Skip to content

Commit a42e5db

Browse files
TravisEz13TravisEz13
authored
Ensure the official build files CodeQL issues (#24278)
* Enable and Disable CodeQL in the right places during the official build * fix codeql condition * fix syntax error * Enable codeQL issue filing * use parameter instead of branch to force codeql * try to name the build better * Update .pipelines/PowerShell-Coordinated_Packages-Official.yml * add debugging to display name of debugging parameters * fix spacing * Update .pipelines/PowerShell-Coordinated_Packages-Official.yml
1 parent 50e99a2 commit a42e5db

4 files changed

Lines changed: 40 additions & 22 deletions

File tree

‎.config/tsaoptions.json‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,5 @@
11
{
2+
"codebaseName": "TFSMSAzure_PowerShell",
23
"instanceUrl": "https://msazure.visualstudio.com",
34
"projectName": "One",
45
"areaPath": "One\\MGMT\\Compute\\Powershell\\Powershell\\PowerShell Core\\pwsh",

‎.pipelines/PowerShell-Coordinated_Packages-Official.yml‎

Lines changed: 23 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
name: UnifiedPackageBuild-$(Build.BuildId)
1+
name: UnifiedPackageBuild-$(BUILD.SOURCEBRANCHNAME)-$(Build.BuildId)
22
trigger: none
33

44
parameters:
@@ -11,19 +11,23 @@ parameters:
1111
type: string
1212
default: 'fromBranch'
1313
- name: SKIP_SIGNING
14-
displayName: Skip Signing
14+
displayName: Debugging - Skip Signing
1515
type: string
1616
default: 'NO'
1717
- name: RUN_TEST_AND_RELEASE
18-
displayName: Run Test and Release Artifacts Stage
18+
displayName: Debugging - Run Test and Release Artifacts Stage
1919
type: boolean
2020
default: true
2121
- name: RUN_WINDOWS
22-
displayName: Enable Windows Stage
22+
displayName: Debugging - Enable Windows Stage
2323
type: boolean
2424
default: true
2525
- name: ENABLE_MSBUILD_BINLOGS
26-
displayName: Enable MSBuild Binary Logs
26+
displayName: Debugging - Enable MSBuild Binary Logs
27+
type: boolean
28+
default: false
29+
- name: FORCE_CODEQL
30+
displayName: Debugging - Enable CodeQL and set cadence to 1 hour
2731
type: boolean
2832
default: false
2933

@@ -74,6 +78,16 @@ variables:
7478
- group: mscodehub-feed-read-akv
7579
- name: ENABLE_MSBUILD_BINLOGS
7680
value: ${{ parameters.ENABLE_MSBUILD_BINLOGS }}
81+
- ${{ if eq(parameters['FORCE_CODEQL'],'true') }}:
82+
# Cadence is hours before CodeQL will allow a re-upload of the database
83+
- name: CodeQL.Cadence
84+
value: 1
85+
- name: CODEQL_ENABLED
86+
${{ if or(eq(variables['Build.SourceBranch'], 'refs/heads/master'), eq(parameters['FORCE_CODEQL'],'true')) }}:
87+
value: true
88+
${{ else }}:
89+
value: false
90+
7791

7892
extends:
7993
template: v2/OneBranch.Official.CrossPlat.yml@onebranchTemplates
@@ -91,11 +105,10 @@ extends:
91105
enabled: false
92106
sbom:
93107
enabled: true
94-
compiled:
95-
${{ if eq(variables['Build.SourceBranch'], 'refs/heads/master') }}:
96-
enabled: true
97-
${{ else }}:
98-
enabled: false
108+
codeql:
109+
compiled:
110+
enabled: $(CODEQL_ENABLED)
111+
tsaEnabled: true # This enables TSA bug filing only for CodeQL 3000
99112
credscan:
100113
enabled: true
101114
scanFolder: $(Build.SourcesDirectory)

