[ci] Migrate to the 1ES template (#8747)

Context: https://aka.ms/1espt The build pipeline has been updated to extend the 1ES pipeline template, which will keep the pipeline up to date with the latest compliance and security requirements. Most compliance tasks and scans will now run automatically as part of artifact upload steps. API Scan and policheck scans against multiple languages are not supported and will continue to run separately.
dotnet · Mar 4, 2024 · a1c5111 · a1c5111
1 parent 5205a5f
commit a1c5111
Show file tree

Hide file tree

Showing 35 changed files with 1,104 additions and 1,487 deletions.
diff --git a/.gdn/.gdnsettings b/.gdn/.gdnsettings
@@ -0,0 +1,7 @@
+{
+  "files": { },
+  "folders": { },
+  "overwriteLogs": true,
+  "telemetryFlushTimeout": 10,
+  "variables": { }
+}
diff --git a/.gdn/.gdnsuppress b/.gdn/.gdnsuppress
@@ -0,0 +1,62 @@
+{
+  "hydrated": false,
+  "properties": {
+    "helpUri": "https://eng.ms/docs/microsoft-security/security/azure-security/cloudai-security-fundamentals-engineering/security-integration/guardian-wiki/microsoft-guardian/general/suppressions",
+    "hydrationStatus": "This file does not contain identifying data. It is safe to check into your repo. To hydrate this file with identifying data, run `guardian hydrate --help` and follow the guidance."
+  },
+  "version": "1.0.0",
+  "suppressionSets": {
+    "default": {
+      "name": "default",
+      "createdDate": "2024-02-21 20:58:02Z",
+      "lastUpdatedDate": "2024-02-22 21:40:38Z"
+    }
+  },
+  "results": {
+    "28e1a7a1157c8739dce8ac1bbd828a471e477444ec50d2656d0440948b58a274": {
+      "signature": "28e1a7a1157c8739dce8ac1bbd828a471e477444ec50d2656d0440948b58a274",
+      "alternativeSignatures": [],
+      "memberOf": [
+        "default"
+      ],
+      "justification": "FillEventHistory+Event API documentation with generic example password.",
+      "createdDate": "2024-02-21 20:58:02Z"
+    },
+    "0b7cc0b28f27b0eeb2a415f10e62c32675dd2d4edcffe35600eae35f8064004e": {
+      "signature": "0b7cc0b28f27b0eeb2a415f10e62c32675dd2d4edcffe35600eae35f8064004e",
+      "alternativeSignatures": [],
+      "memberOf": [
+        "default"
+      ],
+      "justification": "Android.Service.Autofill.FillEventHistory+Event API documentation with generic example password.",
+      "createdDate": "2024-02-21 20:58:02Z"
+    },
+    "e57727a14a28f6fd8f4aa87cd3c4b33401dfea1078ce32fb3cbdf342e8adf63d": {
+      "signature": "e57727a14a28f6fd8f4aa87cd3c4b33401dfea1078ce32fb3cbdf342e8adf63d",
+      "alternativeSignatures": [],
+      "memberOf": [
+        "default"
+      ],
+      "justification": "Javax.Crypto.ISecretKey API documentation with generic example password.",
+      "createdDate": "2024-02-21 20:58:02Z"
+    },
+    "15c51590a2e2bb503a7277448e05357f5fd8d4cb2f9b9b7446e41c872cceaac4": {
