Install Mend Developer Platform for Azure DevOps Repos

Overview

In this article, you will find step-by-step instructions for installing Mend Renovate and the Mend Developer Platform for Azure DevOps Repos.

Getting it done

Prerequisites

Access to an Azure DevOps Repos organization and a user with Admin privileges on the organization/project level
The Azure DevOps Repos organization must allow Third-Party Access Via OAuth (see step 7 of this guide)
If your workspace has conditional access to certain IP addresses, add the following IPs to your allowlist:
- Non-EU customers (e.g., saas.mend.io) -
  34.197.147.244
  34.239.12.110
  35.169.49.18
  44.206.201.73
  52.0.106.131
  52.45.235.219
  52.207.155.173
  54.243.119.210
  98.82.39.166
  107.20.215.6
- saas-eu.mend.io customers -
  52.31.29.228

Also, for paid Mend customers only:

Mend Account with SCA/SAST entitlement on the Mend Platform
Admin Access to Mend Platform to generate Activation Key

Notes:

The Azure DevOps user who will onboard the organization will be the one that will be used to create commit statuses, work items, and PRs from their own account. We recommend creating a bot-user solely dedicated to the integration with the Mend Developer Platform.
When an Azure Repos project is onboarded with a Mend License Key, this key will be applied to all other projects of this organization (including projects that were onboarded before this connection).
Mend License Key is used for the entire Azure Repos organization, and in order to change it, it’s required that the Azure Repos organization admin does that in the Organization Settings.
A GitHub.com token is recommended for running scans. Without it, GitHub release notes won’t be retrieved, which will result in a warning message.

Mend EU Environment

If you are a Mend customer working in our EU environment (saas-eu.mend.io), you will be able to link the integration to your Mend organization only if you use the Mend Developer Platform in the EU environment: https://developer-eu.mend.io/. By doing this, all of the org and user data that we process will stay in the EU zone.

Installing Mend Developer Platform for Azure DevOps Repos

For users who are migrating from the old Mend for Azure Repos integration, please refer to the instructions in our Migration Guide for Mend Developer Platform documentation.

Log in to the Mend Developer Portal and authorize with your Azure DevOps user.
Complete the Mend Registration step and click CONTINUE.
After registration is completed, you’ll be navigated to the Mend Developer Platform main dashboard.

Renovate-only: Users of the free Renovate-only plan should skip to step 6.
Paid Mend customers: Follow all steps below.

Open the Mend Platform and navigate to Integrations under the Settings toggle, then select the Azure Repos integration.
Copy the Activation Key by clicking on Get Activation Key (this will be used in step #10).
In the Mend Developer Portal, click on “Install more” to install Mend Renovate or Mend Developer Platform in your Azure DevOps Repos project(s):
Select the Azure DevOps Repos project(s) that you want to integrate with Mend, and click CONTINUE.
Note: Only projects with Third-Party Access Via OAuth enabled in their Azure DevOps Repos Organization will appear in this list. (See instructions below.)

Enable OAuth in Azure DevOps
In order to view the available projects for onboarding, OAuth must be enabled in the Azure DevOps environment. The toggle for enabling OAuth in Azure DevOps is located at: Organization settings → Policies → Application connection policies → Third party application access via OAuth.

A pop-up window will appear asking you to accept a redirection to Azure DevOps to authenticate and install the Mend integration for the selected project(s).
Note: You will only need to complete this step once. The user's refresh token will also be used for future onboarding.
The Setup Wizard will open, where two product options will be presented.
Renovate-only users: Choose Renovate only, then skip to step 12.
Paid Mend customers: Choose Mend Application Security, then continue to follow all steps.
Using the Activation Key copied from the Mend Platform (as described in step #5), paste the Activation Key into the Mend License Key box to connect your Azure DevOps organization with your paid Mend account.
Click CONNECT PROJECT, and then CONTINUE.
You’ll see the name of the Mend Organization that your organization is now connected to.
Now you have the option to activate the Mend App for all repositories or only selected repositories. Select your preference, and then click CONTINUE.

During the installation process, please note that the Mend Developer Platform app is installed for the entire project. This means that it will have access to all repositories within the project, regardless of the repositories selected during installation.
Selecting repositories at this step defines which will have the available engines enabled and activated.

The next screen is different for Renovate-only users and paid Mend customers.
Renovate-only users: Select “Silent mode” or “Interactive mode”, the press CONTINUE.
Paid Mend customers: Select “Scan only” or “Scan and alert”, then press CONTINUE.

This completes the installation steps for Mend Renovate and Mend Developer Platform.

Organization Settings

This is the page accessible to the Azure Repos Organization Admin, where you can link or unlink a connection to a Mend Organization.

When selecting CHANGE MEND ORG, a pop-up window will appear asking you to insert the new Mend License Key of the organization you would like to connect.

Refresh Token

Mend uses the Refresh Token to create items in the repository on behalf of the onboarded user who installed the integration.

In case you are the user who onboarded projects with the Mend Developer Platform integration, you will find in your Profile Settings page the list of those projects.

Notes:

You can remove integration for specific projects or delete the refresh token. Note that removing the refresh token will cause all projects that were onboarded with this user to uninstall the integration. The same will happen if this user deletes their account on this page.
If you would like to pass the role of bot user to another user, you’ll need to uninstall all or selected projects, and then the new user should re-onboard them. In this case, the project's configuration and repos will be preserved, and the app will continue working under a new bot user.