[build] enable TSA reporting on more steps

.gdn/CredScanSuppressions.json

@@ -0,0 +1,29 @@
+{
+  "Suppressions": [
+    {
+      "Issue": "CSCAN-GENERAL0020",
+      "Justification": "test.keystore is used for testing purposes only and does not contain sensitive information.",
+      "FilePath": "src/Xamarin.Android.Build.Tasks/Tests/Xamarin.ProjectTools/Resources/Base/test.keystore"
+    },
+    {
+      "Issue": "CSCAN-GENERAL0060",
+      "Justification": "False positive detected in external/android-api-docs/docs/xml/Javax.Security.Auth.Callback/PasswordCallback.xml",
+      "FilePath": "external/android-api-docs/docs/xml/Javax.Security.Auth.Callback/PasswordCallback.xml"
+    },
+    {
+      "Issue": "CSCAN-GENERAL0060",
+      "Justification": "False positive detected in external/android-api-docs/docs/xml/Javax.Crypto/ISecretKey.xml",
+      "FilePath": "external/android-api-docs/docs/xml/Javax.Crypto/ISecretKey.xml"
+    },
+    {
+      "Issue": "CSCAN-GENERAL0030",
+      "Justification": "False positive detected in external/android-api-docs/docs/xml/Android.Service.Autofill/FillEventHistory+Event.xml",
+      "FilePath": "external/android-api-docs/docs/xml/Android.Service.Autofill/FillEventHistory+Event.xml"
+    },
+    {
+      "Issue": "CSCAN-GENERAL0060",
+      "Justification": "False positive detected in external/android-api-docs/docs/xml/Android.Service.Autofill/FillEventHistory+Event.xml",
+      "FilePath": "external/android-api-docs/docs/xml/Android.Service.Autofill/FillEventHistory+Event.xml"
+    }
+  ]
+}

build-tools/automation/azure-pipelines-nightly.yaml

@@ -126,7 +126,7 @@ stages:
 
     - template: /build-tools/automation/yaml-templates/run-dotnet-preview.yaml
       parameters:
-        project: Xamarin.Android.sln
+        project: android/Xamarin.Android.sln
         arguments: -t:PrepareJavaInterop -c $(XA.Build.Configuration) -m:1 -v:n
         displayName: prepare java.interop $(XA.Build.Configuration)
         continueOnError: false

build-tools/automation/azure-pipelines.yaml

@@ -28,6 +28,10 @@ resources:
     name: dotnet/maui
     ref: refs/heads/net10.0
     endpoint: xamarin
+  - repository: android-tools
+    type: github
+    name: dotnet/android-tools
+    endpoint: xamarin
 
 parameters:
 - name: pushXAPackagesToMaestro
@@ -64,11 +68,19 @@ extends:
       ${{ if eq('${{ parameters.Skip1ESComplianceTasks }}', 'true') }}:
         enableAllTools: false
       binskim:
+        enabled: true
         scanOutputDirectoryOnly: true
+        analyzeTargetGlob: '$(System.DefaultWorkingDirectory)\bin\$(XA.Build.Configuration)\dotnet\packs\Microsoft.Android*\**.dll;$(System.DefaultWorkingDirectory)\bin\$(XA.Build.Configuration)\dotnet\packs\Microsoft.Android*\**.exe'
       codeql:
         compiled:
           enabled: false
           justificationForDisabling: CodeQL runs against the nightly build
+      credscan:
+        enabled: true
+        ${{ if startsWith(variables['System.JobName'], 'SDLSources') }}:
+          suppressionsFile: .gdn/CredScanSuppressions.json
+        ${{ else }}:
+          suppressionsFile: $(System.SourcesDirectory)/android/.gdn/CredScanSuppressions.json
       policheck:
         enabled: false
         justification: Built in task does not support multi-language scanning
@@ -80,14 +92,22 @@ extends:
         image: $(WindowsPoolImage1ESPT)
         os: windows
       sourceRepositoriesToScan:
-        include:
-        - ${{ if ne(variables['System.PullRequest.IsFork'], 'True') }}:
-          - repository: android-platform-support
         exclude:
-        - repository: yaml-templates
+        - repository: android-platform-support
+        - repository: android-tools
         - repository: maui
+        - repository: yaml-templates
       suppression:
-        suppressionFile: $(Build.SourcesDirectory)\.gdn\.gdnsuppress
+        ${{ if startsWith(variables['System.JobName'], 'SDLSources') }}:
+          suppressionFile: .gdn/.gdnsuppress
+        ${{ else }}:
+          suppressionFile: $(Build.SourcesDirectory)/android/.gdn/.gdnsuppress
+      tsa:
+        enabled: true
+        ${{ if startsWith(variables['System.JobName'], 'SDLSources') }}:
+          configFile: .gdn/tsaoptions-v2.json
+        ${{ else }}:
+          configFile: $(Build.SourcesDirectory)/android/.gdn/tsaoptions-v2.json
     settings:
       skipBuildTagsForGitHubPullRequests: true
     stages:

