This commit is contained in:
Andrew Arnott 2022-08-04 15:09:03 -06:00
Родитель 10a3c38f4f
Коммит f68beb6368
Не найден ключ, соответствующий данной подписи
Идентификатор ключа GPG: F33A420C60ED9C6F
3 изменённых файлов: 16 добавлений и 16 удалений

Просмотреть файл

@ -4,17 +4,17 @@ parameters:
steps: steps:
- task: MicroBuildCodesignVerify@3 - task: MicroBuildCodesignVerify@3
displayName: Verify Signed Files displayName: 🔍 Verify Signed Files
inputs: inputs:
TargetFolders: | TargetFolders: |
$(Build.SourcesDirectory)/bin/Packages/$(BuildConfiguration)/NuGet $(Build.SourcesDirectory)/bin/Packages/$(BuildConfiguration)/NuGet
- task: MicroBuildCleanup@1 - task: MicroBuildCleanup@1
condition: succeededOrFailed() condition: succeededOrFailed()
displayName: MicroBuild Cleanup displayName: ⚙️ MicroBuild Cleanup
- task: Ref12Analyze@0 - task: Ref12Analyze@0
displayName: Ref12 (Codex) Analyze displayName: 📑 Ref12 (Codex) Analyze
inputs: inputs:
codexoutputroot: $(Build.ArtifactStagingDirectory)\Codex codexoutputroot: $(Build.ArtifactStagingDirectory)\Codex
workflowArguments: | workflowArguments: |

Просмотреть файл

@ -1,9 +1,9 @@
steps: steps:
- task: ComponentGovernanceComponentDetection@0 - task: ComponentGovernanceComponentDetection@0
displayName: Component Detection displayName: 🔍 Component Detection
- task: notice@0 - task: notice@0
displayName: Generate NOTICE file displayName: 🛠️ Generate NOTICE file
inputs: inputs:
outputfile: $(System.DefaultWorkingDirectory)/obj/NOTICE outputfile: $(System.DefaultWorkingDirectory)/obj/NOTICE
outputformat: text outputformat: text
@ -12,7 +12,7 @@ steps:
inputs: inputs:
signType: $(SignType) signType: $(SignType)
zipSources: false zipSources: false
displayName: Install MicroBuild Signing Plugin displayName: 🔧 Install MicroBuild Signing Plugin
- task: MicroBuildSbomPlugin@1 - task: MicroBuildSbomPlugin@1
displayName: Install MicroBuild Sbom Plugin displayName: 🔧 Install MicroBuild Sbom Plugin

Просмотреть файл

@ -5,17 +5,17 @@ parameters:
steps: steps:
- task: CredScan@3 - task: CredScan@3
displayName: Run CredScan displayName: 🔍 Run CredScan
- task: PoliCheck@2 - task: PoliCheck@2
displayName: Run PoliCheck displayName: 🔍 Run PoliCheck
inputs: inputs:
targetType: F targetType: F
targetArgument: $(System.DefaultWorkingDirectory) targetArgument: $(System.DefaultWorkingDirectory)
optionsUEPATH: $(System.DefaultWorkingDirectory)\azure-pipelines\PoliCheckExclusions.xml optionsUEPATH: $(System.DefaultWorkingDirectory)\azure-pipelines\PoliCheckExclusions.xml
- task: BinSkim@4 - task: BinSkim@4
displayName: Run BinSkim displayName: 🔍 Run BinSkim
inputs: inputs:
InputType: Basic InputType: Basic
Function: analyze Function: analyze
@ -23,7 +23,7 @@ steps:
AnalyzeTargetGlob: $(BinSkimTargets) AnalyzeTargetGlob: $(BinSkimTargets)
- task: CopyFiles@2 - task: CopyFiles@2
displayName: Collect APIScan inputs displayName: 🔍 Collect APIScan inputs
inputs: inputs:
SourceFolder: $(Build.ArtifactStagingDirectory)/Symbols-$(Agent.JobName) SourceFolder: $(Build.ArtifactStagingDirectory)/Symbols-$(Agent.JobName)
# Exclude any patterns from the Contents (e.g. `!**/git2*`) that we have symbols for but do not need to run APIScan on. # Exclude any patterns from the Contents (e.g. `!**/git2*`) that we have symbols for but do not need to run APIScan on.
@ -34,7 +34,7 @@ steps:
condition: and(succeeded(), ${{ parameters.EnableAPIScan }}, ne(variables.ApiScanClientId, '')) condition: and(succeeded(), ${{ parameters.EnableAPIScan }}, ne(variables.ApiScanClientId, ''))
- task: APIScan@2 - task: APIScan@2
displayName: Run APIScan displayName: 🔍 Run APIScan
inputs: inputs:
softwareFolder: $(Build.ArtifactStagingDirectory)/APIScanInputs softwareFolder: $(Build.ArtifactStagingDirectory)/APIScanInputs
softwareName: $(SymbolsFeatureName) softwareName: $(SymbolsFeatureName)
@ -46,12 +46,12 @@ steps:
AzureServicesAuthConnectionString: runAs=App;AppId=$(ApiScanClientId);TenantId=$(ApiScanTenant);AppKey=$(ApiScanSecret) AzureServicesAuthConnectionString: runAs=App;AppId=$(ApiScanClientId);TenantId=$(ApiScanTenant);AppKey=$(ApiScanSecret)
- task: SdtReport@2 - task: SdtReport@2
displayName: Create Security Analysis Report displayName: 🛠️ Create Security Analysis Report
inputs: inputs:
GdnExportAllTools: true GdnExportAllTools: true
- task: PublishSecurityAnalysisLogs@3 - task: PublishSecurityAnalysisLogs@3
displayName: Publish Code Analysis Logs displayName: 📢 Publish Code Analysis Logs
inputs: inputs:
ArtifactName: CodeAnalysisLogs ArtifactName: CodeAnalysisLogs
ArtifactType: Container ArtifactType: Container
@ -60,7 +60,7 @@ steps:
ToolLogsNotFoundAction: Standard ToolLogsNotFoundAction: Standard
- task: PostAnalysis@2 - task: PostAnalysis@2
displayName: Break on compliance issues displayName: 🏋️‍♀️ Break on compliance issues
inputs: inputs:
GdnBreakAllTools: true GdnBreakAllTools: true
GdnBreakGdnToolBinSkimSeverity: Warning GdnBreakGdnToolBinSkimSeverity: Warning
@ -72,5 +72,5 @@ steps:
# This is useful when false positives appear so we can copy some of the output into the suppressions file. # This is useful when false positives appear so we can copy some of the output into the suppressions file.
- publish: $(Build.ArtifactStagingDirectory)/guardian_failures_as_suppressions - publish: $(Build.ArtifactStagingDirectory)/guardian_failures_as_suppressions
artifact: guardian_failures_as_suppressions artifact: guardian_failures_as_suppressions
displayName: Publish Guardian failures displayName: 🔍 Publish Guardian failures
condition: failed() condition: failed()