compliance.yml

trigger:
- main

# no PR triggers
pr: none

pool:
  vmImage: 'windows-latest'

steps:
- task: CredScan@3

- task: ESLint@1
  inputs:
    Configuration: 'recommended'
    TargetType: 'eslint'
    ErrorLevel: 'warn'

- task: UseDotNet@2
  displayName: 'Use .NET 7.0'
  inputs:
    packageType: 'sdk'
    version: '7.x'

- task: Semmle@1
  env: 
     SYSTEM_ACCESSTOKEN: $(System.AccessToken)
  inputs:
    sourceCodeDirectory: '$(Build.SourcesDirectory)'
    language: 'csharp'
    buildCommandsString: '$(Agent.ToolsDirectory)\dotnet\dotnet.exe restore $(BUILD.SourcesDirectory)\dotnet\SK-dotnet.sln#$(Agent.ToolsDirectory)\dotnet\dotnet.exe build $(BUILD.SourcesDirectory)\dotnet\SK-dotnet.sln'
    querySuite: 'Recommended'
    timeout: '1800'
    ram: '16384'
    addProjectDirToScanningExclusionList: true

# Usage of System.AccessToken is only required for uploading
# results to CodeQL servers via variable LGTM.UploadSnapshot = true
# If you want to analyze errors on your own or if LGTM.UploadSnapshot = false,
# then passing this environment variable is not required.

#######################################################
# Highly Discouraged, only for backward compatibility #
#######################################################
# When code is hosted on GitHub and build pipeline is created on ADO then a PAT token can be used in place of AccessToken as part of environment variable
# SYSTEM_ACCESSTOKEN: $(PATToken)
# Where PATToken is name of the variable and value contains the actual PAT token generated by user

- task: ComponentGovernanceComponentDetection@0
  inputs:
    scanType: 'Register'
    verbosity: 'Verbose'
    alertWarningLevel: 'High'
    failOnAlert: true

- task: PublishSecurityAnalysisLogs@3
  inputs:
    ArtifactName: 'CodeAnalysisLogs'
    ArtifactType: 'Container'
    AllTools: true
    ToolLogsNotFoundAction: 'Standard'