build-tools/automation/yaml-templates/apk-instrumentation.yaml

@@ -1,7 +1,7 @@
 parameters:
   buildConfiguration: $(XA.Build.Configuration)
   configuration: $(XA.Build.Configuration)
-  xaSourcePath: $(System.DefaultWorkingDirectory)
+  xaSourcePath: $(System.DefaultWorkingDirectory)/android
   testName: ""
   project: ""
   testResultsFiles: ""

build-tools/automation/yaml-templates/build-linux.yaml

@@ -55,7 +55,7 @@ stages:
 
     # Always checkout a second resource to ensure we are using multi-repo checkout behavior
     #  https://learn.microsoft.com/en-us/azure/devops/pipelines/repos/multi-repo-checkout?view=azure-devops#checkout-path
-    - checkout: maui
+    - checkout: android-tools
 
     - template: /build-tools/automation/yaml-templates/setup-jdk-variables.yaml
       parameters:

build-tools/automation/yaml-templates/build-windows.yaml

@@ -39,6 +39,10 @@ stages:
 
     - template: /build-tools/automation/yaml-templates/clean.yaml
 
+    # Always checkout a second resource to ensure we are using multi-repo checkout behavior
+    #  https://learn.microsoft.com/en-us/azure/devops/pipelines/repos/multi-repo-checkout?view=azure-devops#checkout-path
+    - checkout: android-tools
+
     - template: /build-tools/automation/yaml-templates/setup-jdk-variables.yaml
       parameters:
         useAgentJdkPath: false
@@ -51,25 +55,25 @@ stages:
     - task: DotNetCoreCLI@2
       displayName: Prepare Solution
       inputs:
-        projects: Xamarin.Android.sln
-        arguments: '-c $(XA.Build.Configuration) -t:Prepare --no-restore -p:AutoProvision=true -bl:$(System.DefaultWorkingDirectory)\bin\Build$(XA.Build.Configuration)\dotnet-build-prepare.binlog'
+        projects: android/Xamarin.Android.sln
+        arguments: '-c $(XA.Build.Configuration) -t:Prepare --no-restore -p:AutoProvision=true -bl:$(System.DefaultWorkingDirectory)\android\bin\Build$(XA.Build.Configuration)\dotnet-build-prepare.binlog'
 
     # Build Xamarin.Android and configure local workloads to test improved local build loop
     - template: /build-tools/automation/yaml-templates/run-dotnet-preview.yaml
       parameters:
-        project: Xamarin.Android.sln
+        project: android/Xamarin.Android.sln
         arguments: >-
           -t:BuildDotNet -c $(XA.Build.Configuration) -v:n
-          -bl:$(System.DefaultWorkingDirectory)\bin\Build$(XA.Build.Configuration)\dotnet-build.binlog
+          -bl:$(System.DefaultWorkingDirectory)\android\bin\Build$(XA.Build.Configuration)\dotnet-build.binlog
         displayName: Build Solution
         continueOnError: false
 
     - template: /build-tools/automation/yaml-templates/run-dotnet-preview.yaml
       parameters:
-        project: build-tools/create-packs/Microsoft.Android.Sdk.proj
+        project: android/build-tools/create-packs/Microsoft.Android.Sdk.proj
         arguments: >-
           -t:ConfigureLocalWorkload -c $(XA.Build.Configuration) -v:n -p:RunningOnCI=false
-          -bl:$(System.DefaultWorkingDirectory)\bin\Build$(XA.Build.Configuration)\local-workload.binlog
+          -bl:$(System.DefaultWorkingDirectory)\android\bin\Build$(XA.Build.Configuration)\local-workload.binlog
         displayName: Run ConfigureLocalWorkload target
         continueOnError: false
 
@@ -81,36 +85,36 @@ stages:
     - template: /build-tools/automation/yaml-templates/run-nunit-tests.yaml
       parameters:
         testRunTitle: Smoke MSBuild Tests - Windows Dotnet Build
-        testAssembly: $(System.DefaultWorkingDirectory)\bin\Test$(XA.Build.Configuration)\$(DotNetStableTargetFramework)\Xamarin.Android.Build.Tests.dll
+        testAssembly: $(System.DefaultWorkingDirectory)\android\bin\Test$(XA.Build.Configuration)\$(DotNetStableTargetFramework)\Xamarin.Android.Build.Tests.dll
         dotNetTestExtraArgs: --filter "TestCategory = SmokeTests"
 
