Analyze code directly in Datadog

For GitHub repositories, you can run Datadog SCA scans directly on Datadog infrastructure. To get started, navigate to Code Security settings.

Analyze code in your CI Pipelines

Run SCA by following instructions for your chosen CI provider below. Datadog SCA offers native support for:

• Github
• Azure DevOps
• Gitlab
• Others (via CLI)

You must scan your default branch at least once before results appear in Datadog Code Security.

If GitHub is your source code management provider, you must configure a GitHub App using the GitHub integration tile and set up the source code integration to see inline code snippets and enable pull request comments.

When installing a GitHub App, the following permissions are required to enable certain features:

• Content: Read, which allows you to see code snippets displayed in Datadog
• Pull Request: Read & Write, which allows Datadog to add feedback for violations directly in your pull requests using pull request comments.
• Checks: Read & Write, which allows you to create checks on SAST violations to block pull requests

If Azure DevOps is your source code management provider, before you can begin installation, you must request access to the closed Preview using the form above. After being granted access, follow the instructions below to complete the setup process.

Note: Azure DevOps Server is not supported.

Create and register a Microsoft Entra app

If you are an admin in your Azure portal, you can configure Entra apps to connect your tenant to Datadog.

1. Navigate to Code Security setup.
2. In Activate scanning for your repositories, click Manage Repositories.
3. Select CI Pipelines.
4. Select the scan types you want to use.
5. Select Azure DevOps as your source code management provider.
6. If this is your first time connecting an Azure DevOps organization to Datadog, click Connect Azure DevOps Account.
7. When connecting a Microsoft Entra tenant for the first time you will need to go to your Azure Portal to register a new application. During this creation process, ensure the following:
   1. You select Accounts in this organizational directory only (Datadog, Inc. only - Single tenant) as the account type.
   2. Set the redirect URI to Web and paste the URI given to you in the instructions.
8. Copy the values for Application (client) ID and Directory (tenant) ID and paste them into Datadog.
9. In the Azure Portal for your app registration, navigate to Manage > Certificates & secrets and switch to Client secrets.
10. Click New client secret and create a secret with your desired description and expiration values.
11. Copy and paste the string in the Value column for your new secret, paste it into Datadog, and click Create Configuration to complete connecting your Entra tenant to Datadog.
12. Add one or more Azure DevOps organizations by pasting the organization slug into Datadog and then adding your Service Principal as a user by going to Organization settings > Users > Add users.
    1. Your Service Principal will need the Basic access level and at least the Project Contributor security group.
13. Click Submit Organization.

Configure project service hooks

To enable all Code Security features in Azure DevOps, you’ll need to use a Datadog API key to configure service hooks for your projects.

First, set your environment variables (note: the Datadog UI will fill these values out for you):

export AZURE_DEVOPS_TOKEN="..."                 # Client Secret Value
export DD_API_KEY="..."                         # Datadog API Key

Then, replace the placeholders in the script below with your Datadog Site and Azure DevOps organization name to configure the necessary service hooks on your organization’s projects:

curl https://raw.githubusercontent.com/DataDog/azdevops-sci-hooks/refs/heads/main/setup-hooks.py > setup-hooks.py && chmod a+x ./setup-hooks.py
./setup-hooks.py --dd-site="<dd-site>" --az-devops-org="<org-name>"

Click here to see our CLI that automates this process.

If GitLab is your source code management provider, before you can begin installation, you must request access to the closed Preview using the form above. After being granted access, follow these instructions to complete the setup process.

If you are using another source code management provider, configure SCA to run in your CI pipelines using the datadog-ci CLI tool and upload the results to Datadog.

GitHub Actions

SCA can run as a job in your GitHub Actions workflows. The action provided below invokes Datadog’s recommended SBOM tool, Datadog SBOM Generator, on your codebase and uploads the results into Datadog.

Add the following code snippet in .github/workflows/datadog-sca.yml.

Make sure to replace the dd_site attribute with the Datadog site you are using.

on: [push]

name: Datadog Software Composition Analysis

jobs:
  software-composition-analysis:
    runs-on: ubuntu-latest
    name: Datadog SBOM Generation and Upload
    steps:
    - name: Checkout
      uses: actions/checkout@v3
    - name: Check imported libraries are secure and compliant
      id: datadog-software-composition-analysis
      uses: DataDog/datadog-sca-github-action@main
      with:
        dd_api_key: ${{ secrets.DD_API_KEY }}
        dd_app_key: ${{ secrets.DD_APP_KEY }}
        dd_site: "datadoghq.com"

Related GitHub Actions

Datadog Static Code Analysis (SAST) analyzes your first-party code. Static Code Analysis can be set up using the datadog-static-analyzer-github-action GitHub action.

Azure DevOps Pipelines

To add a new pipeline in Azure DevOps, go to Pipelines > New Pipeline, select your repository, and then create/select a pipeline.

Add the following content to your Azure DevOps pipeline YAML file:

trigger:
  branches:
    include:
      # Optionally specify a specific branch to trigger on when merging
      - "*"

pr:
  branches:
    include:
      - "*"

variables:
  - group: "Datadog"


jobs:
  - job: DatadogSoftwareCompositionAnalysis
    displayName: "Datadog Software Composition Analysis"
    steps:
      - script: |
          npm install -g @datadog/datadog-ci
          export DATADOG_OSV_SCANNER_URL="https://github.com/DataDog/datadog-sbom-generator/releases/latest/download/datadog-sbom-generator_linux_amd64.zip"
          mkdir -p /tmp/datadog-sbom-generator
          curl -L -o /tmp/datadog-sbom-generator/datadog-sbom-generator.zip $DATADOG_OSV_SCANNER_URL
          unzip /tmp/datadog-sbom-generator/datadog-sbom-generator.zip -d /tmp/datadog-sbom-generator
          chmod 755 /tmp/datadog-sbom-generator/datadog-sbom-generator
          /tmp/datadog-sbom-generator/datadog-sbom-generator scan --output=/tmp/sbom.json .
          datadog-ci sbom upload /tmp/sbom.json          
        env:
          DD_APP_KEY: $(DD_APP_KEY)
          DD_API_KEY: $(DD_API_KEY)
          DD_SITE: datadoghq.com

For all other providers, use the customizable script in the section below to run SCA scans and upload results to Datadog.