diff --git a/.vsts-ci/misc-analysis.yml b/.vsts-ci/misc-analysis.yml index 1f9859568bb..4cf34cf7487 100644 --- a/.vsts-ci/misc-analysis.yml +++ b/.vsts-ci/misc-analysis.yml @@ -6,26 +6,24 @@ trigger: include: - master - release* - paths: - exclude: - - /src/* pr: branches: include: - master - release* - paths: - exclude: - - /src/* resources: - repo: self clean: true -phases: -- phase: Linux_CI +jobs: +- template: templates/credscan.yml - queue: +- job: Linux_CI + + displayName: Markdown and Common Tests + + pool: name: Hosted Ubuntu 1604 steps: - powershell: | diff --git a/.vsts-ci/templates/credscan.yml b/.vsts-ci/templates/credscan.yml new file mode 100644 index 00000000000..859500797fa --- /dev/null +++ b/.vsts-ci/templates/credscan.yml @@ -0,0 +1,28 @@ +parameters: + pool: 'Hosted VS2017' + jobName: 'credscan' + displayName: Secret Scan + +jobs: +- job: ${{ parameters.jobName }} + pool: + name: ${{ parameters.pool }} + + displayName: ${{ parameters.displayName }} + + steps: + - task: securedevelopmentteam.vss-secure-development-tools.build-task-credscan.CredScan@2 + displayName: 'Scan for secrets' + inputs: + suppressionsFile: tools/credScan/suppress.json + debugMode: false + + - task: securedevelopmentteam.vss-secure-development-tools.build-task-publishsecurityanalysislogs.PublishSecurityAnalysisLogs@2 + displayName: 'Publish Secret Scan Logs to Build Artifacts' + continueOnError: true + + - task: securedevelopmentteam.vss-secure-development-tools.build-task-postanalysis.PostAnalysis@1 + displayName: 'Check for failures' + inputs: + CredScan: true + ToolLogsNotFoundAction: Error