PSRules using Jenkins Pipelines

[vishalgoyal16444]

Dear All,

Is it possible to run PSRules engine using Jenkins Pipelines against a codebase hosted on Azure DevOps repos or Gitlab.

We leverage on-premises Jenkins and not Azure DevOps for running our pipelines.

FYI. We are able to run the PSRules engine for our Azure subscription to get assets inventory and rules output.

Thanks,
Vishal.

[BernieWhite]

@vishalgoyal16444 Absolutely. PSRule can be installed and run via PowerShell and it works the same except there isn't a native Jenkins plugin specifically for it.

If you have PSRule already running to get scan an Azure subscription you are mostly already there. In Jenkins you would checkout your repo, then call Assert-PSRule -InputPath '.' -Format File from PowerShell from the working path of the repo root.

Assert-PSRule has some additional parameters that you may want to set or configure via the ps-rule.yaml option file.

An advanced example of how to bootstrap it is here

I'd suggest running a Linux container that has PowerShell pre-installed. If you already have one customised with Azure PowerShell or Azure CLI you might be able to use that. Otherwise, look at the PowerShell image mcr.microsoft.com/powershell.

A full list of PowerShell image tags can be found here: https://mcr.microsoft.com/v2/powershell/tags/list

Use the installing locally instructions to install the PSRule and PSRule for Azure modules.

@ms-sambell You may have some additional input here.

[BernieWhite]

@vishalgoyal16444 If either of these answers solved your question could to please mark as answer.

[ms-sambell]

You definitely can.

On top of what Bernie said, you should be able to set this up by:

1. Adding the PsRules module into your Jenkins build agent (container or VM) by baking in the module, or adding a startup task for when the build agent is created. If those options aren't available just install it during the job execution - Install Guide.
2. Next either create a Powershell script that Jenkins will call during the pipeline or execute the Assert-PSRule -Module 'PSRule.Rules.Azure' in line. I suggest creating a Powershell script so your team can run the PsRules for Azure scans locally (pre-commit check). The script would look like this: PsRules local execution example. In the example, the -InputPath would be the directory within your Azure DevOps repository that contains the ARM templates or Bicep modules.

There are a few different output options for the PsRules results, so experiment with them to determine which one works best for your use case: additional outputs.