Skip to content

Commit dd9051f

Browse files
WardenGnawWardenGnaw
authored
Merge pull request #1407 from microsoft/main
Merge 'main' into 'release_mdd'
2 parents 1b020d7 + c713778 commit dd9051f

File tree

26 files changed

+412
-113
lines changed

26 files changed

+412
-113
lines changed

‎.github/workflows/Build-And-Test.yml‎

Lines changed: 16 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -22,20 +22,20 @@ jobs:
2222

2323
steps:
2424
- name: Checkout
25-
uses: actions/checkout@v2
25+
uses: actions/checkout@v3
2626
with:
2727
fetch-depth: 0
2828

2929
- name: Install .NET Core
30-
uses: actions/setup-dotnet@v1
30+
uses: actions/setup-dotnet@v3
3131
with:
3232
dotnet-version: 6.0.x
3333

3434
- name: Setup MSBuild.exe
35-
uses: microsoft/setup-msbuild@v1.0.2
35+
uses: microsoft/setup-msbuild@v1.1
3636

3737
- name: Setup NuGet.exe for use with actions
38-
uses: NuGet/setup-nuget@v1.0.5
38+
uses: NuGet/setup-nuget@v1
3939

4040
- name: Build MIDebugEngine
4141
run: |
@@ -44,7 +44,7 @@ jobs:
4444
Configuration: ${{ matrix.configuration }}
4545

4646
- name: Setup VSTest.console.exe
47-
uses: darenm/Setup-VSTest@v1
47+
uses: darenm/Setup-VSTest@v1.2
4848

4949
- name: Run VS Extension tests
5050
run: vstest.console.exe ${{ github.workspace }}\bin\${{ matrix.configuration }}\MICoreUnitTests.dll ${{ github.workspace }}\bin\${{ matrix.configuration }}\JDbgUnitTests.dll ${{ github.workspace }}\bin\${{ matrix.configuration }}\SSHDebugTests.dll ${{ github.workspace }}\bin\${{ matrix.configuration }}\MIDebugEngineUnitTests.dll
@@ -54,20 +54,20 @@ jobs:
5454

5555
steps:
5656
- name: Checkout
57-
uses: actions/checkout@v2
57+
uses: actions/checkout@v3
5858
with:
5959
fetch-depth: 0
6060

6161
- name: Install .NET Core
62-
uses: actions/setup-dotnet@v1
62+
uses: actions/setup-dotnet@v3
6363
with:
6464
dotnet-version: 6.0.x
6565

6666
- name: Setup MSBuild.exe
67-
uses: microsoft/setup-msbuild@v1.0.2
67+
uses: microsoft/setup-msbuild@v1.1
6868

6969
- name: Setup NuGet.exe for use with actions
70-
uses: NuGet/setup-nuget@v1.0.5
70+
uses: NuGet/setup-nuget@v1
7171

7272
- name: Build MIDebugEngine
7373
run: |
@@ -102,7 +102,7 @@ jobs:
102102
dotnet test $CppTestsPath --logger "trx;LogFileName=$ResultsPath"
103103
104104
- name: 'Upload Test Results'
105-
uses: actions/upload-artifact@v2
105+
uses: actions/upload-artifact@v3
106106
if: ${{ always() }}
107107
with:
108108
name: win_msys2_x64_results
@@ -112,12 +112,12 @@ jobs:
112112
runs-on: ubuntu-latest
113113
steps:
114114
- name: Checkout
115-
uses: actions/checkout@v2
115+
uses: actions/checkout@v3
116116
with:
117117
fetch-depth: 0
118118

119119
- name: Install .NET Core
120-
uses: actions/setup-dotnet@v1
120+
uses: actions/setup-dotnet@v3
121121
with:
122122
dotnet-version: 6.0.x
123123

@@ -143,7 +143,7 @@ jobs:
143143
${{ github.workspace }}/eng/Scripts/CI-Test.sh
144144
145145
- name: 'Upload Test Results'
146-
uses: actions/upload-artifact@v2
146+
uses: actions/upload-artifact@v3
147147
if: ${{ always() }}
148148
with:
149149
name: linux_x64_results
@@ -153,12 +153,12 @@ jobs:
153153
runs-on: macos-latest
154154
steps:
155155
- name: Checkout
156-
uses: actions/checkout@v2
156+
uses: actions/checkout@v3
157157
with:
158158
fetch-depth: 0
159159

160160
- name: Install .NET Core
161-
uses: actions/setup-dotnet@v1
161+
uses: actions/setup-dotnet@v3
162162
with:
163163
dotnet-version: 6.0.x
164164