     - template: /build-tools/automation/yaml-templates/run-dotnet-preview.yaml@self
       parameters:
         command: test
-        project: src/Microsoft.Android.Sdk.Analysis/Tests/Microsoft.Android.Sdk.Analysis.Tests.csproj 
+        project: android/src/Microsoft.Android.Sdk.Analysis/Tests/Microsoft.Android.Sdk.Analysis.Tests.csproj 
         arguments: -c $(XA.Build.Configuration)
         displayName: Test Microsoft.Android.Sdk.Analysis $(XA.Build.Configuration)
         continueOnError: false
 
     - task: BatchScript@1
       displayName: Test dotnet-local.cmd - create template
       inputs:
-        filename: dotnet-local.cmd
+        filename: android/dotnet-local.cmd
         arguments: new android -o $(Build.StagingDirectory)/LocalWorkloadTest
 
     - task: BatchScript@1
       displayName: Test dotnet-local.cmd - build template
       inputs:
-        filename: dotnet-local.cmd
+        filename: android/dotnet-local.cmd
         arguments: build -v:n $(Build.StagingDirectory)/LocalWorkloadTest
 
     # Pack .nupkgs and extract workload packs to dotnet preview test directory
     - template: /build-tools/automation/yaml-templates/run-dotnet-preview.yaml
       parameters:
-        project: Xamarin.Android.sln
+        project: android/Xamarin.Android.sln
         arguments: >-
           -t:PackDotNet -c $(XA.Build.Configuration) -v:n
-          -bl:$(System.DefaultWorkingDirectory)\bin\Build$(XA.Build.Configuration)\dotnet-pack.binlog
+          -bl:$(System.DefaultWorkingDirectory)\android\bin\Build$(XA.Build.Configuration)\dotnet-pack.binlog
         displayName: Test PackDotNet
 
     - template: /build-tools/automation/yaml-templates/upload-results.yaml

build-tools/automation/yaml-templates/commercial-build.yaml

@@ -24,7 +24,7 @@ steps:
 
 # Always checkout a second resource to ensure we are using multi-repo checkout behavior
 #  https://learn.microsoft.com/en-us/azure/devops/pipelines/repos/multi-repo-checkout?view=azure-devops#checkout-path
-- checkout: maui
+- checkout: android-tools
 
 - ${{ if ne(variables['System.PullRequest.IsFork'], 'True') }}:
   - checkout: android-platform-support

build-tools/automation/yaml-templates/run-dotnet-preview.yaml

@@ -1,6 +1,6 @@
 parameters:
   configuration: $(XA.Build.Configuration)
-  xaSourcePath: $(System.DefaultWorkingDirectory)
+  xaSourcePath: $(System.DefaultWorkingDirectory)/android
   command: build
   project: ''
   arguments: ''

build-tools/automation/yaml-templates/run-msbuild-tests.yaml

@@ -4,7 +4,7 @@ parameters:
   jobDisplayName: ''      # Display name of the job
   agentCount: 1           # Number of build agents to run in parallel
   testFilter: ''          # Filter used to select tests (NUnit test selection language, not dotnet test filter language)
-  xaSourcePath: $(System.DefaultWorkingDirectory)
+  xaSourcePath: $(System.DefaultWorkingDirectory)/android
   repositoryAlias: 'self'
   commit: ''
   shouldFailOnIssue: true

build-tools/automation/yaml-templates/run-sliced-nunit-tests.yaml

@@ -2,7 +2,7 @@ parameters:
   testAssembly: ''        # NUnit test assembly to run
   testFilter: ''          # Filter used to select tests (NUnit test selection language, not dotnet test filter language)
   testRunTitle: ''        # Title of the test run
-  xaSourcePath: $(System.DefaultWorkingDirectory)
+  xaSourcePath: $(System.DefaultWorkingDirectory)/android
   retryFailedTests: true  # Retry failed tests once
 
 steps:

build-tools/automation/yaml-templates/run-xaprepare.yaml

@@ -2,7 +2,7 @@ parameters:
   displayName: run xaprepare
   name:
   configuration: $(XA.Build.Configuration)
-  xaSourcePath: $(System.DefaultWorkingDirectory)
+  xaSourcePath: $(System.DefaultWorkingDirectory)/android
   condition: succeeded()
   arguments:
 

build-tools/automation/yaml-templates/setup-test-environment.yaml

@@ -1,6 +1,6 @@
 parameters:
   configuration: $(XA.Build.Configuration)
-  xaSourcePath: $(System.DefaultWorkingDirectory)
+  xaSourcePath: $(System.DefaultWorkingDirectory)/android
   jdkMajorVersion: $(DefaultJavaSdkMajorVersion)
   useAgentJdkPath: true
   remove_dotnet: false
@@ -22,6 +22,10 @@ steps:
     clean: true
     submodules: recursive
 
