Skip to content

Commit 92825b7

Browse files
TravisEz13TravisEz13
authored
Create new pipeline for compliance (PowerShell#24252)
* Set up CI with Start Right * remove deadcode and add copyright notice * Update .pipelines/templates/compliance/apiscan.yml * Apply suggestions from code review * fix syntax
1 parent c83bd87 commit 92825b7

File tree

3 files changed

+414
-0
lines changed

3 files changed

+414
-0
lines changed

‎.pipelines/apiscan-gen-notice.yml

Lines changed: 79 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,79 @@
1+
# Copyright (c) Microsoft Corporation.
2+
# Licensed under the MIT License.
3+
4+
trigger: none
5+
6+
variables:
7+
- name: ob_outputDirectory
8+
value: '$(Build.ArtifactStagingDirectory)/ONEBRANCH_ARTIFACT'
9+
- name: CDP_DEFINITION_BUILD_COUNT
10+
value: $[counter('', 0)]
11+
# Defines the variables AzureFileCopySubscription, StorageAccount, StorageAccountKey, StorageResourceGroup, StorageSubscriptionName
12+
- group: 'Azure Blob variable group'
13+
# Defines the variables CgPat, CgOrganization, and CgProject
14+
- group: 'ComponentGovernance'
15+
- group: 'PoolNames'
16+
- name: LinuxContainerImage
17+
value: onebranch.azurecr.io/linux/ubuntu-2004:latest
18+
- name: WindowsContainerImage
19+
value: onebranch.azurecr.io/windows/ltsc2022/vse2022:latest
20+
21+
resources:
22+
repositories:
23+
- repository: templates
24+
type: git
25+
name: OneBranch.Pipelines/GovernedTemplates
26+
ref: refs/heads/main
27+
28+
extends:
29+
template: v2/OneBranch.NonOfficial.CrossPlat.yml@templates
30+
parameters:
31+
featureFlags:
32+
WindowsHostVersion:
33+
Version: 2022
34+
globalSdl:
35+
compiled:
36+
enabled: true
37+
armory:
38+
enabled: false
39+
sbom:
40+
enabled: false
41+
cg:
42+
enabled: true
43+
ignoreDirectories: '.devcontainer,demos,docker,docs,src,test,tools/packaging'
44+
tsa:
45+
enabled: true # onebranch publish all SDL results to TSA. If TSA is disabled all SDL tools will forced into 'break' build mode.
46+
credscan:
47+
enabled: true
48+
scanFolder: $(Build.SourcesDirectory)
49+
suppressionsFile: $(Build.SourcesDirectory)\.config\suppress.json
50+
binskim:
51+
break: true # always break the build on binskim issues in addition to TSA upload
52+
policheck:
53+
break: true # always break the build on policheck issues. You can disable it by setting to 'false'
54+
# APIScan requires a non-Ready-To-Run build
55+
apiscan:
56+
enabled: true
57+
softwareName: "PowerShell" # Default is repo name
58+
versionNumber: "7.5" # Default is build number
59+
isLargeApp: false # Default: false.
60+
#softwareFolder - relative path to a folder to be scanned. Default value is root of artifacts folder.
61+
#symbolsFolder - relative path to a folder that contains symbols. Default value is root of artifacts folder.
62+
63+
tsaOptionsFile: .config\tsaoptions.json
64+
65+
stages:
66+
- stage: APIScan
67+
displayName: 'ApiScan'
68+
dependsOn: []
69+
jobs:
70+
- template: /.pipelines/templates/compliance/apiscan.yml@self
71+
parameters:
72+
parentJobs: []
73+
- stage: notice
74+
displayName: Generate Notice File
75+
dependsOn: []
76+
jobs:
77+
- template: /.pipelines/templates/compliance/generateNotice.yml@self
78+
parameters:
79+
parentJobs: []

