|
| 1 | +# When extending this template, pipelines using a repository resource containing versions files for image caching must |
| 2 | +# do the following: |
| 3 | +# |
| 4 | +# - Do not rely on any source code from the versions repo so as to not circumvent SDL and CG guidelines |
| 5 | +# - The versions repo resource must be named `VersionsRepo` to avoid SDL scans |
| 6 | +# - The versions repo must be checked out to `$(Build.SourcesDirectory)/versions` to avoid CG scans |
| 7 | +# |
| 8 | +# If the pipeline is not using a separate repository resource, ensure that there is no source code checked out in |
| 9 | +# `$(Build.SourcesDirectory)/versions`, as it will not be scanned. |
| 10 | + |
| 11 | +parameters: |
| 12 | +- name: stages |
| 13 | + type: stageList |
| 14 | + default: [] |
| 15 | +# List of repositories that will be excluded from SDL scanning. This should |
| 16 | +# only be used when including other repos without building their source code. |
| 17 | +# E.g. for the dotnet/versions repo. |
| 18 | +- name: reposToExcludeFromScanning |
| 19 | + type: object |
| 20 | + default: [] |
| 21 | +# The pool that will be used for initializing service connections. |
| 22 | +- name: pool |
| 23 | + type: object |
| 24 | + default: |
| 25 | + name: $(default1ESInternalPoolName) |
| 26 | + image: $(default1ESInternalPoolImage) |
| 27 | + os: linux |
| 28 | +# The pool that will be used for SDL jobs. |
| 29 | +- name: sourceAnalysisPool |
| 30 | + type: object |
| 31 | + default: |
| 32 | + name: $(defaultSourceAnalysisPoolName) |
| 33 | + image: $(defaultSourceAnalysisPoolImage) |
| 34 | + os: windows |
| 35 | + |
| 36 | +resources: |
| 37 | + repositories: |
| 38 | + - repository: 1ESPipelineTemplates |
| 39 | + type: git |
| 40 | + name: 1ESPipelineTemplates/1ESPipelineTemplates |
| 41 | + ref: refs/tags/release |
| 42 | + |
| 43 | +extends: |
| 44 | + template: /eng/common/templates/task-prefix-decorator.yml@self |
| 45 | + parameters: |
| 46 | + baseTemplate: v1/1ES.${{ iif(contains(variables['Build.DefinitionName'], '-official'), 'Official', 'Unofficial') }}.PipelineTemplate.yml@1ESPipelineTemplates |
| 47 | + templateParameters: |
| 48 | + pool: ${{ parameters.pool }} |
| 49 | + sdl: |
| 50 | + # Required for unofficial pipelines because we rely on the ManifestGeneratorTask that is |
| 51 | + # automatically installed by 1ES pipeline templates |
| 52 | + sbom: |
| 53 | + enabled: true |
| 54 | + binskim: |
| 55 | + enabled: true |
| 56 | + componentgovernance: |
| 57 | + ignoreDirectories: $(Build.SourcesDirectory)/versions |
| 58 | + showAlertLink: true |
| 59 | + policheck: |
| 60 | + enabled: true |
| 61 | + ${{ if ne(length(parameters.reposToExcludeFromScanning), 0) }}: |
| 62 | + sourceRepositoriesToScan: |
| 63 | + exclude: |
| 64 | + - ${{ each repo in parameters.reposToExcludeFromScanning }}: |
| 65 | + - repository: ${{ repo }} |
| 66 | + sourceAnalysisPool: ${{ parameters.sourceAnalysisPool }} |
| 67 | + tsa: |
| 68 | + enabled: true |
| 69 | + stages: |
| 70 | + - ${{ parameters.stages }} |
0 commit comments