Configure Azure DevOps Posting User
Code reviews for your Azure DevOps projects will be posted as a "PullRequest" member of your Azure DevOps team. In order to post code reviews, the user must be created in your Azure DevOps instance.
Last updated
Code reviews for your Azure DevOps projects will be posted as a "PullRequest" member of your Azure DevOps team. In order to post code reviews, the user must be created in your Azure DevOps instance.
Last updated
The Azure DevOps posting user must be created by an individual on your team with the following administrative permissions:
Log in to Azure DevOps as an Administrator and create a new user with the username PullRequest. PullRequest reviewers and systems will use this user to post code review content.
We also recommend adding the HackerOne or PullRequest logo as the posting user's avatar - or one which is easily distinguishable from other members of your development teams.
Add the posting user to all of the organizations/repositories you want code review on. Be sure to grant the user WRITE access so it's able to post comments.
In order to list a repository's collaborators, WRITE permissions are required. HackerOne will never write or modify code in your repositories without explicit consent. Read more about how we keep your code and data secure here.
Log into Azure DevOps as the posting user you just created.
Click the profile icon at the top right and click Security from the drop-down menu. From here, click on Personal access tokens from the sidebar on the left. This should be accessible from the following path:
Click New Token and create a Personal Access Token with the following properties:
In order to function properly write permissions are required. PullRequest will never write or modify code in your repositories. Read more about how we keep your code and data secure here.
Once generated, copy the personal access token to your clipboard so we can configure the connection to Azure DevOps.
Now, it's time to return to that text file we're editing on the proxy server. Go ahead and set the following keys based on what was configured above.
Make sure the PROVIDER_USERNAME is spelled exactly as the username of the posting user that was created. We highly recommend "PullRequest" or "HackerOne" (all one word, PascalCase) to maintain communication consistency.
