.vsts-compliance.yml

# Copyright (C) Microsoft Corporation. All rights reserved.
# Licensed under the MIT license. See LICENSE.txt in the project root for license information.

trigger:
  batch: true
  branches:
    include:
    - main
  paths:
    exclude:
    - README.md
    
schedules:
- cron: "0 18 * * Mon"
  displayName: Monday 11am PDT (6pm UTC) build
  branches:
    include:
    - main
  always: true   

pr: none

variables:
  - group: vssetup-apiscan

resources:
  repositories:
  - repository: MicroBuildTemplate
    type: git
    name: 1ESPipelineTemplates/MicroBuildTemplate
    ref: refs/tags/release

extends:
  template: azure-pipelines/MicroBuild.1ES.Unofficial.yml@MicroBuildTemplate
  parameters:
    pool:
      name: VSEngSS-MicroBuild2022-1ES
    sdl:
      sourceAnalysisPool:
        name: AzurePipelines-EO
        image: 1ESPT-Windows2022
      antimalwareScan:
        enabled: true
      armory:
        enabled: true
      binskim:
        enabled: true
        scanOutputDirectoryOnly: true
      codeql:
        compiled:
          enabled: true
      credscan:
        enabled: true
      policheck:
        enabled: true
      psscriptanalyzer:
        enabled: true
      prefast:
        enabled: true
      tsa:
        enabled: true
        configFile: $(Build.SourcesDirectory)\.config\tsaoptions.json
        onboard: false

    stages:
      - stage: Compliance
        jobs:
          - job: Compliance
            steps:
              - template: /pipelines/templates/build.yml@self
                parameters:
                    BuildConfiguration: $(BuildConfiguration)
                    BuildPlatform: $(BuildPlatform)
                    Sign: false
                    PublishArtifactTemplate: /pipelines/templates/1es-publish-task.yml@self

              - task: CopyFiles@2
                displayName: Copy files for API scan
                inputs:
                  SourceFolder: $(Build.SourcesDirectory)\bin\$(BuildConfiguration)
                  Contents: |
                    **\*.?(exe|dll|pdb|xml)
                    !**\*.test.?(exe|dll|pdb|xml)
                  TargetFolder: $(Build.StagingDirectory)\apiscan-inputs

              - task: APIScan@2
                displayName: Run APIScan
                inputs:
                  softwareFolder: $(Build.StagingDirectory)\apiscan-inputs
                  softwareName: 'Microsoft.VSWhere'
                  softwareVersionNum: '3'
                  toolVersion: Latest
                env:
                  AzureServicesAuthConnectionString: runAs=App;AppId=$(ApiScanClientId)

              - task: PublishSecurityAnalysisLogs@3
                displayName: Publish 'SDLAnalysis-APIScan' artifact
                condition: succeededOrFailed()
                inputs:
                  ArtifactName: SDLAnalysis-APIScan
                  AllTools: false
                  APIScan: true

              - task: PostAnalysis@2
                displayName: Post Analysis
                inputs:
                  GdnBreakAllTools: false
                  GdnBreakGdnToolApiScan: true
                
              - task: TSAUpload@2
                displayName: Upload APIScan results to TSA
                inputs:
                  GdnPublishTsaOnboard: false
                  GdnPublishTsaConfigFile: '$(Build.SourcesDirectory)\.config\tsaoptions.json'
                  GdnPublishTsaExportedResultsPublishable: true
                continueOnError: true
                condition: succeededOrFailed()
                enabled: true