+      "signature": "15c51590a2e2bb503a7277448e05357f5fd8d4cb2f9b9b7446e41c872cceaac4",
+      "alternativeSignatures": [],
+      "memberOf": [
+        "default"
+      ],
+      "justification": "Javax.Security.Auth.Callback.PasswordCallback API documentation with generic example password.",
+      "createdDate": "2024-02-21 20:58:02Z"
+    },
+    "1ccf925aa704efd1035bac38e94d2e629fb5b0d1784d5473e4a52e6d13db16ee": {
+      "signature": "1ccf925aa704efd1035bac38e94d2e629fb5b0d1784d5473e4a52e6d13db16ee",
+      "alternativeSignatures": [],
+      "memberOf": [
+        "default"
+      ],
+      "justification": "Dummy test.keystore file used for testing.",
+      "createdDate": "2024-02-21 20:58:02Z"
+    }
+  }
+}
diff --git a/.gdn/.gitignore b/.gdn/.gitignore
@@ -0,0 +1,11 @@
+## Ignore Guardian internal files
+.r/
+rc/
+rs/
+i/
+p/
+c/
+o/
+
+## Ignore Guardian Local settings
+LocalSettings.gdn.json
diff --git a/.gdn/policheck/CHT.gdnsuppress b/.gdn/policheck/CHT.gdnsuppress
@@ -0,0 +1,26 @@
+{
+ "hydrated": false,
+  "properties": {
+    "helpUri": "https://eng.ms/docs/microsoft-security/security/azure-security/cloudai-security-fundamentals-engineering/security-integration/guardian-wiki/microsoft-guardian/general/suppressions",
+    "hydrationStatus": "This file does not contain identifying data. It is safe to check into your repo. To hydrate this file with identifying data, run `guardian hydrate --help` and follow the guidance."
+  },
+  "version": "1.0.0",
+  "suppressionSets": {
+    "default": {
+      "name": "default",
+      "createdDate": "2023-02-24 00:05:39Z",
+      "lastUpdatedDate": "2024-02-22 21:40:38Z"
+    }
+  },
+  "results": {
+    "04910d714a13bf4523ffa77350f654f52114fa4fa3d760c9f63186d41716c019": {
+      "signature": "04910d714a13bf4523ffa77350f654f52114fa4fa3d760c9f63186d41716c019",
+      "alternativeSignatures": [],
+      "memberOf": [
+        "default"
+      ],
+      "justification": "Reference to the Android package format APK.",
+      "createdDate": "2023-02-24 00:05:39Z"
+    }
+  }
+}
diff --git a/...omation/guardian/PoliCheck.Exclusions.xml → .gdn/policheck/PoliCheck.Exclusions.xml b/...omation/guardian/PoliCheck.Exclusions.xml → .gdn/policheck/PoliCheck.Exclusions.xml
diff --git a/.gdn/policheck/source.gdnsuppress b/.gdn/policheck/source.gdnsuppress
@@ -0,0 +1,171 @@
+{
+  "hydrated": false,
+  "properties": {
+    "helpUri": "https://eng.ms/docs/microsoft-security/security/azure-security/cloudai-security-fundamentals-engineering/security-integration/guardian-wiki/microsoft-guardian/general/suppressions",
+    "hydrationStatus": "This file does not contain identifying data. It is safe to check into your repo. To hydrate this file with identifying data, run `guardian hydrate --help` and follow the guidance."
