Enable BinSkim scan in nightly validation

[MilenaHristova]

Enabling BinSkim scan over build artifacts in Validate-DotNet pipeline and the .NET staging pipeline based on company requirements.

We are required to run SDL tools on official builds and implement automated bug filling for the tools output. Currently we are running SDL checks over the source code in the nightly builds and in the .NET staging pipeline, but to be compliant we need to also run BinSkim over the produced artifacts.

This PRs is enabling BinSkim checks in the nightly run of Validate-DotNet pipeline.

More information is in the Automate BinSkim runs over official builds issue

Microsoft Reviewers: Open in CodeFlow

[pgrawehr]

Do you have an example of how the result looks like? I'm just curious about what this new test does.

[MilenaHristova]

Do you have an example of how the result looks like? I'm just curious about what this new test does.

This is an example work item that got created for windowsdesktop
https://devdiv.visualstudio.com/DevDiv/_workitems/edit/1848201/ (that's just a missing pdb file)
this too: https://devdiv.visualstudio.com/DevDiv/_workitems/edit/1850145/

[krwq]

@MilenaHristova non Microsoft employees don't have access to these issues and that's large part of our maintainers. Are results of this going to be publicly visible? If this is MS specific policy can this be added outside of the repo?

[MilenaHristova]

@MilenaHristova non Microsoft employees don't have access to these issues and that's large part of our maintainers. Are results of this going to be publicly visible? If this is MS specific policy can this be added outside of the repo?

I am not aware of an other way to add this, bugs are filed automatically by the SDL tool. On the other hand, I couldn't find any validation runs for his repo, @mmitche do we need to run SDL on dotnet/iot ?

[mmitche]

@MilenaHristova Nope. This is a .NET Foundation project.

[MilenaHristova]

@MilenaHristova Nope. This is a .NET Foundation project.

ok, thanks. I'll remove it from the list and close this.