‎.pipelines/templates/linux.yml‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -33,9 +33,9 @@ jobs:
3333
value: ${{ parameters.Runtime }}
3434
- name: ob_sdl_sbom_packageName
3535
value: 'Microsoft.Powershell.Linux.${{ parameters.Runtime }}'
36-
- ${{ if eq(variables['Build.SourceBranch'], 'refs/heads/master') }}:
37-
- name: ob_sdl_codeql_compiled_enabled
38-
value: true
36+
# We add this manually, so we need it disabled the OneBranch auto-injected one.
37+
- name: ob_sdl_codeql_compiled_enabled
38+
value: false
3939

4040
steps:
4141
- checkout: self
@@ -54,12 +54,14 @@ jobs:
5454
repoRoot: $(PowerShellRoot)
5555

5656
- task: CodeQL3000Init@0 # Add CodeQL Init task right before your 'Build' step.
57-
condition: eq(variables['Build.SourceBranch'], 'refs/heads/master')
57+
condition: eq(variables['CODEQL_ENABLED'], 'true')
5858
env:
5959
ob_restore_phase: true # Set ob_restore_phase to run this step before '🔒 Setup Signing' step.
6060
inputs:
6161
Enabled: true
62-
AnalyzeInPipeline: true
62+
# AnalyzeInPipeline: false = upload results
63+
# AnalyzeInPipeline: true = do not upload results
64+
AnalyzeInPipeline: false
6365
Language: csharp
6466

6567
- pwsh: |
@@ -110,7 +112,7 @@ jobs:
110112
ob_restore_phase: true # Set ob_restore_phase to run this step before '🔒 Setup Signing' step.
111113
112114
- task: CodeQL3000Finalize@0 # Add CodeQL Finalize task right after your 'Build' step.
113-
condition: eq(variables['Build.SourceBranch'], 'refs/heads/master')
115+
condition: eq(variables['CODEQL_ENABLED'], 'true')
114116
env:
115117
ob_restore_phase: true # Set ob_restore_phase to run this step before '🔒 Setup Signing' step.
116118

‎.pipelines/templates/windows-hosted-build.yml‎

Lines changed: 8 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -34,9 +34,9 @@ jobs:
3434
value: ${{ parameters.BuildConfiguration }}
3535
- name: ob_sdl_sbom_packageName
3636
value: 'Microsoft.Powershell.Windows.${{ parameters.Architecture }}'
37-
- ${{ if eq(variables['Build.SourceBranch'], 'refs/heads/master') }}:
38-
- name: ob_sdl_codeql_compiled_enabled
39-
value: true
37+
# We add this manually, so we need it disabled the OneBranch auto-injected one.
38+
- name: ob_sdl_codeql_compiled_enabled
39+
value: false
4040

4141
steps:
4242
- checkout: self
@@ -55,12 +55,14 @@ jobs:
5555
repoRoot: $(PowerShellRoot)
5656

5757
- task: CodeQL3000Init@0 # Add CodeQL Init task right before your 'Build' step.
58-
condition: eq(variables['Build.SourceBranch'], 'refs/heads/master')
58+
condition: eq(variables['CODEQL_ENABLED'], 'true')
5959
env:
6060
ob_restore_phase: true # Set ob_restore_phase to run this step before '🔒 Setup Signing' step.
6161
inputs:
6262
Enabled: true
63-
AnalyzeInPipeline: true
63+
# AnalyzeInPipeline: false = upload results
64+
# AnalyzeInPipeline: true = do not upload results
65+
AnalyzeInPipeline: false
6466
Language: csharp
6567

6668
- pwsh: |
@@ -184,7 +186,7 @@ jobs:
184186
ob_restore_phase: true # Set ob_restore_phase to run this step before '🔒 Setup Signing' step.
185187
186188
- task: CodeQL3000Finalize@0 # Add CodeQL Finalize task right after your 'Build' step.
187-
condition: eq(variables['Build.SourceBranch'], 'refs/heads/master')
189+
condition: eq(variables['CODEQL_ENABLED'], 'true')
188190
env:
189191
ob_restore_phase: true # Set ob_restore_phase to run this step before '🔒 Setup Signing' step.
190192

0 commit comments

Comments
 (0)