Skip to content

Ensure the official build files CodeQL issues #24278

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Travis Plunk (TravisEz13) merged 10 commits into from
Sep 12, 2024
Merged

Ensure the official build files CodeQL issues #24278

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
10 commits
Select commit Hold shift + click to select a range
571858b
Enable and Disable CodeQL in the right places during the official build
TravisEz13 Sep 11, 2024
1395da5
fix codeql condition
TravisEz13 Sep 11, 2024
fdb3b9f
fix syntax error
TravisEz13 Sep 11, 2024
2233e19
Enable codeQL issue filing
TravisEz13 Sep 11, 2024
701ef9d
use parameter instead of branch to force codeql
TravisEz13 Sep 11, 2024
0b116b3
try to name the build better
TravisEz13 Sep 12, 2024
7e8fac4
Update .pipelines/PowerShell-Coordinated_Packages-Official.yml
TravisEz13 Sep 12, 2024
47c8796
add debugging to display name of debugging parameters
TravisEz13 Sep 12, 2024
da584c0
fix spacing
TravisEz13 Sep 12, 2024
43fee4c
Update .pipelines/PowerShell-Coordinated_Packages-Official.yml
TravisEz13 Sep 12, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions .config/tsaoptions.json
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,5 @@
{
"codebaseName": "TFSMSAzure_PowerShell",
"instanceUrl": "https://msazure.visualstudio.com",
"projectName": "One",
"areaPath": "One\\MGMT\\Compute\\Powershell\\Powershell\\PowerShell Core\\pwsh",
Expand Down
33 changes: 23 additions & 10 deletions .pipelines/PowerShell-Coordinated_Packages-Official.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
name: UnifiedPackageBuild-$(Build.BuildId)
name: UnifiedPackageBuild-$(BUILD.SOURCEBRANCHNAME)-$(Build.BuildId)
trigger: none

parameters:
Expand All @@ -11,19 +11,23 @@ parameters:
type: string
default: 'fromBranch'
- name: SKIP_SIGNING
displayName: Skip Signing
displayName: Debugging - Skip Signing
type: string
default: 'NO'
- name: RUN_TEST_AND_RELEASE
displayName: Run Test and Release Artifacts Stage
displayName: Debugging - Run Test and Release Artifacts Stage
type: boolean
default: true
- name: RUN_WINDOWS
displayName: Enable Windows Stage
displayName: Debugging - Enable Windows Stage
type: boolean
default: true
- name: ENABLE_MSBUILD_BINLOGS
displayName: Enable MSBuild Binary Logs
displayName: Debugging - Enable MSBuild Binary Logs
type: boolean
default: false
- name: FORCE_CODEQL
displayName: Debugging - Enable CodeQL and set cadence to 1 hour
type: boolean
default: false

Expand Down Expand Up @@ -74,6 +78,16 @@ variables:
- group: mscodehub-feed-read-akv
- name: ENABLE_MSBUILD_BINLOGS
value: ${{ parameters.ENABLE_MSBUILD_BINLOGS }}
- ${{ if eq(parameters['FORCE_CODEQL'],'true') }}:
# Cadence is hours before CodeQL will allow a re-upload of the database
- name: CodeQL.Cadence
Comment thread
TravisEz13 marked this conversation as resolved.
value: 1
- name: CODEQL_ENABLED
${{ if or(eq(variables['Build.SourceBranch'], 'refs/heads/master'), eq(parameters['FORCE_CODEQL'],'true')) }}:
value: true
${{ else }}:
value: false


