Skip to content
This repository was archived by the owner on Aug 4, 2022. It is now read-only.

Commit 0884f7e

Browse files
faixfaix
authored
Update compliance pipeline (#144)
* Update compliance pipeline * fix job dependency * ensure apiscan job fetches entire history * remove sbom from compliance pipeline
1 parent feac143 commit 0884f7e

2 files changed

Lines changed: 229 additions & 30 deletions

File tree

‎build/.pipelines/azure-pipelines-compliance.yml‎

Lines changed: 229 additions & 24 deletions
Original file line numberDiff line numberDiff line change
@@ -1,27 +1,232 @@
1-
trigger:
2-
- main
1+
resources:
2+
repositories:
3+
- repository: self
4+
type: git
5+
ref: refs/heads/release
36

4-
pool:
5-
vmImage: 'windows-latest'
7+
pool: $(PoolName)
68

79
variables:
8-
solution: '**/*.sln'
9-
buildPlatform: 'Any CPU'
10-
buildConfiguration: 'Release'
11-
12-
steps:
13-
- task: DotNetCoreCLI@2
14-
inputs:
15-
command: 'restore'
16-
projects: '$(build.sourcesdirectory)/src'
17-
18-
- task: DotNetCoreCLI@2
19-
inputs:
20-
command: 'build'
21-
projects: '$(build.sourcesdirectory)/src'
22-
arguments: '--configuration $(buildConfiguration) --no-restore'
23-
24-
- task: DotNetCoreCLI@2
25-
inputs:
26-
command: 'test'
27-
projects: '$(build.sourcesdirectory)/src'
10+
- template: steps/Variables-template.yml #template for Variables
11+
12+
trigger: none
13+
14+
schedules:
15+
- cron: 0 3 * * 6 # at 3AM every saturday
16+
branches:
17+
include:
18+
- main
19+
always: true
20+
21+
pr: none
22+
23+
stages:
24+
- stage: Build
25+
jobs:
26+
- job: Build_Phase
27+
displayName: Build
28+
29+
steps:
30+
- checkout: self
31+
32+
- task: gitversion/setup@0
33+
inputs:
34+
versionSpec: '5.x'
35+
36+
- task: gitversion/execute@0
37+
inputs:
38+
useConfigFile: true
39+
configFilePath: '$(build.sourcesdirectory)\GitVersion.yml'
40+
41+
- template: steps/Disable-StrongName-template.yml #template for Disable Strong Name
42+
43+
- task: UseDotNet@2
44+
inputs:
45+
packageType: 'sdk'
46+
useGlobalJson: true
47+
workingDirectory: '$(build.sourcesdirectory)/src'
48+
49+
- task: DotNetCoreCLI@2
50+
displayName: .NET Restore
51+
inputs:
52+
command: 'restore'
53+
projects: '$(build.sourcesdirectory)/src'
54+
55+
- task: DotNetCoreCLI@2
56+
displayName: .NET Build
57+
inputs:
58+
command: 'build'
59+
projects: '$(build.sourcesdirectory)/src'
60+
arguments: '--configuration $(BuildConfiguration) --no-restore'
61+
versioningScheme: byEnvVar
62+
versionEnvVar: 'GitVersion.SemVer'
63+
64+
- task: DotNetCoreCLI@2
65+
displayName: .NET Test
66+
inputs:
67+
command: 'test'
68+
projects: '$(build.sourcesdirectory)/src'
69+
70+
- task: DotNetCoreCLI@2
71+
displayName: .NET Publish
72+
inputs:
73+
command: 'publish'
74+
publishWebProjects: false
75+
projects: '$(build.sourcesdirectory)/src/CLI/CLI.csproj'
76+
arguments: '--configuration $(BuildConfiguration) --self-contained --runtime $(BuildPlatform) --output $(build.artifactstagingdirectory)/ScaleUnitManagementTools'
77+
modifyOutputPath: false
78+
zipAfterPublish: false
79+
80+
- template: steps/CodeQL-Template.yml
81+
82+
- template: steps/CodeSigning-template.yml #template for CodeSigning for StrongName and Authenticode
83+
parameters:
84+
codesigning_path: $(build.artifactstagingdirectory)/ScaleUnitManagementTools
85+
strongname_codesigning_pattern: $(strongname_signing_pattern)
86+
codesigning_pattern: $(signing_pattern)
87+
enable_oss_codesigning : true
88+
oss_codesigning_pattern: $(oss_signing_pattern)
89+
90+
- template: steps/CodeSignValidation-Template.yml
91+
parameters:
92+
scan_pattern: |
93+
$(Build.ArtifactStagingDirectory)
94+
95+
- template: steps/AntiMalware-Template.yml
96+
parameters:
97+
scan_pattern: |
98+
$(Build.ArtifactStagingDirectory)
99+
100+
- template: steps/CredScan-Template.yml
101+
parameters:
102+
scan_pattern: |
103+
$(Build.ArtifactStagingDirectory)
104+
105+
- task: NuGetCommand@2
106+
displayName: 'Restore PDBs'
107+
inputs:
108+
command: 'restore'
109+
restoreSolution: '$(build.sourcesdirectory)/build/packages.pdbs.config'
110+
feedsToUse: 'select'
111+
vstsFeed: 'e6f12261-a46a-4af1-ac0c-e22bc2c5a478/70a2a6ad-daeb-46a0-9bfb-6b140d06b2ff'
112+
includeNuGetOrg: false
113+
restoreDirectory: '$(build.sourcesdirectory)/packages'
114+
115+
- task: PowerShell@2
116+
displayName: 'Copy PDBs for scans'
117+
