Using Tidelift with Azure Devops Pipelines

This Article shows you how to use the Tidelift CLI with Azure Devops Pipelines to check catalog alignment during a build stage. This allows builds to fail that include unapproved packages as of a CI/CD process.

To get started, you will need:

• A Tidelift subscription (Please contact us if you are interested in learning more about Tidelift)
• An Azure Devops (ADO) account which can access Tidelift

With the appropriate configuration, Azure Devops Pipelines can use the Tidelift CLI to run an alignment as part of your pipeline. For each Tidelift project, you can create a project and API key in Tidelift and store that key in the appropriate secrets infrastructure provided by your CI system.

An organization-level API key can also be created, which is only scoped to run alignments, but works across all projects. In this example, the API key is stored as a secret variable in the pipeline settings. Next, you need to add steps to your pipeline job that set the Tidelift API Key, checkout code from version control, download the Tidelift CLI, and run an alignment with the Tidelift CLI.

Create a Project in Tidelift and generate an API key in the Tidelift webapp

1. After logging into the Tidelift dashboard, select Projects then Create New Project. Enter the project name and remember that spaces, periods, or slashes are not valid naming characters in project names. When prompted, select the catalog you want the project to align with.
   
   
   
   
2. Close the Upload manifest files dialog to skip manually uploading manifests.
3. Select the Projects actions and settings gear on the left navigation.
4. Select Get Project Key then select Create Project Key.
   
   
   
   
5. Copy the CI/CD usage API_KEY and note the Organization-name/project-name.

In the above example:

• Organization-name: "souza-weisberg-holdings"
• project-name: "azure-devops-test-project"

Add the API Key to the ADO Pipeline Job

Next set the Tidelift API key as a secret variable. This can be done from the dashboard by selecting the pipeline then edit > variables. Name the variable and past the API key into the value field. Make sure the select the Keep this value secret option.

Add pipeline job step to check alignment with Tidelift

In ADO Pipelines:

1. Select the pipeline to use the Tidelift CLI with
2. Add a job with the steps to set the Tidelift API Key
3. Checkout code from version control
4. Download the Tidelift CLI
5. Run an alignment with the Tidelift CLI.

azure-pipelines.yml example

# Azure Devops Pipeline example for checking dependencies from version control 
against a

# Tidelift Catalog

# Set build environment variable for the Tidelift API Key

trigger:

- main

pool:

vmImage: ubuntu-latest

steps:

- script: |

 echo "Running Tidelift alignment"

 echo "Downloading Tidelift CLI"

 curl https://download.tidelift.com/cli/tidelift -o tidelift

 echo "Setting Tidelift CLI permissions"

 chmod +x tidelift

 echo "Running alignment and saving to Tidelift"

 ./tidelift alignment save 

env: 

TIDELIFT_API_KEY: $(azure-devops-test-project-key)

displayName: Tidelift Alignment

Note: The Tidelift CLI will attempt to detect the branch of the pipeline automatically in CLI v1.3.0 and later. If the branch can not be detected, the branch will need to be specified using the branch flag. Please see the CLI reference for more information.

Once the required job steps have been added to the pipeline, select Save. Test the new pipeline configuration by selecting Run Now from pipelines dashboard. Any unapproved packages that are included in the pipeline will cause the check to fail. The output will include a Tidelift link with more info and actions a developer can take to either request new packages or switch to already-approved releases.