Update pipeline for compliance (#438)

microsoft · Sep 4, 2024 · 9e343dc · 9e343dc
1 parent 0fb5d23
commit 9e343dc
Showing 1 changed file with 20 additions and 0 deletions.
diff --git a/build/azure-pipelines.yml b/build/azure-pipelines.yml
@@ -38,6 +38,12 @@ extends:
     sdl:
       roslyn:
         enabled: true
+      binskim:
+        break: false
+        scanOutputDirectoryOnly: true
+      policheck:
+        break: false
+        severity: Note
       arrow:
         serviceConnection: DevHome Build VM Generation
       baseline:
@@ -145,6 +151,16 @@ extends:
                 filePath: 'build/scripts/Build.ps1'
                 arguments: -Platform "${{ platform }}" -Configuration "${{ configuration }}" -Version $(MSIXVersion) -BuildStep "msix" -AzureBuildingBranch "$(BuildingBranch)" -IsAzurePipelineBuild -ClientId $(GitHubClientId) -ClientSecret $(GitHubClientSecret)
 
+            - task: PowerShell@2
+              displayName: Copy Binaries for Artifact Publishing
+              inputs:
+                targetType: inline
+                script: >-
+                  New-Item -Path '$(Build.ArtifactStagingDirectory)\rawBinaries' -ItemType Directory
+                  
+                  Get-ChildItem -Path "$(Build.SourcesDirectory)\buildoutput\*" -Include *.dll,*.exe,*.pdb -Recurse | Copy-Item -Destination "$(Build.ArtifactStagingDirectory)\rawBinaries" -verbose
+                pwsh: true
+
             - template: ./build/templates/EsrpSigning-Steps.yml@self
               parameters:
                 displayName: Submit *.msix to ESRP for code signing
@@ -267,6 +283,10 @@ extends:
                 targetPath: $(appxPackageDir)\${{ configuration }}
                 sbomPackageName: devhomegithubextension.msixpackage
                 sbomPackageVersion: $(MSIXVersion)
+              - output: pipelineArtifact
+                displayName: 'Publish Binaries'
+                artifactName: binaries_${{ platform }}_${{ configuration }}
+                targetPath: $(Build.ArtifactStagingDirectory)\rawBinaries
 
     - stage: Build_MsixBundle
       dependsOn: Build_Msix