+# Always checkout a second resource to ensure we are using multi-repo checkout behavior
+#  https://learn.microsoft.com/en-us/azure/devops/pipelines/repos/multi-repo-checkout?view=azure-devops#checkout-path
+- checkout: android-tools
+
 - template: /build-tools/automation/yaml-templates/setup-jdk-variables.yaml
   parameters:
     jdkMajorVersion: ${{ parameters.jdkMajorVersion }}

build-tools/automation/yaml-templates/stage-msbuild-emulator-tests.yaml

@@ -7,7 +7,7 @@ parameters:
   agent_count: 12
   stageCondition: succeeded()
   stagePrefix: ''
-  xaSourcePath: $(System.DefaultWorkingDirectory)
+  xaSourcePath: $(System.DefaultWorkingDirectory)/android
   repositoryAlias: 'self'
   commit: ''
   usesCleanImages: true
@@ -52,7 +52,7 @@ stages:
     # Currently needed for samples/NativeAOT
     - template: /build-tools/automation/yaml-templates/run-dotnet-preview.yaml@self
       parameters:
-        project: Xamarin.Android.sln
+        project: ${{ parameters.xaSourcePath }}/Xamarin.Android.sln
         arguments: -t:PrepareJavaInterop -c $(XA.Build.Configuration) --no-restore
         displayName: prepare java.interop $(XA.Build.Configuration)
         continueOnError: false
@@ -186,7 +186,7 @@ stages:
 
     - template: /build-tools/automation/yaml-templates/run-sliced-nunit-tests.yaml
       parameters:
-        testAssembly: $(System.DefaultWorkingDirectory)\bin\Test$(XA.Build.Configuration)\MSBuildDeviceIntegration\$(DotNetStableTargetFramework)\MSBuildDeviceIntegration.dll
+        testAssembly: ${{ parameters.xaSourcePath }}\bin\Test$(XA.Build.Configuration)\MSBuildDeviceIntegration\$(DotNetStableTargetFramework)\MSBuildDeviceIntegration.dll
         testFilter: name == DebuggingTest
         testRunTitle: DebuggingTest tests on Windows
 

build-tools/automation/yaml-templates/stage-msbuild-tests.yaml

@@ -5,7 +5,7 @@ parameters:
   stageCondition: succeeded()
   dependsOn: mac_build
   stagePrefix: ''
-  xaSourcePath: $(System.DefaultWorkingDirectory)
+  xaSourcePath: $(System.DefaultWorkingDirectory)/android
   repositoryAlias: 'self'
   commit: ''
   shouldFailOnIssue: true

build-tools/automation/yaml-templates/stage-package-tests.yaml

@@ -26,33 +26,33 @@ stages:
     - task: DownloadPipelineArtifact@2
       inputs:
         artifactName: $(TestAssembliesArtifactName)
-        downloadPath: $(System.DefaultWorkingDirectory)/bin/Test$(XA.Build.Configuration)
+        downloadPath: $(System.DefaultWorkingDirectory)/android/bin/Test$(XA.Build.Configuration)
 
     # Set up dependencies to run tests in both debug and release configurations
     - task: DotNetCoreCLI@2
       displayName: build Xamarin.Android.Tools.BootstrapTasks.csproj
       inputs:
-        projects: $(System.DefaultWorkingDirectory)/build-tools/Xamarin.Android.Tools.BootstrapTasks/Xamarin.Android.Tools.BootstrapTasks.csproj
-        arguments: -c Debug -bl:$(System.DefaultWorkingDirectory)/bin/TestDebug/BootstrapTasks.binlog
+        projects: $(System.DefaultWorkingDirectory)/android/build-tools/Xamarin.Android.Tools.BootstrapTasks/Xamarin.Android.Tools.BootstrapTasks.csproj
+        arguments: -c Debug -bl:$(System.DefaultWorkingDirectory)/android/bin/TestDebug/BootstrapTasks.binlog
 
