azure-devops-secure-file-can-read

A pipeline stage that uses DownloadSecureFile@1 (or equivalent) materializes the secure file on the agent disk; pipeline code can read the certificate, SSH key, or credential file.

derived azure emits CanReadSecret

match

A conjunctive graph pattern. Variables (?x) bind node ids; every clause must hold.

where

emit

source type	`BuildWorker`
target type	`Secret`
source	`?pipeline`
target	`?secure_file`
permissions	`Use permission on secure file (DevOps Library namespace)`
state logic	ACTIVE when the pipeline has Use permission on the secure file and the task is present in the pipeline YAML. CONDITIONAL(service_state) if the secure file is locked (authorized for specific pipelines only and this one is not on the list).

source type

BuildWorker

target type

Secret

source

?pipeline

target

?secure_file

permissions

Use permission on secure file (DevOps Library namespace)

state logic

ACTIVE when the pipeline has Use permission on the secure file and the task is present in the pipeline YAML. CONDITIONAL(service_state) if the secure file is locked (authorized for specific pipelines only and this one is not on the list).

Narrative

{pipeline.name} downloads secure file {secure_file.name} to the agent disk during the job; pipeline code can read the file at the path provided by DownloadSecureFile@1.

Raw rule rules/derived/azure/devops.yaml

id: azure-devops-secure-file-can-read
emits: CanReadSecret
description: A pipeline stage that uses DownloadSecureFile@1 (or equivalent) materializes the secure file
  on the agent disk; pipeline code can read the certificate, SSH key, or credential file.
applies_to:
- azure
match:
- - pipeline: null
  - HasPolicy
  - secure_file: null
where:
- node_type(?pipeline) == BuildWorker
- node_type(?secure_file) == Secret
- ?secure_file.provider_type == Microsoft.DevOps/securefile
- ?pipeline YAML references ?secure_file via DownloadSecureFile@1 task or secureFile input
emit:
  source_type: BuildWorker
  target_type: Secret
  source: ?pipeline
  target: ?secure_file
  permissions:
  - Use permission on secure file (DevOps Library namespace)
  conditions: []
  state_logic: ACTIVE when the pipeline has Use permission on the secure file and the task is present
    in the pipeline YAML. CONDITIONAL(service_state) if the secure file is locked (authorized for specific
    pipelines only and this one is not on the list).
  confidence: 0.9
  derived_from: []
  false_positive_note: The secure file is materialized as a temporary file on the agent disk at the path
    returned by the task's secureFilePath output variable. On Microsoft-hosted agents the file is deleted
    after the job; on self-hosted agents, poor cleanup may persist it. The file content (certificate,
    SSH key) is fully accessible to job code.
  narrative: '{pipeline.name} downloads secure file {secure_file.name} to the agent disk during the job;
    pipeline code can read the file at the path provided by DownloadSecureFile@1.'