Movatterモバイル変換

[0]ホーム
URL:

Skip to content

Navigation Menu

Sign in
Appearance settings

Search code, repositories, users, issues, pull requests...

Provide feedback

We read every piece of feedback, and take your input very seriously.

Saved searches

Use saved searches to filter your results more quickly

 Sign up
Appearance settings

Commit211c051

Browse files
committed
Add CodeQL scanning to APIScan build (#24303)
* Enable CodeQL in the APIScan build* fix indentation* fix build name* Manually add CodeQL* enable TSA directly in codeql* update codeql source code directory* go back to version 0* switch to variable to configure source code root* Update .pipelines/apiscan-gen-notice.yml
1 parent32511eb commit211c051

File tree

2 files changed

+69
-31
lines changed

2 files changed

+69
-31
lines changed

‎.pipelines/apiscan-gen-notice.yml

Lines changed: 29 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,8 +1,14 @@
11
# Copyright (c) Microsoft Corporation.
22
# Licensed under the MIT License.
3-
3+
name:apiscan-genNotice-$(BUILD.SOURCEBRANCHNAME)-$(Build.BuildId)
44
trigger:none
55

6+
parameters:
7+
-name:FORCE_CODEQL
8+
displayName:Debugging - Enable CodeQL and set cadence to 1 hour
9+
type:boolean
10+
default:false
11+
612
variables:
713
-name:ob_outputDirectory
814
value:'$(Build.ArtifactStagingDirectory)/ONEBRANCH_ARTIFACT'
@@ -17,6 +23,24 @@ variables:
1723
value:onebranch.azurecr.io/linux/ubuntu-2004:latest
1824
-name:WindowsContainerImage
1925
value:onebranch.azurecr.io/windows/ltsc2022/vse2022:latest
26+
-${{ if eq(parameters['FORCE_CODEQL'],'true') }}:
27+
# Cadence is hours before CodeQL will allow a re-upload of the database
28+
-name:CodeQL.Cadence
29+
value:0
30+
-name:CODEQL_ENABLED
31+
${{ if or(eq(variables['Build.SourceBranch'], 'refs/heads/master'), eq(parameters['FORCE_CODEQL'],'true')) }}:
32+
value:true
33+
${{ else }}:
34+
value:false
35+
-name:Codeql.TSAEnabled
36+
value:$(CODEQL_ENABLED)
37+
# AnalyzeInPipeline: false = upload results
38+
# AnalyzeInPipeline: true = do not upload results
39+
-name:Codeql.AnalyzeInPipeline
40+
${{ if or(eq(variables['Build.SourceBranch'], 'refs/heads/master'), eq(parameters['FORCE_CODEQL'],'true')) }}:
41+
value:false
42+
${{ else }}:
43+
value:true
2044

2145
resources:
2246
repositories:
@@ -32,8 +56,10 @@ extends:
3256
WindowsHostVersion:
3357
Version:2022
3458
globalSdl:
35-
compiled:
36-
enabled:true
59+
codeql:
60+
compiled:
61+
enabled:$(CODEQL_ENABLED)
62+
tsaEnabled:$(CODEQL_ENABLED)# This enables TSA bug filing only for CodeQL 3000
3763
armory:
3864
enabled:false
3965
sbom:

