From 3b62a1856d24de39dfc53049a65d4823c1488772 Mon Sep 17 00:00:00 2001 From: "Tian L." <60599517+tian-lt@users.noreply.github.com> Date: Thu, 3 Jul 2025 10:31:27 +0800 Subject: [PATCH] replace the manual prefast with policheck (#2350) --- .config/tvs.ruleset | 310 ------------------ build/config/PoliCheckExclusions.xml | 5 + .../azure-pipelines.ci-internal.yaml | 4 + build/pipelines/azure-pipelines.ci.yaml | 77 ----- build/pipelines/azure-pipelines.release.yaml | 5 +- .../templates/build-single-architecture.yaml | 3 - .../templates/run-compliance-checks.yaml | 47 --- 7 files changed, 12 insertions(+), 439 deletions(-) delete mode 100644 .config/tvs.ruleset create mode 100644 build/config/PoliCheckExclusions.xml delete mode 100644 build/pipelines/azure-pipelines.ci.yaml delete mode 100644 build/pipelines/templates/run-compliance-checks.yaml diff --git a/.config/tvs.ruleset b/.config/tvs.ruleset deleted file mode 100644 index 33575dc2..00000000 --- a/.config/tvs.ruleset +++ /dev/null @@ -1,310 +0,0 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - diff --git a/build/config/PoliCheckExclusions.xml b/build/config/PoliCheckExclusions.xml new file mode 100644 index 00000000..c2b0894f --- /dev/null +++ b/build/config/PoliCheckExclusions.xml @@ -0,0 +1,5 @@ + + + + AF-ZA|AM-ET|AR-SA|AS-IN|AZ-LATN-AZ|BG-BG|BN-IN|BS-LATN-BA|CA-ES|CA-ES-VALENCIA|CS-CZ|CY-GB|DA-DK|DE-DE|EL-GR|EN-GB|ES-ES|ES-MX|ET-EE|EU-ES|FA-IR|FI-FI|FIL-PH|FR-CA|FR-FR|GA-IE|GD-GB|GL-ES|GU-IN|HE-IL|HI-IN|HR-HR|HU-HU|HY-AM|ID-ID|IS-IS|IT-IT|JA-JP|KA-GE|KK-KZ|KM-KH|KN-IN|KO-KR|KOK-IN|LB-LU|LO-LA|LT-LT|LV-LV|MI-NZ|MK-MK|ML-IN|MR-IN|MS-MY|MT-MT|NB-NO|NE-NP|NL-NL|NN-NO|OR-IN|PA-IN|PL-PL|PT-BR|PT-PT|QUZ-PE|RO-RO|RU-RU|SK-SK|SL-SI|SQ-AL|SR-CYRL-BA|SR-CYRL-RS|SR-LATN-RS|SV-SE|TA-IN|TE-IN|TH-TH|TR-TR|TT-RU|UG-CN|UK-UA|UR-PK|UZ-LATN-UZ|VI-VN|ZH-CN|ZH-TW + diff --git a/build/pipelines/azure-pipelines.ci-internal.yaml b/build/pipelines/azure-pipelines.ci-internal.yaml index 049ea488..e832e708 100644 --- a/build/pipelines/azure-pipelines.ci-internal.yaml +++ b/build/pipelines/azure-pipelines.ci-internal.yaml @@ -26,6 +26,10 @@ extends: name: EssentialExperiences-windows-2022 image: MMSWindows2022-Secure os: windows + sdl: + policheck: + enabled: true + exclusionsFile: '$(Build.SourcesDirectory)\build\config\PoliCheckExclusions.xml' stages: - stage: diff --git a/build/pipelines/azure-pipelines.ci.yaml b/build/pipelines/azure-pipelines.ci.yaml deleted file mode 100644 index 542ab397..00000000 --- a/build/pipelines/azure-pipelines.ci.yaml +++ /dev/null @@ -1,77 +0,0 @@ -# -# Continuous Integration (CI) -# This pipeline builds and validate the app for all supported architectures, in a public -# configuration. If the build was queued to validate a pull request, we build and test only x64. -# - -trigger: -- main -- release/* -- feature/* -pr: -- main -- release/* -- feature/* - -name: 0.$(Date:yyMM).$(DayOfMonth)$(Rev:rr).0 - -resources: - repositories: - - repository: 1esPipelines - type: git - name: 1ESPipelineTemplates/1ESPipelineTemplates - ref: refs/tags/release - -extends: - template: v1/1ES.Unofficial.PipelineTemplate.yml@1esPipelines - parameters: - pool: - name: EssentialExperiencesOpenSource-windows-2022 - image: MMSWindows2022-Secure - os: windows - - sdl: - binskim: - enabled: false - - stages: - - stage: Calculator - jobs: - - template: /build/pipelines/templates/build-single-architecture.yaml@self - parameters: - platform: x64 - isOSSBuild: true - - - template: /build/pipelines/templates/build-single-architecture.yaml@self - parameters: - platform: x86 - condition: not(eq(variables['Build.Reason'], 'PullRequest')) - isOSSBuild: true - - - template: /build/pipelines/templates/build-single-architecture.yaml@self - parameters: - platform: ARM - condition: not(eq(variables['Build.Reason'], 'PullRequest')) - isOSSBuild: true - - - template: /build/pipelines/templates/build-single-architecture.yaml@self - parameters: - platform: ARM64 - condition: not(eq(variables['Build.Reason'], 'PullRequest')) - isOSSBuild: true - - - template: /build/pipelines/templates/run-ui-tests.yaml@self - parameters: - platform: x64 - isOSSBuild: true - runsettingsFileName: CalculatorUITests.ci.runsettings - - - template: /build/pipelines/templates/run-unit-tests.yaml@self - parameters: - platform: x64 - - - template: /build/pipelines/templates/run-unit-tests.yaml@self - parameters: - platform: x86 - - - template: /build/pipelines/templates/package-msixbundle.yaml@self diff --git a/build/pipelines/azure-pipelines.release.yaml b/build/pipelines/azure-pipelines.release.yaml index fb9607a6..7abbfbbd 100644 --- a/build/pipelines/azure-pipelines.release.yaml +++ b/build/pipelines/azure-pipelines.release.yaml @@ -58,6 +58,9 @@ extends: allTools: true codeql: tsaEnabled: true + policheck: + enabled: true + exclusionsFile: '$(Build.SourcesDirectory)\build\config\PoliCheckExclusions.xml' stages: - stage: Calculator @@ -89,8 +92,6 @@ extends: useReleaseAppxmanifest: true condition: not(eq(variables['Build.Reason'], 'PullRequest')) - - template: /build/pipelines/templates/run-compliance-checks.yaml@self - - template: /build/pipelines/templates/run-ui-tests.yaml@self parameters: platform: x64 diff --git a/build/pipelines/templates/build-single-architecture.yaml b/build/pipelines/templates/build-single-architecture.yaml index 8b2b55f4..f63a4864 100644 --- a/build/pipelines/templates/build-single-architecture.yaml +++ b/build/pipelines/templates/build-single-architecture.yaml @@ -32,9 +32,6 @@ jobs: sdl: binskim: analyzeTargetGlob: +:f|$(Agent.BuildDirectory)\binskim\**\* - prefast: - enable: true - outputs: - output: pipelineArtifact displayName: Publish drop artifact diff --git a/build/pipelines/templates/run-compliance-checks.yaml b/build/pipelines/templates/run-compliance-checks.yaml deleted file mode 100644 index ba301af5..00000000 --- a/build/pipelines/templates/run-compliance-checks.yaml +++ /dev/null @@ -1,47 +0,0 @@ -jobs: -- job: ComplianceChecks - displayName: Run compliance checks - timeoutInMinutes: 60 - pool: - name: EssentialExperiences-windows-2022 - steps: - - checkout: self - - - task: UniversalPackages@0 - displayName: Download internals package - inputs: - command: download - downloadDirectory: $(Build.SourcesDirectory) - vstsFeed: WindowsInboxApps - vstsFeedPackage: calculator-internals - vstsPackageVersion: 0.0.117 - - - task: NuGetToolInstaller@0 - displayName: Use NuGet 6.x - inputs: - versionSpec: 6.x - - - task: NuGetCommand@2 - displayName: NuGet restore src/Calculator.sln - inputs: - command: custom - arguments: restore src/Calculator.sln -Verbosity Detailed -NonInteractive - - - task: PowerShell@2 - displayName: Set version number in AppxManifest - inputs: - filePath: $(Build.SourcesDirectory)\build\scripts\UpdateAppxManifestVersion.ps1 - arguments: '-AppxManifest $(Build.SourcesDirectory)\src\Calculator\Package.appxmanifest -Version $(Build.BuildNumber)' - - - task: securedevelopmentteam.vss-secure-development-tools.build-task-prefast.SDLNativeRules@3 - displayName: 'Run the PREfast SDL Native Rules' - inputs: - userProvideBuildInfo: msBuildInfo - setupCommandlines: '"%ProgramFiles%\Microsoft Visual Studio\2022\Enterprise\Common7\Tools\VsMSBuildCmd.bat"' - msBuildArchitecture: 'amd64' - msBuildCommandline: 'msbuild.exe $(Build.SourcesDirectory)\src\Calculator.sln /p:AppVersion=$(Build.BuildNumber) /p:OutDir=$(Build.BinariesDirectory)\ /p:Configuration=Release /p:Platform=x64 /m /p:IsStoreBuild=true' - rulesetName: Custom - customRuleset: $(Build.SourcesDirectory)\.config\tvs.ruleset - - - task: securedevelopmentteam.vss-secure-development-tools.build-task-publishsecurityanalysislogs.PublishSecurityAnalysisLogs@3 - displayName: 'Publish Guardian Artifacts'