182 lines
8.9 KiB
YAML
182 lines
8.9 KiB
YAML
parameters:
|
|
enable: 'false' # Whether the SDL validation job should execute or not
|
|
overrideParameters: '' # Optional: to override values for parameters.
|
|
additionalParameters: '' # Optional: parameters that need user specific values eg: '-SourceToolsList @("abc","def") -ArtifactToolsList @("ghi","jkl")'
|
|
# Optional: if specified, restore and use this version of Guardian instead of the default.
|
|
overrideGuardianVersion: ''
|
|
# Optional: if true, publish the '.gdn' folder as a pipeline artifact. This can help with in-depth
|
|
# diagnosis of problems with specific tool configurations.
|
|
publishGuardianDirectoryToPipeline: false
|
|
# The script to run to execute all SDL tools. Use this if you want to use a script to define SDL
|
|
# parameters rather than relying on YAML. It may be better to use a local script, because you can
|
|
# reproduce results locally without piecing together a command based on the YAML.
|
|
executeAllSdlToolsScript: 'eng/common/sdl/execute-all-sdl-tools.ps1'
|
|
# There is some sort of bug (has been reported) in Azure DevOps where if this parameter is named
|
|
# 'continueOnError', the parameter value is not correctly picked up.
|
|
# This can also be remedied by the caller (post-build.yml) if it does not use a nested parameter
|
|
sdlContinueOnError: false # optional: determines whether to continue the build if the step errors;
|
|
# optional: determines if build artifacts should be downloaded.
|
|
downloadArtifacts: true
|
|
# optional: determines if this job should search the directory of downloaded artifacts for
|
|
# 'tar.gz' and 'zip' archive files and extract them before running SDL validation tasks.
|
|
extractArchiveArtifacts: false
|
|
dependsOn: '' # Optional: dependencies of the job
|
|
artifactNames: '' # Optional: patterns supplied to DownloadBuildArtifacts
|
|
# Usage:
|
|
# artifactNames:
|
|
# - 'BlobArtifacts'
|
|
# - 'Artifacts_Windows_NT_Release'
|
|
# Optional: download a list of pipeline artifacts. 'downloadArtifacts' controls build artifacts,
|
|
# not pipeline artifacts, so doesn't affect the use of this parameter.
|
|
pipelineArtifactNames: []
|
|
|
|
jobs:
|
|
- job: Run_SDL
|
|
dependsOn: ${{ parameters.dependsOn }}
|
|
displayName: Run SDL tool
|
|
condition: eq( ${{ parameters.enable }}, 'true')
|
|
variables:
|
|
- group: DotNet-VSTS-Bot
|
|
- name: AzDOProjectName
|
|
value: ${{ parameters.AzDOProjectName }}
|
|
- name: AzDOPipelineId
|
|
value: ${{ parameters.AzDOPipelineId }}
|
|
- name: AzDOBuildId
|
|
value: ${{ parameters.AzDOBuildId }}
|
|
# The Guardian version specified in 'eng/common/sdl/packages.config'. This value must be kept in
|
|
# sync with the packages.config file.
|
|
- name: DefaultGuardianVersion
|
|
value: 0.110.1
|
|
- name: GuardianVersion
|
|
value: ${{ coalesce(parameters.overrideGuardianVersion, '$(DefaultGuardianVersion)') }}
|
|
- name: GuardianPackagesConfigFile
|
|
value: $(Build.SourcesDirectory)\eng\common\sdl\packages.config
|
|
pool:
|
|
# We don't use the collection uri here because it might vary (.visualstudio.com vs. dev.azure.com)
|
|
${{ if eq(variables['System.TeamProject'], 'DevDiv') }}:
|
|
name: VSEngSS-MicroBuild2022-1ES
|
|
demands: Cmd
|
|
# If it's not devdiv, it's dnceng
|
|
${{ if ne(variables['System.TeamProject'], 'DevDiv') }}:
|
|
name: NetCore1ESPool-Internal
|
|
demands: ImageOverride -equals Build.Server.Amd64.VS2019
|
|
steps:
|
|
- checkout: self
|
|
clean: true
|
|
|
|
- template: /eng/common/templates/post-build/setup-maestro-vars.yml
|
|
|
|
- ${{ if ne(parameters.downloadArtifacts, 'false')}}:
|
|
- ${{ if ne(parameters.artifactNames, '') }}:
|
|
- ${{ each artifactName in parameters.artifactNames }}:
|
|
- task: DownloadBuildArtifacts@0
|
|
displayName: Download Build Artifacts
|
|
inputs:
|
|
buildType: specific
|
|
buildVersionToDownload: specific
|
|
project: $(AzDOProjectName)
|
|
pipeline: $(AzDOPipelineId)
|
|
buildId: $(AzDOBuildId)
|
|
artifactName: ${{ artifactName }}
|
|
downloadPath: $(Build.ArtifactStagingDirectory)\artifacts
|
|
checkDownloadedFiles: true
|
|
- ${{ if eq(parameters.artifactNames, '') }}:
|
|
- task: DownloadBuildArtifacts@0
|
|
displayName: Download Build Artifacts
|
|
inputs:
|
|
