Security analysis on both CI and Dist pipelines

Azure · Feb 9, 2022 · a906e63 · a906e63
1 parent 9f1a3c9
commit a906e63
Show file tree

Hide file tree

Showing 4 changed files with 27 additions and 21 deletions.
diff --git a/.vsts/win/ci.yml b/.vsts/win/ci.yml
@@ -1,12 +1,5 @@
 steps:
-  # Static analysis before build
-  - task: securedevelopmentteam.vss-secure-development-tools.build-task-credscan.CredScan@2
-    displayName: "Run CredScan"
-    inputs:
-      suppressionsFile: test/cred-scan-exclude.json
-      toolMajorVersion: V2
-      debugMode: false
-
+  - template: ./credscan.yml
   - template: ./win-dependencies.yml
 
   - powershell: npm run build-and-pack
@@ -20,19 +13,7 @@ steps:
       npm run spectron
     displayName: Running spectron
 
-  - task: securedevelopmentteam.vss-secure-development-tools.build-task-antimalware.AntiMalware@3
-    displayName: "AntiMalware Scanner"
-    inputs:
-      EnableServices: true
-
-  - task: securedevelopmentteam.vss-secure-development-tools.build-task-publishsecurityanalysislogs.PublishSecurityAnalysisLogs@2
-    displayName: "Publish Security Analysis Logs"
-
-  - task: securedevelopmentteam.vss-secure-development-tools.build-task-postanalysis.PostAnalysis@1
-    displayName: "Post Analysis"
-    inputs:
-      CredScan: true
-
+  - template: ./security-analysis.yml
 
   - template: ../common/publish-artifacts.yml
     parameters:

diff --git a/.vsts/win/credscan.yml b/.vsts/win/credscan.yml
@@ -0,0 +1,9 @@
+steps:
+  # Static analysis before build
+  - task: securedevelopmentteam.vss-secure-development-tools.build-task-credscan.CredScan@2
+    displayName: "Run CredScan"
+    inputs:
+      suppressionsFile: test/cred-scan-exclude.json
+      toolMajorVersion: V2
+      debugMode: false
+
diff --git a/.vsts/win/distribution.yml b/.vsts/win/distribution.yml
@@ -1,4 +1,5 @@
 steps:
+  - template: ./credscan.yml
   - template: ./win-dependencies.yml
   - powershell: ./scripts/azpipelines/update-build-name.ps1
     displayName: Resolve version
@@ -10,6 +11,8 @@ steps:
       exec { npm run package win-exe }
     displayName: Build executable
 
+  - template: ./security-analysis.yml
+
   - template: ./sign.yml
     parameters:
       name: "Sign executable and dll"

diff --git a/.vsts/win/security-analysis.yml b/.vsts/win/security-analysis.yml
@@ -0,0 +1,13 @@
+steps:
+  - task: securedevelopmentteam.vss-secure-development-tools.build-task-antimalware.AntiMalware@3
+    displayName: "AntiMalware Scanner"
+    inputs:
+      EnableServices: true
+
+  - task: securedevelopmentteam.vss-secure-development-tools.build-task-publishsecurityanalysislogs.PublishSecurityAnalysisLogs@2
+    displayName: "Publish Security Analysis Logs"
+
+  - task: securedevelopmentteam.vss-secure-development-tools.build-task-postanalysis.PostAnalysis@1
+    displayName: "Post Analysis"
+    inputs:
+      CredScan: true