@@ -172,7 +172,7 @@ jobs:
172172
${{ github.workspace }}/eng/Scripts/CI-Test.sh
173173
174174
- name: 'Upload Test Results'
175-
uses: actions/upload-artifact@v2
175+
uses: actions/upload-artifact@v3
176176
if: ${{ always() }}
177177
with:
178178
name: osx_x64_results

‎SECURITY.md‎

Lines changed: 41 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,41 @@
1+
<!-- BEGIN MICROSOFT SECURITY.MD V0.0.8 BLOCK -->
2+
3+
## Security
4+
5+
Microsoft takes the security of our software products and services seriously, which includes all source code repositories managed through our GitHub organizations, which include [Microsoft](https://github.com/microsoft), [Azure](https://github.com/Azure), [DotNet](https://github.com/dotnet), [AspNet](https://github.com/aspnet), [Xamarin](https://github.com/xamarin), and [our GitHub organizations](https://opensource.microsoft.com/).
6+
7+
If you believe you have found a security vulnerability in any Microsoft-owned repository that meets [Microsoft's definition of a security vulnerability](https://aka.ms/opensource/security/definition), please report it to us as described below.
8+
9+
## Reporting Security Issues
10+
11+
**Please do not report security vulnerabilities through public GitHub issues.**
12+
13+
Instead, please report them to the Microsoft Security Response Center (MSRC) at [https://msrc.microsoft.com/create-report](https://aka.ms/opensource/security/create-report).
14+
15+
If you prefer to submit without logging in, send email to [[email protected]](mailto:[email protected]). If possible, encrypt your message with our PGP key; please download it from the [Microsoft Security Response Center PGP Key page](https://aka.ms/opensource/security/pgpkey).
16+
17+
You should receive a response within 24 hours. If for some reason you do not, please follow up via email to ensure we received your original message. Additional information can be found at [microsoft.com/msrc](https://aka.ms/opensource/security/msrc).
18+
19+
Please include the requested information listed below (as much as you can provide) to help us better understand the nature and scope of the possible issue:
20+
21+
* Type of issue (e.g. buffer overflow, SQL injection, cross-site scripting, etc.)
22+
* Full paths of source file(s) related to the manifestation of the issue
23+
* The location of the affected source code (tag/branch/commit or direct URL)
24+
* Any special configuration required to reproduce the issue
25+
* Step-by-step instructions to reproduce the issue
26+
* Proof-of-concept or exploit code (if possible)
27+
* Impact of the issue, including how an attacker might exploit the issue
28+
29+
This information will help us triage your report more quickly.
30+
31+
If you are reporting for a bug bounty, more complete reports can contribute to a higher bounty award. Please visit our [Microsoft Bug Bounty Program](https://aka.ms/opensource/security/bounty) page for more details about our active programs.
32+
33+
## Preferred Languages
34+
35+
We prefer all communications to be in English.
36+
37+
## Policy
38+
39+
Microsoft follows the principle of [Coordinated Vulnerability Disclosure](https://aka.ms/opensource/security/cvd).
40+
41+
<!-- END MICROSOFT SECURITY.MD BLOCK -->

‎eng/pipelines/MIDebugEngine-CI.yml‎

Lines changed: 12 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,15 @@
11
---
22
name: $(Date:yyyMMdd).$(Rev:r)
3+
4+
schedules:
5+
# Run on the 1st and 15th of every month
6+
- cron: 30 1 1,15 * *
7+
displayName: Biweekly Build
8+
branches:
9+
include:
10+
- main
11+
always: true # Run even if there are no code changes
12+
313
stages:
414
- stage: CI
515
dependsOn: []
@@ -8,6 +18,8 @@ stages:
818
value: test
919
- name: TeamName
1020
value: MDDDebugger
21+
- name: Codeql.Enabled
22+
value: true
1123
jobs:
1224
- template: ./jobs/VSEngSS-MicroBuild2022-1ES.job.yml
1325
parameters:

‎eng/pipelines/resources/TSAConfig.json‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
{
2+
"codebaseName": "MIEngine",
3+
"notificationAliases": ["[email protected]"],
4+
"instanceUrl": "https://devdiv.visualstudio.com",
5+
"projectName": "DevDiv",
6+
"areaPath": "DevDiv\\VS Diagnostics\\Debugger - XPlat\\Cpp",
7+
"iterationPath": "DevDiv",
8+
"allTools": true
9+
}

‎eng/pipelines/resources/falsepositives.gdnsuppress‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
{}

‎eng/pipelines/steps/APIScan.yml‎

Lines changed: 15 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,21 +1,33 @@
11
parameters:
2-
FolderToScan: '$(Pipeline.Workspace)\Lab.Release'
2+
SourceFolder: '$(Pipeline.Workspace)\Lab.Release'
33