inputs:
118+
filePath: '$(build.sourcesdirectory)/build/Copy-FilesForScans.ps1'
119+
arguments: '-PackagesDir $(build.sourcesdirectory)/packages -PackagesFile $(build.sourcesdirectory)/build/packages.pdbs.config -DestinationDir $(build.artifactstagingdirectory)/ScaleUnitManagementTools'
120+
121+
- template: steps/Binskim-Template.yml
122+
parameters:
123+
scan_pattern: |
124+
$(build.artifactstagingdirectory)/ScaleUnitManagementTools/*.dll
125+
$(build.artifactstagingdirectory)/ScaleUnitManagementTools/*.exe
126+
symbols_pattern: |
127+
$(build.artifactstagingdirectory)/ScaleUnitManagementTools/
128+
129+
- template: steps/TSAUpload-Template.yml
130+
131+
- task: PublishBuildArtifacts@1
132+
displayName: Publish files for APIScan
133+
inputs:
134+
PathtoPublish: $(build.artifactstagingdirectory)/ScaleUnitManagementTools
135+
ArtifactName: ScaleUnitManagementToolsAPIScan
136+
137+
- task: ComponentGovernanceComponentDetection@0
138+
displayName: Component Detection
139+
140+
- task: PublishSecurityAnalysisLogs@3
141+
inputs:
142+
ArtifactName: "CodeAnalysisLogs"
143+
ArtifactType: "Container"
144+
145+
- template: steps/PostAnalysis-template.yml
146+
147+
- job: APIScan_Phase
148+
displayName: 'APIScan'
149+
timeoutInMinutes: 360
150+
dependsOn: Build_Phase
151+
152+
pool: 'FinOps-APIScan'
153+
154+
steps:
155+
- checkout: self # self represents the repo where the initial Pipelines YAML file was found
156+
157+
- task: gitversion/setup@0
158+
inputs:
159+
versionSpec: '5.x'
160+
161+
- task: gitversion/execute@0
162+
inputs:
163+
useConfigFile: true
164+
configFilePath: '$(build.sourcesdirectory)\GitVersion.yml'
165+
166+
- task: AzureKeyVault@1
167+
inputs:
168+
azureSubscription: "$(Azure_Sub)"
169+
KeyVaultName: "$(Keyvault_Name)"
170+
SecretsFilter: "$(Keyvault_Secret)"
171+
RunAsPreJob: false
172+
173+
- task: DownloadPipelineArtifact@2
174+
inputs:
175+
artifact: ScaleUnitManagementToolsAPIScan
176+
path: $(Build.ArtifactStagingDirectory)
177+
178+
- task: APIScan@2
179+
displayName: 'Run APIScan'
180+
env:
181+
AzureServicesAuthConnectionString: RunAs=App;AppId=$(App_ID);TenantId=$(Tenant_Id);AppKey=$(ApiScanAppSecretName)
182+
inputs:
183+
softwareFolder: '$(Build.ArtifactStagingDirectory)'
184+
softwareName: d365scm-devtools
185+
softwareVersionNum: '$(GitVersion.Major).0.0'
186+
mode: 'release'
187+
symbolsFolder: $(Build.ArtifactStagingDirectory)
188+
isLargeApp: false
189+
analyzerTimeout: '20:00:00'
190+
verbosityLevel: 'standard'
191+
statusUpdateInterval: '00:03:00'
192+
193+
- template: steps/TSAUpload-Template.yml
194+
195+
- task: PublishSecurityAnalysisLogs@3
196+
displayName: 'Publish Security Analysis Logs'
197+
198+
- stage: CodeScanning
199+
dependsOn: [] # this removes the implicit dependency on any previous stage and causes this to run in parallel
200+
displayName: 'Source scanning'
201+
202+
jobs:
203+
- job: CodeScanningJob
204+
displayName: 'Source scanning'
205+
206+
variables:
207+
- name: runCodesignValidationInjection
208+
value: false
209+
210+
steps:
211+
- checkout: self # self represents the repo where the initial Pipelines YAML file was found
212+
clean: true
213+
fetchDepth: 1 # the depth of commits to ask Git to fetch
214+
215+
- template: steps/CredScan-Template.yml
216+
parameters:
217+
scan_pattern: |
218+
$(Build.SourcesDirectory)
219+
220+
- template: steps/Policheck-Template.yml
221+
parameters:
222+
scan_pattern: |
223+
$(Build.SourcesDirectory)
224+
225+
- template: steps/TSAUpload-Template.yml
226+
227+
- task: PublishSecurityAnalysisLogs@3
228+
inputs:
229+
ArtifactName: "CodeAnalysisLogs"
230+
ArtifactType: "Container"
231+
232+
- template: steps/PostAnalysis-template.yml

‎build/.pipelines/azure-pipelines-rel.yml‎

Lines changed: 0 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -158,12 +158,6 @@ stages:
158158
changeLogType: 'commitBased'
159159
assets: |
160160
$(Build.ArtifactStagingDirectory)/ScaleUnitManagementTools_v$(GitVersion.SemVer).zip
161-
162-
- task: PublishBuildArtifacts@1
163-
displayName: Publish Artifact
164-
inputs:
165-
PathtoPublish: $(build.artifactstagingdirectory)/ScaleUnitManagementTools_v$(GitVersion.SemVer).zip
166-
ArtifactName: ZipPackage
167161
168162
- task: ComponentGovernanceComponentDetection@0
169163
displayName: Component Detection

0 commit comments

Comments
 (0)