In Azure Pipelines, run a script step that installs the Safeguard CLI and runs safeguard detect with SARIF output into the build artifact staging directory, then add a publish step so the file is kept with the run, even when a later step fails.
The pipeline
Safeguard's CI/CD page describes an Azure DevOps script step that installs the CLI and writes SARIF to the staging directory. Here is a complete version:
trigger:
- main
pool:
vmImage: ubuntu-latest
steps:
- script: |
export SAFEGUARD_VERSION="<version from the download page>"
curl -fsSL https://cli.safeguard.sh/install | bash
displayName: Install Safeguard CLI
- script: |
safeguard detect --path . --format sarif --output "$(Build.ArtifactStagingDirectory)/safeguard.sarif"
displayName: Safeguard detect
- publish: $(Build.ArtifactStagingDirectory)
artifact: safeguard
condition: always()
The publish keyword is a shortcut for the Publish Pipeline Artifact task, per Microsoft's documentation, with a target path and an artifact name. Adding the always condition keeps the file when something else failed.
Details worth knowing
Pipeline artifacts are tied to the run. Microsoft notes that deleting a pipeline run deletes the artifacts attached to it, so do not use them as your long term record.
If a later job needs the file, use the download keyword in a job that depends on the first one. The documentation says the list of published artifacts is only available in dependent jobs.
If you consume the artifact on a different operating system, avoid file names with characters that Windows rejects. The default file name above is safe.
The sign-in question
The documented examples do not include a login step. The CLI documentation does not describe an API key variable for CI, so do not invent one. If your use case needs the CLI to talk to a tenant, check the CLI docs or ask Safeguard support before wiring secrets into a pipeline.
Windows agents
The PowerShell installer exists for Windows, and the CLI ships a Windows x86_64 build. If your agent pool is Windows, swap the install script for the PowerShell one-liner and use backslash paths. Windows on ARM is not listed for the CLI.
Triggers and scope
The trigger block above runs on pushes to main. For pull requests in Azure Repos, branch policies can run a build validation pipeline, which is where a scan earns its keep. For repositories hosted elsewhere, use the pr trigger keyword where the host supports it.
Keep the install step in a template once you have more than a couple of pipelines. A single template with the pinned version means one edit updates every repository that uses it.
Quick check
Where does the SARIF file end up?
In the build artifact staging directory, then in a pipeline artifact named safeguard once the publish step runs.
Does Azure DevOps render SARIF by itself?
Not in the documented flow. Treat the file as an artifact, and check which viewers your organisation has installed.
Where Safeguard fits
Safeguard can also connect to Azure DevOps repositories as an integration, which scans them without a pipeline step. Choose between the two in connect the repository or run the CLI.
Sources
- Safeguard docs: CI/CD Integration
- Safeguard docs: CLI system configuration
- Microsoft Learn: Publish and download pipeline artifacts
Last reviewed: 19 October 2026.