+  },
+  "version": "1.0.0",
+  "suppressionSets": {
+    "default": {
+      "name": "default",
+      "createdDate": "2023-02-22 23:55:29Z",
+      "lastUpdatedDate": "2024-02-22 21:40:38Z"
+    }
+  },
+  "results": {
+    "6789cab1bdc97b0cc3ad057b7fdd21d63cdf8bc2679391923803fa240ef81292": {
+      "signature": "6789cab1bdc97b0cc3ad057b7fdd21d63cdf8bc2679391923803fa240ef81292",
+      "alternativeSignatures": [
+        "b5041e3ec6776af49d6d69148e4db480f366b559299d19ec8ea3e095295b39a8"
+      ],
+      "memberOf": [
+        "default"
+      ],
+      "justification": "Reference to an ISCII term.",
+      "createdDate": "2023-02-22 23:55:29Z"
+    },
+    "bbaf5f946cb72748567e41f0df5f1bae05550f4ba7381e21ec6b26d6c3ecec9f": {
+      "signature": "bbaf5f946cb72748567e41f0df5f1bae05550f4ba7381e21ec6b26d6c3ecec9f",
+      "alternativeSignatures": [
+        "739cb5e6ee2409515900652ca668f819f697f23834becece8d2f9f9236723c1b"
+      ],
+      "memberOf": [
+        "default"
+      ],
+      "justification": "Reference to an ISCII term.",
+      "createdDate": "2023-02-22 23:55:29Z"
+    },
+    "db8916a0f0cdca4082c540921dd362e09a9ff413862ab826308411b76ee35789": {
+      "signature": "db8916a0f0cdca4082c540921dd362e09a9ff413862ab826308411b76ee35789",
+      "alternativeSignatures": [
+        "a755747462567003e5aa2b7bf01aa72af5143714e427ad043747b1fb54b1c440"
+      ],
+      "memberOf": [
+        "default"
+      ],
+      "justification": "Reference to an Android logging function.",
+      "createdDate": "2023-02-22 23:55:29Z"
+    },
+    "6d1fb3a483eb491710d6a09ed0b4bab47f13942d0c6fc744e6683614a66604ab": {
+      "signature": "6d1fb3a483eb491710d6a09ed0b4bab47f13942d0c6fc744e6683614a66604ab",
+      "alternativeSignatures": [
+        "a755747462567003e5aa2b7bf01aa72af5143714e427ad043747b1fb54b1c440"
+      ],
+      "memberOf": [
+        "default"
+      ],
+      "justification": "Reference to an Android logging function.",
+      "createdDate": "2023-02-22 23:55:29Z"
+    },
+    "b07e75fc8a506b94690dbd06877da06c1228e40e7deda3967f6b882b842f726d": {
+      "signature": "b07e75fc8a506b94690dbd06877da06c1228e40e7deda3967f6b882b842f726d",
+      "alternativeSignatures": [
+        "a755747462567003e5aa2b7bf01aa72af5143714e427ad043747b1fb54b1c440"
+      ],
+      "memberOf": [
+        "default"
+      ],
+      "justification": "Reference to an Android logging function.",
+      "createdDate": "2023-02-22 23:55:29Z"
+    },
+    "87d8313310c2dd42021844b95bdcb9121bf10036fea5b212b945e0732a456e5a": {
+      "signature": "87d8313310c2dd42021844b95bdcb9121bf10036fea5b212b945e0732a456e5a",
+      "alternativeSignatures": [
+        "a755747462567003e5aa2b7bf01aa72af5143714e427ad043747b1fb54b1c440"
+      ],
+      "memberOf": [
+        "default"
+      ],
+      "justification": "Reference to an Android logging function.",
+      "createdDate": "2023-02-22 23:55:29Z"
+    },
+    "8e5400e0233c8d887ad48bd8a48e8a7be5a579f9eefad521419b6df0828bbfac": {
+      "signature": "8e5400e0233c8d887ad48bd8a48e8a7be5a579f9eefad521419b6df0828bbfac",
+      "alternativeSignatures": [
+        "a755747462567003e5aa2b7bf01aa72af5143714e427ad043747b1fb54b1c440"
+      ],
+      "memberOf": [
+        "default"
+      ],
+      "justification": "Reference to an Android logging function.",
+      "createdDate": "2023-02-22 23:55:29Z"
