Sonatype Reachability Analysis in Azure DevOps Pipelines
See how Sonatype evaluates policy with call flow analysis in Azure DevOps pipelines, so your team can identify vulnerabilities that are actually reachable in your application.
Related Resources
Frequently Asked Questions
What is reachability analysis?
Reachability analysis follows your application's call paths to determine whether a vulnerable method can actually be reached at runtime. It adds practical context to policy results so teams can focus remediation effort where it matters most.
How do I enable call flow analysis in Azure DevOps?
Enable the call flow parameter in your Sonatype task configuration. You can set it in your pipeline YAML or in the Azure DevOps task interface when creating or updating a pipeline.
Can I limit the analysis to particular namespaces?
Yes. Add one or more namespaces to the callflow namespaces setting. Narrowing the scope can improve both the speed and precision of the analysis for larger applications.
Where do I see the results?
The pipeline task log shows when call flow analysis begins. In Sonatype, the application report identifies vulnerable components and flags policy violations with their reachable status.