Fix Up OneBranch PR Yaml (#3739)

.azure/OneBranch.PullRequest.yml

@@ -25,7 +25,7 @@ parameters:
 - name: 'WindowsContainerImage2DockerTag'
   displayName: 'WindowsContainerImage2 DockerTag'
   type: string
-  default: 'latest'
+  default: 'vse2022.5'
 
 variables:
   system.debug: ${{ parameters.debug }}
@@ -35,8 +35,9 @@ variables:
   REPOROOT: $(Build.SourcesDirectory)
   OUTPUTROOT: $(REPOROOT)\out
   NUGET_XMLDOC_MODE: none
+  ONEBRANCH_AME_ACR_LOGIN: onebranch.azurecr.io, cdpxb7b51c2f738e43e48f7605d9a8e5f6d700.azurecr.io
 
-  WindowsContainerImage: 'onebranch.azurecr.io/windows/ltsc2019/vse2019:latest'
+  WindowsContainerImage: 'onebranch.azurecr.io/windows/ltsc2022/vse2022:latest'
   WindowsContainerImage2: 'cdpxb7b51c2f738e43e48f7605d9a8e5f6d700.azurecr.io/b7b51c2f-738e-43e4-8f76-05d9a8e5f6d7/official/msquicbuild:${{ parameters.WindowsContainerImage2DockerTag }}'
   LinuxContainerImage: 'ghcr.io/microsoft/msquic/linux-build-xcomp:22.04'
   LinuxContainerImage2: 'ghcr.io/microsoft/msquic/linux-build-xcomp:20.04'
@@ -51,17 +52,23 @@ resources:
 extends:
   template: v2/OneBranch.NonOfficial.CrossPlat.yml@templates # https://aka.ms/obpipelines/templates
   parameters:
+    cloudvault: # https://aka.ms/obpipelines/cloudvault
+      enabled: false
     globalSdl: # https://aka.ms/obpipelines/sdl
+      sbom:
+        validate: false
       tsa:
         enabled: false # onebranch publish all sdl results to TSA. If TSA is disabled all SDL tools will forced into 'break' build mode.
-      # credscan:
-      #   suppressionsFile: $(Build.SourcesDirectory)\.config\CredScanSuppressions.json
+      credscan:
+        suppressionsFile: $(Build.SourcesDirectory)\.azure\CredScanSuppressions.json
       binskim:
-        break: true # always break the build on binskim issues. You can disable it by setting to 'false'
+        break: true # always break the build on binskim issues in addition to TSA upload
       policheck:
         break: true # always break the build on policheck issues. You can disable it by setting to 'false'
       suppression:
         suppressionFile: $(Build.SourcesDirectory)\.azure\openssl.gdnsuppress
+    featureFlags:
+      WindowsHostVersion: '1ESWindows2022'
 
     stages:
     - stage: build_winkernel
@@ -82,6 +89,11 @@ extends:
       - template: .azure/obtemplates/build-winuser-xdp.yml@self
         parameters:
           config: Release
+          tls: schannel
+      - template: .azure/obtemplates/build-winuser-xdp.yml@self
+        parameters:
+          config: Release
+          tls: openssl
       - template: .azure/obtemplates/build-winuser-xdp.yml@self
         parameters:
           config: Debug
@@ -98,7 +110,6 @@ extends:
         parameters:
           config: Debug
           tls: schannel
-
       - template: .azure/obtemplates/build-winuser.yml@self
         parameters:
           config: Release
@@ -107,6 +118,14 @@ extends:
         parameters:
           config: Debug
           tls: openssl
+      - template: .azure/obtemplates/build-winuser.yml@self
+        parameters:
+          config: Release
+          tls: openssl3
+      - template: .azure/obtemplates/build-winuser.yml@self
+        parameters:
+          config: Debug
+          tls: openssl3
 
     - stage: build_gamecore_console
       displayName: Build Gamecore
@@ -137,7 +156,6 @@ extends:
           config: Debug
           tls: schannel
           platform: uwp
-
       - template: .azure/obtemplates/build-winuser.yml@self
         parameters:
           config: Release