Enabling Code Sign Validation through 1ES template (#274)

* Enabling Code Sign Validation * Adding codesign parameters to 1ES template, removing call to MicroBuild task * Adding back explicit call to MicroBuildCodesignVerify@3 * Fixing CodeSign validation td1 parameter name * Adding codeSignValidationEnabled false to some outputs * Removing td1 parameter * Removed global enabled = true for codesign validation --------- Co-authored-by: Luke Westendorf <[email protected]>
xamarin · Oct 7, 2024 · 2b69c76 · 2b69c76
1 parent 70406fc
commit 2b69c76
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 0 deletions.
diff --git a/build/stages/build.yml b/build/stages/build.yml
@@ -20,24 +20,28 @@ stages:
         targetPath: '$(Build.SourcesDirectory)\src\Tests\bin\$(Configuration)'
         artifactName: unit-tests
         sbomEnabled: false
+        codeSignValidationEnabled: false
       - output: pipelineArtifact
         displayName: 'Publish Artifact: integration-tests'
         condition: always()
         targetPath: '$(Build.SourcesDirectory)\src\IntegrationTests\bin\$(Configuration)'
         artifactName: integration-tests
         sbomEnabled: false
+        codeSignValidationEnabled: false
       - output: pipelineArtifact
         displayName: 'Publish Artifact: logs'
         condition: always()
         targetPath: '$(Build.ArtifactStagingDirectory)\binlogs'
         artifactName: logs
         sbomEnabled: false
+        codeSignValidationEnabled: false
       - output: pipelineArtifact
         displayName: 'Publish Artifact: symbols'
         condition: always()
         targetPath: '$(Build.ArtifactStagingDirectory)/Symbols'
         artifactName: symbols
         sbomEnabled: false
+        codeSignValidationEnabled: false
     steps:
     - checkout: self
       clean: true

diff --git a/pipeline.yml b/pipeline.yml
@@ -36,6 +36,11 @@ extends:
       policheck:
         enabled: true
         exclusionsFile: $(Build.SourcesDirectory)\build\PoliCheckExclusions.xml
+      codeSignValidation:
+        break: true
+        targetPathExclusionPattern: \"**\*.xml\"
+        ${{ if not(and(eq(variables['Build.Reason'], 'IndividualCI'), eq(variables['Build.SourceBranch'], 'refs/heads/main'))) }}:
+          policyFile: $(MBSIGN_APPFOLDER)\CSVTestSignPolicy.xml
       sourceAnalysisPool: VSEngSS-MicroBuild2022-1ES
     pool:
       name: AzurePipelines-EO