8000 Use `fxdependent-win-desktop` runtime for compliance runs (#20326) · PowerShell/PowerShell@9c91ba2 · GitHub
[go: up one dir, main page]
Skip to content

Commit 9c91ba2

Browse files
adityapatwardhanadityapatwardhan
committed
Use fxdependent-win-desktop runtime for compliance runs (#20326)
1 parent 2267c40 commit 9c91ba2

File tree

1 file changed

+145
-0
lines changed
  • tools/releaseBuild/azureDevOps/templates/compliance

1 file changed

+145
-0
lines changed

‎tools/releaseBuild/azureDevOps/templates/compliance/apiscan.yml

Lines changed: 145 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,145 @@
1+
jobs:
2+
- job: APIScan
3+
variables:
4+
- name: runCodesignValidationInjection
5+
value : false
6+
- name: NugetSecurityAnalysisWarningLevel
7+
value: none
8+
- name: ReleaseTagVar
9+
value: fromBranch
10+
# Defines the variables APIScanClient, APIScanTenant and APIScanSecret
11+
- group: PS-PS-APIScan
12+
# PAT permissions NOTE: Declare a SymbolServerPAT variable in this group with a 'microsoft' organizanization scoped PAT with 'Symbols' Read permission.
13+
# A PAT in the wrong org will give a single Error 203. No PAT will give a single Error 401, and individual pdbs may be missing even if permissions are correct.
14+
- group: symbols
15+
- name: branchCounterKey
16+
value: $[format('{0:yyyyMMdd}-{1}', pipeline.startTime,variables['Build.SourceBranch'])]
17+
- name: branchCounter
18+
value: $[counter(variables['branchCounterKey'], 1)]
19+
- group: DotNetPrivateBuildAccess
20+
21+
pool:
22+
name: PowerShell1ES
23+
demands:
24+
- ImageOverride -equals PSMMS2019-Secure
25+
26+
# APIScan can take a long time
27+
timeoutInMinutes: 180
28+
29+
steps:
30+
- template: ../SetVersionVariables.yml
31+
parameters:
32+
ReleaseTagVar: $(ReleaseTagVar)
33+
CreateJson: yes
34+
UseJson: no
35+
36+
- pwsh: |
37+
Import-Module .\build.psm1 -force
38+
Start-PSBootstrap
39+
workingDirectory: '$(Build.SourcesDirectory)'
40+
retryCountOnTaskFailure: 2
41+
displayName: 'Bootstrap'
42+
env:
43+
__DOTNET_RUNTIME_FEED: $(RUNTIME_SOURCEFEED)
44+
__DOTNET_RUNTIME_FEED_KEY: $(RUNTIME_SOURCEFEED_KEY)
45+
46+
- pwsh: |
47+
Import-Module .\build.psm1 -force
48+
Find-DotNet
49+
dotnet tool install dotnet-symbol --tool-path $(Agent.ToolsDirectory)\tools\dotnet-symbol
50+
$symbolToolPath = Get-ChildItem -Path $(Agent.ToolsDirectory)\tools\dotnet-symbol\dotnet-symbol.exe | Select-Object -First 1 -ExpandProperty FullName
51+
Write-Host "##vso[task.setvariable variable=symbolToolPath]$symbolToolPath"
52+
displayName: Install dotnet-symbol
53+
retryCountOnTaskFailure: 2
54+
55+
- pwsh: |
56+
Import-Module .\build.psm1 -force
57+
Find-DotNet
58+
Start-PSBuild -Configuration StaticAnalysis -PSModuleRestore -Clean -Runtime fxdependent-win-desktop
59+
60+
$OutputFolder = Split-Path (Get-PSOutput)
61+
Write-Host "##vso[task.setvariable variable=BinDir]$OutputFolder"
62+
workingDirectory: '$(Build.SourcesDirectory)'
63+
displayName: 'Build PowerShell Source'
64+
65+
- pwsh: |
66+
Get-ChildItem -Path env:
67+