‎.pipelines/templates/compliance/apiscan.yml

Lines changed: 181 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,181 @@
1+
# Copyright (c) Microsoft Corporation.
2+
# Licensed under the MIT License.
3+
4+
jobs:
5+
- job: APIScan
6+
variables:
7+
- name: runCodesignValidationInjection
8+
value : false
9+
- name: NugetSecurityAnalysisWarningLevel
10+
value: none
11+
- name: ReleaseTagVar
12+
value: fromBranch
13+
# Defines the variables APIScanClient, APIScanTenant and APIScanSecret
14+
- group: PS-PS-APIScan
15+
# PAT permissions NOTE: Declare a SymbolServerPAT variable in this group with a 'microsoft' organizanization scoped PAT with 'Symbols' Read permission.
16+
# A PAT in the wrong org will give a single Error 203. No PAT will give a single Error 401, and individual pdbs may be missing even if permissions are correct.
17+
- group: symbols
18+
- name: branchCounterKey
19+
value: $[format('{0:yyyyMMdd}-{1}', pipeline.startTime,variables['Build.SourceBranch'])]
20+
- name: branchCounter
21+
value: $[counter(variables['branchCounterKey'], 1)]
22+
- group: DotNetPrivateBuildAccess
23+
- group: Azure Blob variable group
24+
- group: ReleasePipelineSecrets
25+
- group: mscodehub-feed-read-general
26+
- group: mscodehub-feed-read-akv
27+
- name: ob_outputDirectory
28+
value: '$(Build.ArtifactStagingDirectory)/ONEBRANCH_ARTIFACT'
29+
- name: repoRoot
30+
value: '$(Build.SourcesDirectory)\PowerShell'
31+
- name: ob_sdl_tsa_configFile
32+
value: $(Build.SourcesDirectory)\PowerShell\.config\tsaoptions.json
33+
- name: ob_sdl_credscan_suppressionsFile
34+
value: $(Build.SourcesDirectory)\PowerShell\.config\suppress.json
35+
36+
pool:
37+
type: windows
38+
39+
# APIScan can take a long time
40+
timeoutInMinutes: 180
41+
42+
steps:
43+
- checkout: self
44+
clean: true
45+
fetchTags: true
46+
fetchDepth: 1000
47+
displayName: Checkout PowerShell
48+
retryCountOnTaskFailure: 1
49+
env:
50+
ob_restore_phase: true # This ensures checkout is done at the beginning of the restore phase
51+
52+
- template: ../SetVersionVariables.yml
53+
parameters:
54+
ReleaseTagVar: $(ReleaseTagVar)
55+
CreateJson: yes
56+
UseJson: no
57+
58+
- template: ../insert-nuget-config-azfeed.yml
59+
parameters:
60+
repoRoot: '$(repoRoot)'
61+
62+
- pwsh: |
63+
Import-Module .\build.psm1 -force
64+
Start-PSBootstrap
65+
workingDirectory: '$(repoRoot)'
66+
retryCountOnTaskFailure: 2
67+
displayName: 'Bootstrap'
68+
env:
69+
__DOTNET_RUNTIME_FEED_KEY: $(RUNTIME_SOURCEFEED_KEY)
70+
71+
- pwsh: |
72+
Import-Module .\build.psm1 -force
73+
Find-DotNet
74+
dotnet tool install dotnet-symbol --tool-path $(Agent.ToolsDirectory)\tools\dotnet-symbol
75+
$symbolToolPath = Get-ChildItem -Path $(Agent.ToolsDirectory)\tools\dotnet-symbol\dotnet-symbol.exe | Select-Object -First 1 -ExpandProperty FullName
76+
Write-Host "##vso[task.setvariable variable=symbolToolPath]$symbolToolPath"
77+
displayName: Install dotnet-symbol
78+
workingDirectory: '$(repoRoot)'
79+
retryCountOnTaskFailure: 2
80+
81+
- pwsh: |
82+
$modules = 'Az.Accounts', 'Az.Storage'
83+
foreach($module in $modules) {
84+
if(!(get-module $module -listavailable)) {
85+
Write-Verbose "installing $module..." -verbose
86+
Install-Module $module -force -AllowClobber
87+
} else {
88+
Write-Verbose "$module already installed." -verbose
89+
}
90+
}
91+
displayName: Install PowerShell modules
92+
workingDirectory: '$(repoRoot)'
93+
94+
- task: AzurePowerShell@5
95+
displayName: Download winverify-private Artifacts
96+
inputs:
97+
azureSubscription: az-blob-cicd-infra
98+
scriptType: inlineScript
