Skip to content

Change binskim to filter and only run on build legs #8594

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 9 commits into from
Jan 7, 2025
Merged

Change binskim to filter and only run on build legs #8594

Changes from 8 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
6c1a8a5
Set the allow no targets environment variable to true
marcpopMSFT Oct 18, 2024
e430da1
try the prerelease version 4.3.1
marcpopMSFT Oct 18, 2024
5b7c126
try a regex that has a valid value and the artifacts folder
marcpopMSFT Oct 24, 2024
8833e02
Add md file explaining why this folder needs to exist
marcpopMSFT Nov 26, 2024
6b45132
add presteps and remove binskim md file
marcpopMSFT Dec 6, 2024
56f0ed9
Merge remote-tracking branch 'origin/release/9.0.1xx' into marcpopMSF…
marcpopMSFT Dec 6, 2024
608fb25
add the specific prestep workaround
marcpopMSFT Dec 6, 2024
5f2f8b6
Move the binskim filter to the specific job we want it running in
marcpopMSFT Dec 16, 2024
8c22ce0
Respond to PR feedback
marcpopMSFT Dec 16, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
12 changes: 10 additions & 2 deletions azure-pipelines.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -27,6 +27,8 @@ variables:
value: true
- name: EnableReleaseOneLocBuild
value: false
- name: GDN_ALLOW_ANALYZE_NO_TARGETS
value: true
- template: /eng/common/templates-official/variables/pool-providers.yml

resources:
Expand Down Expand Up @@ -59,8 +61,6 @@ extends:
enabled: true
tsa:
enabled: true
binskim:
analyzeTargetGlob: +:f|**\*.dll;+:f|**\*.exe;
stages:
- stage: build
displayName: Build
Expand Down Expand Up @@ -89,6 +89,14 @@ extends:
enableInternalSources: true
enableTelemetry: true
helixRepo: dotnet/templating
# WORKAROUND: BinSkim requires the folder exist prior to scanning.
templateContext:
sdl:
binskim:
analyzeTargetGlob: +:f|artifacts\bin\**\*.dll;+:f|artifacts\bin\**\*.exe;
preSteps:
- powershell: New-Item -ItemType Directory -Path $(Build.SourcesDirectory)/artifacts/bin -Force
displayName: Create artifacts/bin directory
jobs:
- ${{ each config in parameters.buildConfigurations }}:
- job: Windows_NT_${{ config.buildConfig }}
Expand Down
Loading