displayName: Capture Environment
68+
condition: succeededOrFailed()
69+
70+
# Explicitly download symbols for the drop since the SDL image doesn't have http://SymWeb access and APIScan cannot handle https yet.
71+
- pwsh: |
72+
Import-Module .\build.psm1 -force
73+
Find-DotNet
74+
$pat = '$(SymbolServerPAT)'
75+
if ($pat -like '*PAT*' -or $pat -eq '')
76+
{
77+
throw 'No PAT defined'
78+
}
79+
$url = 'https://microsoft.artifacts.visualstudio.com/defaultcollection/_apis/symbol/symsrv'
80+
$(symbolToolPath) --authenticated-server-path $(SymbolServerPAT) $url --symbols -d "$env:BinDir\*" --recurse-subdirectories
81+
displayName: 'Download Symbols for binaries'
82+
retryCountOnTaskFailure: 2
83+
workingDirectory: '$(Build.SourcesDirectory)'
84+
85+
- pwsh: |
86+
Get-ChildItem '$(BinDir)' -File -Recurse |
87+
Foreach-Object {
88+
[pscustomobject]@{
89+
Path = $_.FullName
90+
Version = $_.VersionInfo.FileVersion
91+
Md5Hash = (Get-FileHash -Algorithm MD5 -Path $_.FullName).Hash
92+
Sha512Hash = (Get-FileHash -Algorithm SHA512 -Path $_.FullName).Hash
93+
}
94+
} | Export-Csv -Path '$(Build.SourcesDirectory)/ReleaseFileHash.csv'
95+
displayName: 'Create release file hash artifact'
96+
97+
- task: PublishBuildArtifacts@1
98+
displayName: 'Publish Build File Hash artifact'
99+
inputs:
100+
pathToPublish: '$(Build.SourcesDirectory)/ReleaseFileHash.csv'
101+
artifactName: ReleaseFilesHash
102+
retryCountOnTaskFailure: 2
103+
104+
- task: securedevelopmentteam.vss-secure-development-tools.build-task-apiscan.APIScan@2
105+
displayName: 'Run APIScan'
106+
inputs:
107+
softwareFolder: '$(BinDir)'
108+
softwareName: PowerShell
109+
softwareVersionNum: '$(ReleaseTagVar)'
110+
isLargeApp: false
111+
preserveTempFiles: false
112+
verbosityLevel: standard
113+
# write a status update every 5 minutes. Default is 1 minute
114+
statusUpdateInterval: '00:05:00'
115+
env:
116+
AzureServicesAuthConnectionString: RunAs=App;AppId=$(APIScanClient);TenantId=$(APIScanTenant);AppKey=$(APIScanSecret)
117+
118+
- task: securedevelopmentteam.vss-secure-development-tools.build-task-report.SdtReport@2
119+
continueOnError: true
120+
displayName: 'Guardian Export'
121+
inputs:
122+
GdnExportVstsConsole: true
123+
GdnExportSarifFile: true
124+
GdnExportHtmlFile: true
125+
GdnExportAllTools: false
126+
GdnExportGdnToolApiScan: true
127+
#this didn't do anything GdnExportCustomLogsFolder: '$(Build.ArtifactStagingDirectory)/Guardian'
128+
129+
- task: TSAUpload@2
130+
displayName: 'TSA upload'
131+
inputs:
132+
GdnPublishTsaOnboard: false
133+
GdnPublishTsaConfigFile: '$(Build.SourcesDirectory)\tools\guardian\tsaconfig-APIScan.json'
134+
135+
- pwsh: |
136+
Get-ChildItem -Path env:
137+
displayName: Capture Environment
138+
condition: succeededOrFailed()
139+
140+
- task: securedevelopmentteam.vss-secure-development-tools.build-task-publishsecurityanalysislogs.PublishSecurityAnalysisLogs@3
141+
displayName: 'Publish Guardian Artifacts'
142+
inputs:
143+
AllTools: false
144+
APIScan: true
145+
ArtifactName: APIScan

0 commit comments

Comments
 (0)
0