99+
azurePowerShellVersion: LatestVersion
100+
workingDirectory: '$(repoRoot)'
101+
pwsh: true
102+
inline: |
103+
# download smybols for getfilesiginforedist.dll
104+
$downloadsDirectory = '$(Build.ArtifactStagingDirectory)/downloads'
105+
$uploadedDirectory = '$(Build.ArtifactStagingDirectory)/uploaded'
106+
$storageAccountName = "pscoretestdata"
107+
$containerName = 'winverify-private'
108+
$winverifySymbolsPath = New-Item -ItemType Directory -Path '$(System.ArtifactsDirectory)/winverify-symbols' -Force
109+
$dllName = 'getfilesiginforedist.dll'
110+
$winverifySymbolsDllPath = Join-Path $winverifySymbolsPath $dllName
111+
112+
$context = New-AzStorageContext -StorageAccountName $storageAccountName -UseConnectedAccount
113+
114+
Get-AzStorageBlobContent -Container $containerName -Blob $dllName -Destination $winverifySymbolsDllPath -Context $context
115+
116+
- pwsh: |
117+
Get-ChildItem -Path '$(System.ArtifactsDirectory)/winverify-symbols'
118+
displayName: Capture winverify-private Artifacts
119+
workingDirectory: '$(repoRoot)'
120+
condition: succeededOrFailed()
121+
122+
- pwsh: |
123+
Import-Module .\build.psm1 -force
124+
Find-DotNet
125+
Start-PSBuild -Configuration StaticAnalysis -PSModuleRestore -Clean -Runtime fxdependent-win-desktop
126+
127+
$OutputFolder = Split-Path (Get-PSOutput)
128+
129+
Write-Verbose -Verbose -Message "Deleting ref folder from output folder"
130+
if (Test-Path $OutputFolder/ref) {
131+
Remove-Item -Recurse -Force $OutputFolder/ref
132+
}
133+
134+
Copy-Item -Path "$OutputFolder\*" -Destination '$(ob_outputDirectory)' -Recurse -Verbose
135+
136+
workingDirectory: '$(repoRoot)'
137+
displayName: 'Build PowerShell Source'
138+
139+
- pwsh: |
140+
Get-ChildItem -Path env: | Out-String -width 9999 -Stream | write-Verbose -Verbose
141+
workingDirectory: '$(repoRoot)'
142+
displayName: Capture Environment
143+
condition: succeededOrFailed()
144+
145+
# Explicitly download symbols for the drop since the SDL image doesn't have http://SymWeb access and APIScan cannot handle https yet.
146+
- pwsh: |
147+
Import-Module .\build.psm1 -force
148+
Find-DotNet
149+
$pat = '$(SymbolServerPAT)'
150+
if ($pat -like '*PAT*' -or $pat -eq '')
151+
{
152+
throw 'No PAT defined'
153+
}
154+
$url = 'https://microsoft.artifacts.visualstudio.com/defaultcollection/_apis/symbol/symsrv'
155+
$(symbolToolPath) --authenticated-server-path $(SymbolServerPAT) $url --symbols -d "$env:ob_outputDirectory\*" --recurse-subdirectories
156+
displayName: 'Download Symbols for binaries'
157+
retryCountOnTaskFailure: 2
158+
workingDirectory: '$(repoRoot)'
159+
160+
- pwsh: |
161+
Get-ChildItem '$(ob_outputDirectory)' -File -Recurse |
162+
Foreach-Object {
163+
[pscustomobject]@{
164+
Path = $_.FullName
165+
Version = $_.VersionInfo.FileVersion
166+
Md5Hash = (Get-FileHash -Algorithm MD5 -Path $_.FullName).Hash
167+
Sha512Hash = (Get-FileHash -Algorithm SHA512 -Path $_.FullName).Hash
168+
}
169+
} | Export-Csv -Path '$(Build.SourcesDirectory)/ReleaseFileHash.csv'
170+
workingDirectory: '$(repoRoot)'
171+
displayName: 'Create release file hash artifact'
172+
173+
- pwsh: |
174+
Copy-Item -Path '$(Build.SourcesDirectory)/ReleaseFileHash.csv' -Destination '$(ob_outputDirectory)' -Verbose
175+
displayName: 'Publish Build File Hash artifact'
176+
177+
- pwsh: |
178+
Get-ChildItem -Path env: | Out-String -width 9999 -Stream | write-Verbose -Verbose
179+
displayName: Capture Environment
180+
condition: succeededOrFailed()
181+
workingDirectory: '$(repoRoot)'

0 commit comments

Comments
 (0)