+    },
+    "1b38e026fae90da4ae2fe9151c9c1ebd73c8b3c2c5f072ceae390a3ceec2fb97": {
+      "signature": "1b38e026fae90da4ae2fe9151c9c1ebd73c8b3c2c5f072ceae390a3ceec2fb97",
+      "alternativeSignatures": [
+        "a755747462567003e5aa2b7bf01aa72af5143714e427ad043747b1fb54b1c440"
+      ],
+      "memberOf": [
+        "default"
+      ],
+      "justification": "Reference to an Android logging function.",
+      "createdDate": "2023-02-22 23:55:29Z"
+    },
+    "a2b4d032c59a9d1211d218c3cd550cf8febb369941d70284d07d03ebee855bc0": {
+      "signature": "a2b4d032c59a9d1211d218c3cd550cf8febb369941d70284d07d03ebee855bc0",
+      "alternativeSignatures": [
+        "9feaec8a73b72e0d212c0e18d863e4fe16ff010c5d33cf8d47d8b0f465cc4c5e"
+      ],
+      "memberOf": [
+        "default"
+      ],
+      "justification": "Reference to find first set bit function.",
+      "createdDate": "2023-02-22 23:55:29Z"
+    },
+    "1c87b45a6044d205dc3f3562f349c238f7cabe22b4609da762df9dc44151e9fb": {
+      "signature": "1c87b45a6044d205dc3f3562f349c238f7cabe22b4609da762df9dc44151e9fb",
+      "alternativeSignatures": [
+        "9feaec8a73b72e0d212c0e18d863e4fe16ff010c5d33cf8d47d8b0f465cc4c5e"
+      ],
+      "memberOf": [
+        "default"
+      ],
+      "justification": "Reference to find first set bit function.",
+      "createdDate": "2023-02-22 23:55:29Z"
+    },
+    "a6639098c4785509a4215c9e2fc10f82c06fce461915dc11a00227ddec558845": {
+      "signature": "a6639098c4785509a4215c9e2fc10f82c06fce461915dc11a00227ddec558845",
+      "alternativeSignatures": [
+        "9feaec8a73b72e0d212c0e18d863e4fe16ff010c5d33cf8d47d8b0f465cc4c5e"
+      ],
+      "memberOf": [
+        "default"
+      ],
+      "justification": "Reference to find first set bit function.",
+      "createdDate": "2023-02-22 23:55:29Z"
+    },
+    "f94ede7b396cb54934db2084f0879cd31a17ce2584eb01e0bfcd35324a724c31": {
+      "signature": "f94ede7b396cb54934db2084f0879cd31a17ce2584eb01e0bfcd35324a724c31",
+      "alternativeSignatures": [
+        "9feaec8a73b72e0d212c0e18d863e4fe16ff010c5d33cf8d47d8b0f465cc4c5e"
+      ],
+      "memberOf": [
+        "default"
+      ],
+      "justification": "Reference to find first set bit function.",
+      "createdDate": "2024-02-22 21:40:38Z"
+    },
+    "b34b42aa41018376a31460c142f2ae910704725d9e9a4470f92b587df682369b": {
+      "signature": "b34b42aa41018376a31460c142f2ae910704725d9e9a4470f92b587df682369b",
+      "alternativeSignatures": [
+        "3901d031f3ac168bb1a84d06bb234355af514c59a0ed9da325b11a8861ff0b05"
+      ],
+      "memberOf": [
+        "default"
+      ],
+      "justification": "Reference to output from an external tool.",
+      "createdDate": "2023-02-22 23:55:29Z"
+    },
+    "243e199c7aec22377e0363bdca82384278cc36b0674f35697935fde6c45cfd0e": {
+      "signature": "243e199c7aec22377e0363bdca82384278cc36b0674f35697935fde6c45cfd0e",
+      "alternativeSignatures": [
+        "cf02f44873b25336e01a1fa294bd858d2ea69ae734f08c6db40d4b83d17ccf76"
+      ],
+      "memberOf": [
+        "default"
+      ],
+      "justification": "Reference to a proper name.",
+      "createdDate": "2023-10-26 21:20:54Z"
+    }
+  }
+}
diff --git a/...ls/automation/guardian/tsaoptions-v2.json → .gdn/tsaoptions-v2.json b/...ls/automation/guardian/tsaoptions-v2.json → .gdn/tsaoptions-v2.json