     - template: /build-tools/automation/yaml-templates/run-dotnet-preview.yaml
       parameters:
-        project: Xamarin.Android.sln
+        project: android/Xamarin.Android.sln
         arguments: -t:PrepareJavaInterop -c Debug --no-restore
         displayName: prepare java.interop Debug
         continueOnError: false
 
     - template: /build-tools/automation/yaml-templates/run-dotnet-preview.yaml
       parameters:
-        project: Xamarin.Android.sln
+        project: android/Xamarin.Android.sln
         arguments: -t:PrepareJavaInterop -c $(XA.Build.Configuration) --no-restore
         displayName: prepare java.interop $(XA.Build.Configuration)
         continueOnError: false
 
     - template: /build-tools/automation/yaml-templates/run-dotnet-preview.yaml
       parameters:
         command: test
-        project: src/Microsoft.Android.Sdk.Analysis/Tests/Microsoft.Android.Sdk.Analysis.Tests.csproj 
+        project: android/src/Microsoft.Android.Sdk.Analysis/Tests/Microsoft.Android.Sdk.Analysis.Tests.csproj 
         arguments: -c $(XA.Build.Configuration)
         displayName: Test Microsoft.Android.Sdk.Analysis $(XA.Build.Configuration)
         continueOnError: false
@@ -131,33 +131,33 @@ stages:
     - task: DownloadPipelineArtifact@2
       inputs:
         artifactName: $(TestAssembliesArtifactName)
-        downloadPath: $(System.DefaultWorkingDirectory)/bin/Test$(XA.Build.Configuration)
+        downloadPath: $(System.DefaultWorkingDirectory)/android/bin/Test$(XA.Build.Configuration)
 
     # Set up dependencies to run tests in both debug and release configurations
     - task: DotNetCoreCLI@2
       displayName: build Xamarin.Android.Tools.BootstrapTasks.csproj
       inputs:
-        projects: $(System.DefaultWorkingDirectory)/build-tools/Xamarin.Android.Tools.BootstrapTasks/Xamarin.Android.Tools.BootstrapTasks.csproj
-        arguments: -c Debug -bl:$(System.DefaultWorkingDirectory)/bin/TestDebug/BootstrapTasks.binlog
+        projects: $(System.DefaultWorkingDirectory)/android/build-tools/Xamarin.Android.Tools.BootstrapTasks/Xamarin.Android.Tools.BootstrapTasks.csproj
+        arguments: -c Debug -bl:$(System.DefaultWorkingDirectory)/android/bin/TestDebug/BootstrapTasks.binlog
 
     - template: /build-tools/automation/yaml-templates/run-dotnet-preview.yaml
       parameters:
-        project: Xamarin.Android.sln
+        project: android/Xamarin.Android.sln
         arguments: -t:PrepareJavaInterop -c Debug --no-restore
         displayName: prepare java.interop Debug
         continueOnError: false
 
     - template: /build-tools/automation/yaml-templates/run-dotnet-preview.yaml
       parameters:
-        project: Xamarin.Android.sln
+        project: android/Xamarin.Android.sln
         arguments: -t:PrepareJavaInterop -c $(XA.Build.Configuration) --no-restore
         displayName: prepare java.interop $(XA.Build.Configuration)
         continueOnError: false
 
     - template: /build-tools/automation/yaml-templates/run-dotnet-preview.yaml
       parameters:
         command: test
-        project: src/Microsoft.Android.Sdk.Analysis/Tests/Microsoft.Android.Sdk.Analysis.Tests.csproj 
+        project: android/src/Microsoft.Android.Sdk.Analysis/Tests/Microsoft.Android.Sdk.Analysis.Tests.csproj 
         arguments: -c $(XA.Build.Configuration)
         displayName: Test Microsoft.Android.Sdk.Analysis $(XA.Build.Configuration)
         continueOnError: false
@@ -226,7 +226,7 @@ stages:
     - template: /build-tools/automation/yaml-templates/run-nunit-tests.yaml
       parameters:
         testRunTitle: Xamarin.Android.Tools.Aidl-Tests - macOS
-        testAssembly: $(System.DefaultWorkingDirectory)/bin/Test$(XA.Build.Configuration)/$(DotNetStableTargetFramework)/Xamarin.Android.Tools.Aidl-Tests.dll
+        testAssembly: $(System.DefaultWorkingDirectory)/android/bin/Test$(XA.Build.Configuration)/$(DotNetStableTargetFramework)/Xamarin.Android.Tools.Aidl-Tests.dll
 
     - task: ShellScript@2
       displayName: Test dotnet-local.sh