.vsts-compliance.yml

# Copyright (C) Microsoft Corporation. All rights reserved.
# Licensed under the MIT license. See LICENSE.txt in the project root for license information.

variables:
- group: vssetup-apiscan

resources:
  repositories:
    - repository: MicroBuildTemplate
      type: git
      name: 1ESPipelineTemplates/MicroBuildTemplate
      ref: refs/tags/release

extends:
  template: azure-pipelines/MicroBuild.1ES.Unofficial.yml@MicroBuildTemplate
  parameters:
    pool:
      name: VSEngSS-MicroBuild2022-1ES
    sdl:
      sourceAnalysisPool:
        name: AzurePipelines-EO
        image: 1ESPT-Windows2022
      antimalwareScan:
        enabled: true
      armory:
        enabled: true
      binskim:
        enabled: true
        scanOutputDirectoryOnly: true
      codeql:
        compiled:
          enabled: true
      credscan:
        enabled: true
      policheck:
        enabled: true
      psscriptanalyzer:
        enabled: true
      prefast:
        enabled: true
      tsa:
        enabled: true
        configFile: $(Build.SourcesDirectory)\.config\tsaoptions.json
        onboard: false # We already onboarded

    stages:
      - stage: Compliance
        jobs:
          - job: Compliance
            steps:
              - template: /build/templates/build.yml@self
                parameters:
                  BuildConfiguration: $(BuildConfiguration)
                  BuildPlatform: $(BuildPlatform)
                  PublishArtifactTemplate: /build/templates/1es-publish-task.yml@self

              - task: CopyFiles@2
                displayName: Copy files for API scan
                inputs:
                  SourceFolder: $(Build.SourcesDirectory)\bin\$(BuildConfiguration)
                  Contents: |
                    **\*.?(pdb|exe|dll|xml)
                    !**\*.Test.*
                  TargetFolder: $(Build.StagingDirectory)\apiscan-inputs

              - task: APIScan@2
                displayName: Run APIScan
                inputs:
                  softwareFolder: $(Build.StagingDirectory)\apiscan-inputs
                  softwareName: 'Microsoft.VsixBootstrapper'
                  softwareVersionNum: '2' # Must match the version of ApiScan tooling
                  toolVersion: Latest
                env:
                  AzureServicesAuthConnectionString: runAs=App;AppId=$(ApiScanClientId)

              - task: PublishSecurityAnalysisLogs@3
                displayName: Publish 'SDLAnalysis-APIScan' artifact
                condition: succeededOrFailed()
                inputs:
                  ArtifactName: SDLAnalysis-APIScan
                  AllTools: false
                  APIScan: true

              - task: PostAnalysis@2
                displayName: Post Analysis
                inputs:
                  GdnBreakAllTools: false
                  GdnBreakGdnToolApiScan: true
                
              - task: TSAUpload@2
                displayName: Upload APIScan results to TSA
                inputs:
                  GdnPublishTsaOnboard: false
                  GdnPublishTsaConfigFile: '$(Build.SourcesDirectory)\.config\tsaoptions.json'
                  GdnPublishTsaExportedResultsPublishable: true
                continueOnError: true
                condition: succeededOrFailed()
                enabled: true