Scan your staging site in Azure Pipelines after each deploy, fail the run on what you choose, and see each test in the run's Tests tab.

Before you start

A verified domain for the site.
An API key. Use a team key in CI: see Keys for CI.

Add the steps

azure-pipelines.yml

steps:
  - task: NodeTool@0
    inputs:
      versionSpec: '22.x'
  - script: npx -y @valiqai/cli scan "$STAGING_URL" --fail-on blocker --output $(Build.ArtifactStagingDirectory)/valiqai-junit.xml
    displayName: ValiqAI scan
    env:
      # Secret variables reach a script only when mapped like this.
      VALIQAI_API_KEY: $(VALIQAI_API_KEY)
      STAGING_URL: https://staging.example.com
  - task: PublishTestResults@2
    condition: always()
    inputs:
      testResultsFormat: JUnit
      testResultsFiles: $(Build.ArtifactStagingDirectory)/valiqai-junit.xml

The key goes in: Pipelines › your pipeline › Edit › Variables, as a secret named VALIQAI_API_KEY. Results show in: the run's Tests tab.

A secret variable reaches a script only when it's mapped under env, as above.

Deploy, then scan

Put the scan in a stage that depends on the deploy:

YAML

trigger:
  branches:
    include: [main]

pool:
  vmImage: ubuntu-latest

stages:
  - stage: Deploy
    jobs:
      - job: deploy
        steps:
          - script: ./scripts/deploy-staging.sh

  - stage: Scan
    dependsOn: Deploy
    jobs:
      - job: valiqai
        steps:
          - task: NodeTool@0
            inputs:
              versionSpec: '22.x'
          - script: npx -y @valiqai/cli scan "$STAGING_URL" --fail-on blocker --output $(Build.ArtifactStagingDirectory)/valiqai-junit.xml
            displayName: ValiqAI scan
            env:
              VALIQAI_API_KEY: $(VALIQAI_API_KEY)
              STAGING_URL: https://staging.example.com
          - task: PublishTestResults@2
            condition: always()
            inputs:
              testResultsFormat: JUnit
              testResultsFiles: $(Build.ArtifactStagingDirectory)/valiqai-junit.xml

What you'll see

The run's Tests tab: each test the scan ran. A test fails when it found an open problem at --fail-on or above.
The job log: progress, the summary, and a link to the scan.
The scan's page in ValiqAI says Azure Pipelines · main · a1b2c3d, linking back to the run.