44
steps:
55
- task: CopyFiles@2
66
displayName: 'Copy Files to: $(Pipeline.Workspace)\ApiScanFiles'
77
inputs:
8-
SourceFolder: ${{ parameters.FolderToScan }}
8+
SourceFolder: ${{ parameters.SourceFolder }}
99
Contents: |
1010
**\*Microsoft@(*.dll|*.pdb|*.exe)
11-
**\*Newtonsoft@(*.dll|*.pdb|*.exe)
1211
**\*OpenDebugAD7@(*.dll|*.pdb|*.exe)
1312
**\*WindowsDebugLauncher@(*.dll|*.pdb|*.exe)
13+
**\Microsoft.VisualStudio.Debugger.Interop.UnixPortSupplier.DesignTime.dll
1414
!**\*.resources.dll
15+
!**\Microsoft.VisualStudio.Debugger.Interop*
16+
!**\vscode\Microsoft.VisualStudio.Interop.dll
17+
!**\vscode\Microsoft.VisualStudio.Shared.VSCodeDebugProtocol.dll
1518
TargetFolder: '$(Pipeline.Workspace)\ApiScanFiles'
1619
CleanTargetFolder: true
1720
OverWrite: true
1821

22+
# This gets excluded by !**\Microsoft.VisualStudio.Debugger.Interop* but we create Microsoft.VisualStudio.Debugger.Interop.UnixPortSupplier.DesignTime.dll.
23+
- task: CopyFiles@2
24+
displayName: 'Copy UnixPortSupplier to: $(Pipeline.Workspace)\ApiScanFiles'
25+
inputs:
26+
SourceFolder: ${{ parameters.SourceFolder }}
27+
Contents: |
28+
**\Microsoft.VisualStudio.Debugger.Interop.UnixPortSupplier.DesignTime.dll
29+
TargetFolder: '$(Pipeline.Workspace)\ApiScanFiles'
30+
1931
- task: securedevelopmentteam.vss-secure-development-tools.build-task-apiscan.APIScan@2
2032
displayName: 'Run APIScan'
2133
inputs:

‎eng/pipelines/steps/PostAnalysis.yml‎

Lines changed: 19 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,19 @@
1+
parameters:
2+
GdnSuppressionFiles: $(Build.SourcesDirectory)\eng\pipelines\resources\falsepositives.gdnsuppress
3+
4+
steps:
5+
- task: securedevelopmentteam.vss-secure-development-tools.build-task-postanalysis.PostAnalysis@2
6+
displayName: 🏋️‍♀️ Break on compliance issues
7+
inputs:
8+
GdnBreakAllTools: true
9+
GdnBreakSuppressionFiles: ${{ parameters.GdnSuppressionFiles }}
10+
GdnBreakSuppressionSets: falsepositives
11+
12+
- task: securedevelopmentteam.vss-secure-development-tools.build-task-postanalysis.PostAnalysis@2
13+
displayName: 📝 Generate Guardian Suppressions File
14+
inputs:
15+
GdnBreakAllTools: true
16+
GdnBreakOutputSuppressionFile: $(Build.ArtifactStagingDirectory)\GuardianSuppressions
17+
GdnBreakOutputSuppressionSet: falsepositives
18+
continueOnError: true
19+
condition: failed()

‎eng/pipelines/tasks/AntiMalware.yml‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
parameters:
2+
SourcePath: $(Build.SourcesDirectory)
3+
ArtifactPath: $(Pipeline.Workspace)
4+
5+
steps:
6+
- task: AntiMalware@4
7+
displayName: 🔎 Run AntiMalware on source
8+
inputs:
9+
InputType: Basic
10+
ScanType: CustomScan
11+
FileDirPath: ${{ parameters.SourcePath }}
12+
continueOnError: true
13+
14+
- task: AntiMalware@4
15+
displayName: 🔎 Run AntiMalware on artifacts
16+
inputs:
17+
InputType: Basic
18+
ScanType: CustomScan
19+
FileDirPath: ${{ parameters.ArtifactPath }}
20+
DisableRemediation: false
21+
continueOnError: true

‎eng/pipelines/tasks/CredScan.yml‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,4 +3,5 @@ steps:
33
displayName: 'Run CredScan'
44
inputs:
55
outputFormat: pre
6-
debugMode: false
6+
debugMode: false
7+
continueOnError: true

‎eng/pipelines/tasks/PSScriptAnalyzer.yml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,7 @@
1+
steps:
2+
- task: PSScriptAnalyzer@1
3+
displayName: 🔎 Run PSScriptAnalyzer
4+
inputs:
5+
Path: '$(Build.SourcesDirectory)'
6+
Settings: required
7+
Recurse: true

0 commit comments

Comments
 (0)