buildType: specific
|
|
buildVersionToDownload: specific
|
|
project: $(AzDOProjectName)
|
|
pipeline: $(AzDOPipelineId)
|
|
buildId: $(AzDOBuildId)
|
|
downloadType: specific files
|
|
itemPattern: "**"
|
|
downloadPath: $(Build.ArtifactStagingDirectory)\artifacts
|
|
checkDownloadedFiles: true
|
|
|
|
- ${{ each artifactName in parameters.pipelineArtifactNames }}:
|
|
- task: DownloadPipelineArtifact@2
|
|
displayName: Download Pipeline Artifacts
|
|
inputs:
|
|
buildType: specific
|
|
buildVersionToDownload: specific
|
|
project: $(AzDOProjectName)
|
|
pipeline: $(AzDOPipelineId)
|
|
buildId: $(AzDOBuildId)
|
|
artifactName: ${{ artifactName }}
|
|
downloadPath: $(Build.ArtifactStagingDirectory)\artifacts
|
|
checkDownloadedFiles: true
|
|
|
|
- powershell: eng/common/sdl/extract-artifact-packages.ps1
|
|
-InputPath $(Build.ArtifactStagingDirectory)\artifacts\BlobArtifacts
|
|
-ExtractPath $(Build.ArtifactStagingDirectory)\artifacts\BlobArtifacts
|
|
displayName: Extract Blob Artifacts
|
|
continueOnError: ${{ parameters.sdlContinueOnError }}
|
|
|
|
- powershell: eng/common/sdl/extract-artifact-packages.ps1
|
|
-InputPath $(Build.ArtifactStagingDirectory)\artifacts\PackageArtifacts
|
|
-ExtractPath $(Build.ArtifactStagingDirectory)\artifacts\PackageArtifacts
|
|
displayName: Extract Package Artifacts
|
|
continueOnError: ${{ parameters.sdlContinueOnError }}
|
|
|
|
- ${{ if ne(parameters.extractArchiveArtifacts, 'false') }}:
|
|
- powershell: eng/common/sdl/extract-artifact-archives.ps1
|
|
-InputPath $(Build.ArtifactStagingDirectory)\artifacts
|
|
-ExtractPath $(Build.ArtifactStagingDirectory)\artifacts
|
|
displayName: Extract Archive Artifacts
|
|
continueOnError: ${{ parameters.sdlContinueOnError }}
|
|
|
|
- ${{ if ne(parameters.overrideGuardianVersion, '') }}:
|
|
- powershell: |
|
|
$content = Get-Content $(GuardianPackagesConfigFile)
|
|
|
|
Write-Host "packages.config content was:`n$content"
|
|
|
|
$content = $content.Replace('$(DefaultGuardianVersion)', '$(GuardianVersion)')
|
|
$content | Set-Content $(GuardianPackagesConfigFile)
|
|
|
|
Write-Host "packages.config content updated to:`n$content"
|
|
displayName: Use overridden Guardian version ${{ parameters.overrideGuardianVersion }}
|
|
|
|
- task: NuGetToolInstaller@1
|
|
displayName: 'Install NuGet.exe'
|
|
- task: NuGetCommand@2
|
|
displayName: 'Install Guardian'
|
|
inputs:
|
|
restoreSolution: $(Build.SourcesDirectory)\eng\common\sdl\packages.config
|
|
feedsToUse: config
|
|
nugetConfigPath: $(Build.SourcesDirectory)\eng\common\sdl\NuGet.config
|
|
externalFeedCredentials: GuardianConnect
|
|
restoreDirectory: $(Build.SourcesDirectory)\.packages
|
|
|
|
- ${{ if ne(parameters.overrideParameters, '') }}:
|
|
- powershell: ${{ parameters.executeAllSdlToolsScript }} ${{ parameters.overrideParameters }}
|
|
displayName: Execute SDL
|
|
continueOnError: ${{ parameters.sdlContinueOnError }}
|
|
- ${{ if eq(parameters.overrideParameters, '') }}:
|
|
- powershell: ${{ parameters.executeAllSdlToolsScript }}
|
|
-GuardianPackageName Microsoft.Guardian.Cli.$(GuardianVersion)
|
|
-NugetPackageDirectory $(Build.SourcesDirectory)\.packages
|
|
-AzureDevOpsAccessToken $(dn-bot-dotnet-build-rw-code-rw)
|
|
${{ parameters.additionalParameters }}
|
|
displayName: Execute SDL
|
|
continueOnError: ${{ parameters.sdlContinueOnError }}
|
|
|
|
- ${{ if ne(parameters.publishGuardianDirectoryToPipeline, 'false') }}:
|
|
# We want to publish the Guardian results and configuration for easy diagnosis. However, the
|
|
# '.gdn' dir is a mix of configuration, results, extracted dependencies, and Guardian default
|
|
# tooling files. Some of these files are large and aren't useful during an investigation, so
|
|
# exclude them by simply deleting them before publishing. (As of writing, there is no documented
|
|
# way to selectively exclude a dir from the pipeline artifact publish task.)
|
|
- task: DeleteFiles@1
|
|
displayName: Delete Guardian dependencies to avoid uploading
|
|
inputs:
|
|
SourceFolder: $(Agent.BuildDirectory)/.gdn
|
|
Contents: |
|
|
c
|
|
i
|
|
condition: succeededOrFailed()
|
|
- publish: $(Agent.BuildDirectory)/.gdn
|
|
artifact: GuardianConfiguration
|
|
displayName: Publish GuardianConfiguration
|
|
condition: succeededOrFailed()
|