From 3b62a1856d24de39dfc53049a65d4823c1488772 Mon Sep 17 00:00:00 2001
From: "Tian L." <60599517+tian-lt@users.noreply.github.com>
Date: Thu, 3 Jul 2025 10:31:27 +0800
Subject: [PATCH] replace the manual prefast with policheck (#2350)
---
.config/tvs.ruleset | 310 ------------------
build/config/PoliCheckExclusions.xml | 5 +
.../azure-pipelines.ci-internal.yaml | 4 +
build/pipelines/azure-pipelines.ci.yaml | 77 -----
build/pipelines/azure-pipelines.release.yaml | 5 +-
.../templates/build-single-architecture.yaml | 3 -
.../templates/run-compliance-checks.yaml | 47 ---
7 files changed, 12 insertions(+), 439 deletions(-)
delete mode 100644 .config/tvs.ruleset
create mode 100644 build/config/PoliCheckExclusions.xml
delete mode 100644 build/pipelines/azure-pipelines.ci.yaml
delete mode 100644 build/pipelines/templates/run-compliance-checks.yaml
diff --git a/.config/tvs.ruleset b/.config/tvs.ruleset
deleted file mode 100644
index 33575dc2..00000000
--- a/.config/tvs.ruleset
+++ /dev/null
@@ -1,310 +0,0 @@
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
-
diff --git a/build/config/PoliCheckExclusions.xml b/build/config/PoliCheckExclusions.xml
new file mode 100644
index 00000000..c2b0894f
--- /dev/null
+++ b/build/config/PoliCheckExclusions.xml
@@ -0,0 +1,5 @@
+
+
+
+ AF-ZA|AM-ET|AR-SA|AS-IN|AZ-LATN-AZ|BG-BG|BN-IN|BS-LATN-BA|CA-ES|CA-ES-VALENCIA|CS-CZ|CY-GB|DA-DK|DE-DE|EL-GR|EN-GB|ES-ES|ES-MX|ET-EE|EU-ES|FA-IR|FI-FI|FIL-PH|FR-CA|FR-FR|GA-IE|GD-GB|GL-ES|GU-IN|HE-IL|HI-IN|HR-HR|HU-HU|HY-AM|ID-ID|IS-IS|IT-IT|JA-JP|KA-GE|KK-KZ|KM-KH|KN-IN|KO-KR|KOK-IN|LB-LU|LO-LA|LT-LT|LV-LV|MI-NZ|MK-MK|ML-IN|MR-IN|MS-MY|MT-MT|NB-NO|NE-NP|NL-NL|NN-NO|OR-IN|PA-IN|PL-PL|PT-BR|PT-PT|QUZ-PE|RO-RO|RU-RU|SK-SK|SL-SI|SQ-AL|SR-CYRL-BA|SR-CYRL-RS|SR-LATN-RS|SV-SE|TA-IN|TE-IN|TH-TH|TR-TR|TT-RU|UG-CN|UK-UA|UR-PK|UZ-LATN-UZ|VI-VN|ZH-CN|ZH-TW
+
diff --git a/build/pipelines/azure-pipelines.ci-internal.yaml b/build/pipelines/azure-pipelines.ci-internal.yaml
index 049ea488..e832e708 100644
--- a/build/pipelines/azure-pipelines.ci-internal.yaml
+++ b/build/pipelines/azure-pipelines.ci-internal.yaml
@@ -26,6 +26,10 @@ extends:
name: EssentialExperiences-windows-2022
image: MMSWindows2022-Secure
os: windows
+ sdl:
+ policheck:
+ enabled: true
+ exclusionsFile: '$(Build.SourcesDirectory)\build\config\PoliCheckExclusions.xml'
stages:
- stage:
diff --git a/build/pipelines/azure-pipelines.ci.yaml b/build/pipelines/azure-pipelines.ci.yaml
deleted file mode 100644
index 542ab397..00000000
--- a/build/pipelines/azure-pipelines.ci.yaml
+++ /dev/null
@@ -1,77 +0,0 @@
-#
-# Continuous Integration (CI)
-# This pipeline builds and validate the app for all supported architectures, in a public
-# configuration. If the build was queued to validate a pull request, we build and test only x64.
