Azure DevOps

Site admins can sync Git repositories hosted on Azure DevOps with Sourcegraph so that users can search and navigate the repositories.

To connect Azure DevOps to Sourcegraph, create a personal access token from your user settings page. Ensure that you select the following scopes:

• Code (Read)
• Project and Team
• User Profile

Additionally, under the Organization menu, select All accessible organizations to allow access to all organizations. This is required to be able to sync repositories from multiple organizations. Alternatively, site admins may also create a unique user that has access to only the selective organizations that they would like to sync with Sourcegraph.

1. Go to Site admin > Manage code hosts > Add repositories.

2. Select Azure DevOps.

3. Provide a configuration for the Azure DevOps code host connection. Here is an example configuration:

   {
     "url": "https://dev.azure.com/",
     "username": "<admin username>",
     "token": "<admin token>",
     "projects": ["org1/project1"],
     "orgs": ["org2"]
   }
   

4. Press Add repositories.

Repository syncing

Currently, all repositories belonging to the configured organizations/projects will be synced.

In addition, you may exclude one or more repositories by setting the exclude field in the code host connection.

HTTPS cloning

Sourcegraph clones repositories from Azure DevOps via HTTP(S), using the username and token required fields you provide in the configuration.

Configuration

Azure DevOps connections support the following configuration options, which are specified in the JSON editor in the site admin "Manage code hosts" area.

admin/external_service/azuredevops.schema.json

{
	// A flag to enforce Azure DevOps repository access permissions
	"enforcePermissions": false,

	// A list of repositories to never mirror from Azure DevOps Services.
	"exclude": null,
	// Other example values:
	// - [
	//     {
	//       "name": "myorg/myproject/myrepo"
	//     }
	//   ]
	// - [
	//     {
	//       "name": "myorg/myproject/myrepo"
	//     },
	//     {
	//       "name": "myorg/myproject/myotherrepo"
	//     },
	//     {
	//       "pattern": "^topsecretproject/.*"
	//     }
	//   ]

	// An array of organization names identifying Azure DevOps organizations whose repositories should be mirrored on Sourcegraph.
	"orgs": null,
	// Other example values:
	// - ["name"]
	// - [
	//     "kubernetes",
	//     "golang",
	//     "facebook"
	//   ]

	// An array of projects "org/project" strings specifying which Azure DevOps projects' repositories should be mirrored on Sourcegraph.
	"projects": null,
	// Other example values:
	// - ["org/project"]

	// The Personal Access Token associated with the Azure DevOps username used for authentication.
	"token": null,

	// URL for Azure DevOps Services, set to https://dev.azure.com.
	"url": null,
	// Other example values:
	// - "https://dev.azure.com"

	// A username for authentication with the Azure DevOps code host.
	"username": null
}

Webhooks

Please consult this page in order to configure webhooks.

Permissions syncing

User-level permissions syncing is supported for Azure DevOps code host connections. Here is the list of prerequisites:

1. Configure Azure DevOps as an OAuth provider by consulting this page

2. Next verify that users can now sign up / login to your Sourcegraph instance with your Azure DevOps OAuth provider

3. Set the following in your Azure DevOps code host connection:

   {
     // ...
     "enforcePermissions": true
   }
   

4. For each Azure DevOps organization that is part of the orgs or projects list in the code host configuration, enable Third-party application access via OAuth from Organization settings > Security > Policies

Since permissions are already enforced by setting enforcePermission in the code host configuration, even though user permissions may not have synced completely, users will not have access to any repositories that they cannot access on Azure DevOps. As the user permissions sync progresses and eventually completes, they will be able to access the complete set of repositories on Sourcegraph that they can already access on Azure DevOps.

Rate limits

When Sourcegraph hits a rate limit imposed by Azure DevOps, Sourcegraph waits the appropriate amount of time specified by the code host before retrying the request. You can read more about how Azure DevOps imposes rate limits here.