@@ -182,78 +182,8 @@ stages:
182182steps :
183183 -template :build/steps/build-osx.yml
184184
185- -stage :PoliCheck
186- displayName :' Code Analysis'
187- dependsOn :windows
188- jobs :
189- -job :run_poli_check
190- displayName :' Policheck And Credentials Compliance'
191- pool :
192- name :$(vs2019VmPool)
193- vmImage :$(vs2019VmImage)
194- timeoutInMinutes :60
195- cancelTimeoutInMinutes :5
196- steps :
197- -checkout :self
198-
199- -template :security/policheck/v2.yml@xamarin-templates
200-
201- -template :security/credscan/v3.yml@xamarin-templates
202- parameters :
203- suppressionsFile :$(System.DefaultWorkingDirectory)\build\automation\CredScanSuppressions.json
204-
205- -task :securedevelopmentteam.vss-secure-development-tools.build-task-antimalware.AntiMalware@4
206- displayName :Run AntiMalware (Defender) Scan
207- inputs :
208- FileDirPath :$(System.DefaultWorkingDirectory)
209- EnableServices :true
210- condition :succeededOrFailed()
211-
212- -task :securedevelopmentteam.vss-secure-development-tools.build-task-report.SdtReport@2
213- displayName :Create Security Analysis Report
214- inputs :
215- CredScan :true
216- PoliCheck :true
217- condition :succeededOrFailed()
218-
219- -task :securedevelopmentteam.vss-secure-development-tools.build-task-publishsecurityanalysislogs.PublishSecurityAnalysisLogs@3
220- displayName :Publish Security Analysis Logs
221- inputs :
222- ArtifactName :CodeAnalysisLogs
223- condition :succeededOrFailed()
224-
225- -task :securedevelopmentteam.vss-secure-development-tools.build-task-postanalysis.PostAnalysis@2
226- displayName :Fail Job if Security Issues are Detected
227- inputs :
228- CredScan :true
229- PoliCheck :true
230- GdnBreakGdnToolPoliCheckSeverity :' Error'
231- condition :succeededOrFailed()
232-
233- # - job: api_scan
234- # displayName: APIScan Compliance
235- # pool:
236- # name: $(corpVmImage)
237- # steps:
238- # - checkout: none
239- # clean: true
240-
241- # - task: DownloadBuildArtifacts@0
242- # displayName: 'Download build artifact win_build'
243- # inputs:
244- # artifactName: win_build
245- # downloadPath: $(Build.StagingDirectory)
246-
247- # - task: securedevelopmentteam.vss-secure-development-tools.build-task-apiscan.APIScan@2
248- # displayName: 'Run APIScan'
249- # inputs:
250- # softwareFolder: '$(Build.StagingDirectory)\win_build'
251- # softwareName: Xamarin.Forms
252- # softwareVersionNum: $(Build.BuildNumber)
253- # isLargeApp: false
254-
255185# only sign using the private server and not sigining Maui for now
256- -${{ ifand( eq(variables['System.TeamProject'], 'devdiv'), ne(variables['System.DefinitionId'], '13330') ) }} :
186+ -${{ if eq(variables['System.TeamProject'], 'devdiv') }} :
257187 -stage :nuget_signing
258188dependsOn :windows
259189displayName :Sign Nuget
@@ -270,6 +200,55 @@ stages:
270200 -task :NuGetToolInstaller@1
271201inputs :
272202versionSpec :$(NUGET_VERSION)
203+
204+ -stage :PoliCheck
205+ displayName :' Code Analysis'
206+ dependsOn :windows
207+ jobs :
208+ -job :run_poli_check
209+ displayName :' Policheck And Credentials Compliance'
210+ pool :
211+ name :$(vs2019VmPool)
212+ vmImage :$(vs2019VmImage)
213+ timeoutInMinutes :60
214+ cancelTimeoutInMinutes :5
215+ steps :
216+ -checkout :self
217+
218+ -template :security/policheck/v2.yml@xamarin-templates
219+
220+ -template :security/credscan/v3.yml@xamarin-templates
221+ parameters :
222+ suppressionsFile :$(System.DefaultWorkingDirectory)\build\automation\CredScanSuppressions.json
223+
224+ -task :securedevelopmentteam.vss-secure-development-tools.build-task-antimalware.AntiMalware@4
225+ displayName :Run AntiMalware (Defender) Scan
226+ inputs :
227+ FileDirPath :$(System.DefaultWorkingDirectory)
228+ EnableServices :true
229+ condition :succeededOrFailed()
230+
231+ -task :securedevelopmentteam.vss-secure-development-tools.build-task-report.SdtReport@2
232+ displayName :Create Security Analysis Report
233+ inputs :
234+ CredScan :true
235+ PoliCheck :true
236+ condition :succeededOrFailed()
237+
238+ -task :securedevelopmentteam.vss-secure-development-tools.build-task-publishsecurityanalysislogs.PublishSecurityAnalysisLogs@3
239+ displayName :Publish Security Analysis Logs
240+ inputs :
241+ ArtifactName :CodeAnalysisLogs
242+ condition :succeededOrFailed()
243+
244+ -task :securedevelopmentteam.vss-secure-development-tools.build-task-postanalysis.PostAnalysis@2
245+ displayName :Fail Job if Security Issues are Detected
246+ inputs :
247+ CredScan :true
248+ PoliCheck :true
249+ GdnBreakGdnToolPoliCheckSeverity :' Error'
250+ condition :succeededOrFailed()
251+
273252 -stage :sbom
274253dependsOn :nuget_signing
275254displayName :' Software Bill of Materials'