-#
-
-trigger:
-- main
-- release/*
-- feature/*
-pr:
-- main
-- release/*
-- feature/*
-
-name: 0.$(Date:yyMM).$(DayOfMonth)$(Rev:rr).0
-
-resources:
- repositories:
- - repository: 1esPipelines
- type: git
- name: 1ESPipelineTemplates/1ESPipelineTemplates
- ref: refs/tags/release
-
-extends:
- template: v1/1ES.Unofficial.PipelineTemplate.yml@1esPipelines
- parameters:
- pool:
- name: EssentialExperiencesOpenSource-windows-2022
- image: MMSWindows2022-Secure
- os: windows
-
- sdl:
- binskim:
- enabled: false
-
- stages:
- - stage: Calculator
- jobs:
- - template: /build/pipelines/templates/build-single-architecture.yaml@self
- parameters:
- platform: x64
- isOSSBuild: true
-
- - template: /build/pipelines/templates/build-single-architecture.yaml@self
- parameters:
- platform: x86
- condition: not(eq(variables['Build.Reason'], 'PullRequest'))
- isOSSBuild: true
-
- - template: /build/pipelines/templates/build-single-architecture.yaml@self
- parameters:
- platform: ARM
- condition: not(eq(variables['Build.Reason'], 'PullRequest'))
- isOSSBuild: true
-
- - template: /build/pipelines/templates/build-single-architecture.yaml@self
- parameters:
- platform: ARM64
- condition: not(eq(variables['Build.Reason'], 'PullRequest'))
- isOSSBuild: true
-
- - template: /build/pipelines/templates/run-ui-tests.yaml@self
- parameters:
- platform: x64
- isOSSBuild: true
- runsettingsFileName: CalculatorUITests.ci.runsettings
-
- - template: /build/pipelines/templates/run-unit-tests.yaml@self
- parameters:
- platform: x64
-
- - template: /build/pipelines/templates/run-unit-tests.yaml@self
- parameters:
- platform: x86
-
- - template: /build/pipelines/templates/package-msixbundle.yaml@self
diff --git a/build/pipelines/azure-pipelines.release.yaml b/build/pipelines/azure-pipelines.release.yaml
index fb9607a6..7abbfbbd 100644
--- a/build/pipelines/azure-pipelines.release.yaml
+++ b/build/pipelines/azure-pipelines.release.yaml
@@ -58,6 +58,9 @@ extends:
allTools: true
codeql:
tsaEnabled: true
+ policheck:
+ enabled: true
+ exclusionsFile: '$(Build.SourcesDirectory)\build\config\PoliCheckExclusions.xml'
stages:
- stage: Calculator
@@ -89,8 +92,6 @@ extends:
useReleaseAppxmanifest: true
condition: not(eq(variables['Build.Reason'], 'PullRequest'))
- - template: /build/pipelines/templates/run-compliance-checks.yaml@self
-
- template: /build/pipelines/templates/run-ui-tests.yaml@self
parameters:
platform: x64
diff --git a/build/pipelines/templates/build-single-architecture.yaml b/build/pipelines/templates/build-single-architecture.yaml
index 8b2b55f4..f63a4864 100644
--- a/build/pipelines/templates/build-single-architecture.yaml
+++ b/build/pipelines/templates/build-single-architecture.yaml
@@ -32,9 +32,6 @@ jobs:
sdl:
binskim:
analyzeTargetGlob: +:f|$(Agent.BuildDirectory)\binskim\**\*
- prefast:
- enable: true
-
outputs:
- output: pipelineArtifact
displayName: Publish drop artifact
diff --git a/build/pipelines/templates/run-compliance-checks.yaml b/build/pipelines/templates/run-compliance-checks.yaml
deleted file mode 100644
index ba301af5..00000000
--- a/build/pipelines/templates/run-compliance-checks.yaml
+++ /dev/null
@@ -1,47 +0,0 @@
-jobs:
-- job: ComplianceChecks
- displayName: Run compliance checks
- timeoutInMinutes: 60
- pool:
- name: EssentialExperiences-windows-2022
- steps:
- - checkout: self
-
- - task: UniversalPackages@0
- displayName: Download internals package
- inputs:
- command: download
- downloadDirectory: $(Build.SourcesDirectory)
- vstsFeed: WindowsInboxApps
- vstsFeedPackage: calculator-internals
- vstsPackageVersion: 0.0.117
-
- - task: NuGetToolInstaller@0
- displayName: Use NuGet 6.x
- inputs:
- versionSpec: 6.x
-
- - task: NuGetCommand@2
- displayName: NuGet restore src/Calculator.sln
- inputs:
- command: custom
- arguments: restore src/Calculator.sln -Verbosity Detailed -NonInteractive
-
- - task: PowerShell@2
- displayName: Set version number in AppxManifest
- inputs:
- filePath: $(Build.SourcesDirectory)\build\scripts\UpdateAppxManifestVersion.ps1
- arguments: '-AppxManifest $(Build.SourcesDirectory)\src\Calculator\Package.appxmanifest -Version $(Build.BuildNumber)'
-
- - task: securedevelopmentteam.vss-secure-development-tools.build-task-prefast.SDLNativeRules@3
- displayName: 'Run the PREfast SDL Native Rules'
- inputs:
- userProvideBuildInfo: msBuildInfo
- setupCommandlines: '"%ProgramFiles%\Microsoft Visual Studio\2022\Enterprise\Common7\Tools\VsMSBuildCmd.bat"'
- msBuildArchitecture: 'amd64'
- msBuildCommandline: 'msbuild.exe $(Build.SourcesDirectory)\src\Calculator.sln /p:AppVersion=$(Build.BuildNumber) /p:OutDir=$(Build.BinariesDirectory)\ /p:Configuration=Release /p:Platform=x64 /m /p:IsStoreBuild=true'
- rulesetName: Custom
- customRuleset: $(Build.SourcesDirectory)\.config\tvs.ruleset
-
- - task: securedevelopmentteam.vss-secure-development-tools.build-task-publishsecurityanalysislogs.PublishSecurityAnalysisLogs@3
- displayName: 'Publish Guardian Artifacts'