extends:
template: v2/OneBranch.Official.CrossPlat.yml@onebranchTemplates
Expand All @@ -91,11 +105,10 @@ extends:
enabled: false
sbom:
enabled: true
compiled:
${{ if eq(variables['Build.SourceBranch'], 'refs/heads/master') }}:
enabled: true
${{ else }}:
enabled: false
codeql:
compiled:
enabled: $(CODEQL_ENABLED)
tsaEnabled: true # This enables TSA bug filing only for CodeQL 3000
credscan:
enabled: true
scanFolder: $(Build.SourcesDirectory)
Expand Down
14 changes: 8 additions & 6 deletions .pipelines/templates/linux.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -33,9 +33,9 @@ jobs:
value: ${{ parameters.Runtime }}
- name: ob_sdl_sbom_packageName
value: 'Microsoft.Powershell.Linux.${{ parameters.Runtime }}'
- ${{ if eq(variables['Build.SourceBranch'], 'refs/heads/master') }}:
- name: ob_sdl_codeql_compiled_enabled
value: true
# We add this manually, so we need it disabled the OneBranch auto-injected one.
- name: ob_sdl_codeql_compiled_enabled
value: false

steps:
- checkout: self
Expand All @@ -54,12 +54,14 @@ jobs:
repoRoot: $(PowerShellRoot)

- task: CodeQL3000Init@0 # Add CodeQL Init task right before your 'Build' step.
condition: eq(variables['Build.SourceBranch'], 'refs/heads/master')
condition: eq(variables['CODEQL_ENABLED'], 'true')
env:
ob_restore_phase: true # Set ob_restore_phase to run this step before '🔒 Setup Signing' step.
inputs:
Enabled: true
AnalyzeInPipeline: true
# AnalyzeInPipeline: false = upload results
# AnalyzeInPipeline: true = do not upload results
AnalyzeInPipeline: false
Language: csharp

- pwsh: |
Expand Down Expand Up @@ -110,7 +112,7 @@ jobs:
ob_restore_phase: true # Set ob_restore_phase to run this step before '🔒 Setup Signing' step.

- task: CodeQL3000Finalize@0 # Add CodeQL Finalize task right after your 'Build' step.
condition: eq(variables['Build.SourceBranch'], 'refs/heads/master')
condition: eq(variables['CODEQL_ENABLED'], 'true')
env:
ob_restore_phase: true # Set ob_restore_phase to run this step before '🔒 Setup Signing' step.

Expand Down
14 changes: 8 additions & 6 deletions .pipelines/templates/windows-hosted-build.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -34,9 +34,9 @@ jobs:
value: ${{ parameters.BuildConfiguration }}
- name: ob_sdl_sbom_packageName
value: 'Microsoft.Powershell.Windows.${{ parameters.Architecture }}'
- ${{ if eq(variables['Build.SourceBranch'], 'refs/heads/master') }}:
- name: ob_sdl_codeql_compiled_enabled
value: true
# We add this manually, so we need it disabled the OneBranch auto-injected one.
- name: ob_sdl_codeql_compiled_enabled
value: false

steps:
- checkout: self
Expand All @@ -55,12 +55,14 @@ jobs:
repoRoot: $(PowerShellRoot)

- task: CodeQL3000Init@0 # Add CodeQL Init task right before your 'Build' step.
condition: eq(variables['Build.SourceBranch'], 'refs/heads/master')
condition: eq(variables['CODEQL_ENABLED'], 'true')
env:
ob_restore_phase: true # Set ob_restore_phase to run this step before '🔒 Setup Signing' step.
inputs:
Enabled: true
AnalyzeInPipeline: true
# AnalyzeInPipeline: false = upload results
# AnalyzeInPipeline: true = do not upload results
AnalyzeInPipeline: false
Language: csharp

- pwsh: |
Expand Down Expand Up @@ -184,7 +186,7 @@ jobs:
ob_restore_phase: true # Set ob_restore_phase to run this step before '🔒 Setup Signing' step.

- task: CodeQL3000Finalize@0 # Add CodeQL Finalize task right after your 'Build' step.
condition: eq(variables['Build.SourceBranch'], 'refs/heads/master')
condition: eq(variables['CODEQL_ENABLED'], 'true')
env:
ob_restore_phase: true # Set ob_restore_phase to run this step before '🔒 Setup Signing' step.

Expand Down