‎.pipelines/templates/compliance/apiscan.yml

Lines changed: 40 additions & 28 deletions
Original file line numberDiff line numberDiff line change
@@ -4,34 +4,36 @@
44
jobs:
55
-job:APIScan
66
variables:
7-
-name:runCodesignValidationInjection
8-
value:false
9-
-name:NugetSecurityAnalysisWarningLevel
10-
value:none
11-
-name:ReleaseTagVar
12-
value:fromBranch
13-
# Defines the variables APIScanClient, APIScanTenant and APIScanSecret
14-
-group:PS-PS-APIScan
15-
# PAT permissions NOTE: Declare a SymbolServerPAT variable in this group with a 'microsoft' organizanization scoped PAT with 'Symbols' Read permission.
16-
# A PAT in the wrong org will give a single Error 203. No PAT will give a single Error 401, and individual pdbs may be missing even if permissions are correct.
17-
-group:symbols
18-
-name:branchCounterKey
19-
value:$[format('{0:yyyyMMdd}-{1}', pipeline.startTime,variables['Build.SourceBranch'])]
20-
-name:branchCounter
21-
value:$[counter(variables['branchCounterKey'], 1)]
22-
-group:DotNetPrivateBuildAccess
23-
-group:Azure Blob variable group
24-
-group:ReleasePipelineSecrets
25-
-group:mscodehub-feed-read-general
26-
-group:mscodehub-feed-read-akv
27-
-name:ob_outputDirectory
28-
value:'$(Build.ArtifactStagingDirectory)/ONEBRANCH_ARTIFACT'
29-
-name:repoRoot
30-
value:'$(Build.SourcesDirectory)\PowerShell'
31-
-name:ob_sdl_tsa_configFile
32-
value:$(Build.SourcesDirectory)\PowerShell\.config\tsaoptions.json
33-
-name:ob_sdl_credscan_suppressionsFile
34-
value:$(Build.SourcesDirectory)\PowerShell\.config\suppress.json
7+
-name:runCodesignValidationInjection
8+
value:false
9+
-name:NugetSecurityAnalysisWarningLevel
10+
value:none
11+
-name:ReleaseTagVar
12+
value:fromBranch
13+
# Defines the variables APIScanClient, APIScanTenant and APIScanSecret
14+
-group:PS-PS-APIScan
15+
# PAT permissions NOTE: Declare a SymbolServerPAT variable in this group with a 'microsoft' organizanization scoped PAT with 'Symbols' Read permission.
16+
# A PAT in the wrong org will give a single Error 203. No PAT will give a single Error 401, and individual pdbs may be missing even if permissions are correct.
17+
-group:symbols
18+
-name:branchCounterKey
19+
value:$[format('{0:yyyyMMdd}-{1}', pipeline.startTime,variables['Build.SourceBranch'])]
20+
-name:branchCounter
21+
value:$[counter(variables['branchCounterKey'], 1)]
22+
-group:DotNetPrivateBuildAccess
23+
-group:Azure Blob variable group
24+
-group:ReleasePipelineSecrets
25+
-group:mscodehub-feed-read-general
26+
-group:mscodehub-feed-read-akv
27+
-name:ob_outputDirectory
28+
value:'$(Build.ArtifactStagingDirectory)/ONEBRANCH_ARTIFACT'
29+
-name:repoRoot
30+
value:'$(Build.SourcesDirectory)\PowerShell'
31+
-name:ob_sdl_tsa_configFile
32+
value:$(Build.SourcesDirectory)\PowerShell\.config\tsaoptions.json
33+
-name:ob_sdl_credscan_suppressionsFile
34+
value:$(Build.SourcesDirectory)\PowerShell\.config\suppress.json
35+
-name:Codeql.SourceRoot
36+
value:$(repoRoot)
3537

3638
pool:
3739
type:windows
@@ -119,6 +121,12 @@ jobs:
119121
workingDirectory: '$(repoRoot)'
120122
condition: succeededOrFailed()
121123
124+
-task:CodeQL3000Init@0# Add CodeQL Init task right before your 'Build' step.
125+
displayName:🔏 CodeQL 3000 Init
126+
condition:eq(variables['CODEQL_ENABLED'], 'true')
127+
inputs:
128+
Language:csharp
129+
122130
-pwsh:|
123131
Import-Module .\build.psm1 -force
124132
Find-DotNet
@@ -136,6 +144,10 @@ jobs:
136144
workingDirectory: '$(repoRoot)'
137145
displayName: 'Build PowerShell Source'
138146
147+
-task:CodeQL3000Finalize@0# Add CodeQL Finalize task right after your 'Build' step.
148+
displayName:🔏 CodeQL 3000 Finalize
149+
condition:eq(variables['CODEQL_ENABLED'], 'true')
150+
139151
-pwsh:|
140152
Get-ChildItem -Path env: | Out-String -width 9999 -Stream | write-Verbose -Verbose
141153
workingDirectory: '$(repoRoot)'

0 commit comments

Comments
 (0)
[8]ページ先頭
©2009-2025 Movatter.jp