
      docker run --rm -v "$(Build.SourcesDirectory):/workspace:ro" \
        -e APPARCH_Collector__Token="$(APPARCH_TOKEN)" \
        -e APPARCH_Collector__ApiUrl="https://api.yourdomain.com" \
        -e SYSTEM_PULLREQUEST_PULLREQUESTID="$(System.PullRequest.PullRequestId)" \
        -e SYSTEM_PULLREQUEST_TARGETBRANCH="$(System.PullRequest.TargetBranch)" \
        -e SYSTEM_TEAMPROJECT="$(System.TeamProject)" \
        -e BUILD_REPOSITORY_NAME="$(Build.Repository.Name)" \
        -e SYSTEM_COLLECTIONURI="$(System.CollectionUri)" \
        -e BUILD_SOURCEVERSION="$(Build.SourceVersion)" \
        hub.apparch.io/collectors/dotnet:latest /workspace

Define APPARCH_TOKEN, APPARCH_INSTALLATION_ID and APPARCH_INSTALLATION_KEY as secret variables in the pipeline. The first is the project’s runner token; the last two are the installation credential the image pull authenticates with. The SYSTEM_PULLREQUEST_PULLREQUESTID variable is what tells the runner it is reviewing a pull request.