compliance.yaml

resources:
  repositories:
  - repository: self
    checkoutOptions:
      submodules: false

pr: none
trigger: none

jobs:
- job: Build
  pool:
    vmImage: 'macos-latest'

  variables:
  - name: Codeql.Enabled
    value: true
  - name: Codeql.TSAEnabled
    value: true
  - name: Codeql.TSAOptionsPath
    value: '$(Build.SourcesDirectory)/.config/tsaoptions.json'

  steps:

  - task: CodeQL3000Init@0

  - task: DotNetCoreCLI@2
    displayName: Build and Package
    inputs:
      command: build
      arguments: '-c Release'

  - task: CodeQL3000Finalize@0


- job: Analysis_Job
  displayName: Analysis
  pool: VSEngStaticAnalysis-Test
  timeoutInMinutes: 300

  variables:
  - name: DOTNET_ROOT
    value: /root/.dotnet

  steps:

  - task: NodeTool@0
    displayName: 'Use Node 6.x'

  - task: PowerShell@2
    displayName: Checkout Submodules
    inputs:
      targetType: 'inline'
      script: |
        # Enlist into all of the submodules
        git submodule update --init --recursive
    env:
      SYSTEM_ACCESSTOKEN: $(System.AccessToken)

  - task: CredScan@3
    displayName: Run CredScan
    continueOnError: false
    inputs:
      outputFormat: pre

  - task: PoliCheck@2
    inputs:
      inputType: 'Basic'
      targetType: 'F'
      targetArgument: '$(Build.SourcesDirectory)'
      result: 'PoliCheck.xml'

  - task: SdtReport@2
    displayName: 'Create security analysis report'
    inputs:
      GdnExportAllTools: false
      GdnExportGdnToolCredScan: true
      GdnExportGdnToolPoliCheck: true

  - task: TSAUpload@2
    displayName: Upload Results to TSA
    inputs:
      GdnPublishTsaOnboard: true
      GdnPublishTsaConfigFile: '$(Build.SourcesDirectory)/.config/tsaoptions.json'

  - task: PostAnalysis@2
    displayName: Run Security Post Analysis
    inputs:
      GdnBreakAllTools: true
    continueOnError: true
    condition: succeededOrFailed()

  - task: PublishSecurityAnalysisLogs@3
    displayName: Publish Code Analysis Logs
    inputs:
      ArtifactName: CodeAnalysisLogs
      ArtifactType: Container
      PublishProcessedResults: true
      AllTools: true
      ToolLogsNotFoundAction: Standard