|
9 | 9 | - eng/pipelines/aggregate-reports.yml |
10 | 10 |
|
11 | 11 | jobs: |
12 | | - - job: Generate |
| 12 | + - job: Reporting |
| 13 | + displayName: Generate reports (with build) |
13 | 14 | timeoutInMinutes: 180 |
14 | 15 | variables: |
15 | 16 | - template: templates/variables/globals.yml |
16 | 17 | pool: |
17 | | - vmImage: 'windows-2019' |
| 18 | + vmImage: 'ubuntu-18.04' |
18 | 19 | steps: |
19 | | - # Put cred scan step before install and build packages to avoid the tool scans generated folder like /target. |
20 | | - - task: securedevelopmentteam.vss-secure-development-tools.build-task-credscan.CredScan@3 |
21 | | - displayName: 'Run CredScan' |
22 | | - inputs: |
23 | | - suppressionsFile: 'eng\CredScanSuppression.json' |
24 | | - condition: succeededOrFailed() |
25 | | - - task: securedevelopmentteam.vss-secure-development-tools.build-task-publishsecurityanalysislogs.PublishSecurityAnalysisLogs@3 |
26 | | - displayName: 'Publish Security Analysis Logs' |
27 | | - condition: succeededOrFailed() |
28 | | - - task: securedevelopmentteam.vss-secure-development-tools.build-task-postanalysis.PostAnalysis@2 |
29 | | - displayName: 'Post Analysis' |
30 | | - inputs: |
31 | | - GdnBreakAllTools: false |
32 | | - GdnBreakGdnToolCredScan: true |
33 | | - GdnBreakGdnToolCredScanSeverity: Error |
34 | | - GdnBreakBaselineFiles: $(Build.SourcesDirectory)\eng\java.gdnbaselines |
35 | | - GdnBreakBaselines: baseline |
36 | | - # Used for generating baseline file. |
37 | | - # GdnBreakOutputBaselineFile: java |
38 | | - # GdnBreakOutputBaseline: baseline |
39 | | - condition: succeededOrFailed() |
40 | | - - task: securedevelopmentteam.vss-secure-development-tools.build-task-publishsecurityanalysislogs.PublishSecurityAnalysisLogs@3 |
41 | | - displayName: 'Publish Security Analysis Logs' |
42 | | - condition: succeededOrFailed() |
43 | 20 | # We `install` the code quality reports tooling into our local m2 cache separately from building the Maven project |
44 | 21 | # reports. This means it is available as part of that, but also so that this is not documented in the project report. |
45 | 22 | - template: templates/steps/install-reporting-tools.yml |
|
59 | 36 | publishJUnitResults: false |
60 | 37 | goals: 'clean install' |
61 | 38 |
|
62 | | - - task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0 |
63 | | - # ComponentGovernance is currently unable to run on pull requests of public projects. Running on non-PR |
64 | | - # builds should be sufficient. |
65 | | - # Only run if building all libraries succeeded. |
66 | | - condition: and(succeeded(), ne(variables['Build.Reason'], 'PullRequest')) |
67 | | - displayName: 'Component Detection' |
68 | | - |
69 | 39 | - task: Maven@3 |
70 | 40 | displayName: 'Generate Reports' |
71 | 41 | inputs: |
|
76 | 46 | jdkVersionOption: $(JavaBuildVersion) |
77 | 47 | jdkArchitectureOption: 'x64' |
78 | 48 | publishJUnitResults: false |
79 | | - goals: 'clean verify site:site site:stage' |
| 49 | + goals: 'verify site:site site:stage' |
80 | 50 |
|
81 | 51 | - task: PublishTestResults@2 |
82 | 52 | condition: succeededOrFailed() |
@@ -110,21 +80,55 @@ jobs: |
110 | 80 | Copy-Item eng/code-quality-reports/src/main/resources/index.html $(Build.ArtifactStagingDirectory) |
111 | 81 | Copy-Item eng/code-quality-reports/src/main/resources/dependency-allowlist.html $(Build.ArtifactStagingDirectory)/staging |
112 | 82 |
|
113 | | - # What is this? |
114 | | - # copy output/pom.client.html (Join-Path $(Build.ArtifactStagingDirectory) "staging") |
115 | | -
|
116 | 83 | Copy-Item eng/common/InterdependencyGraph.html $(Build.ArtifactStagingDirectory)/staging |
117 | 84 | Copy-Item data.js $(Build.ArtifactStagingDirectory)/staging |
118 | 85 | displayName: 'Copy reports to artifact staging' |
119 | 86 |
|
| 87 | + - publish: $(Build.ArtifactStagingDirectory) |
| 88 | + condition: succeededOrFailed() |
| 89 | + displayName: 'Publish Report Artifacts' |
| 90 | + artifact: reports |
| 91 | + - job: Compliance |
| 92 | + displayName: Analyze (no build) |
| 93 | + timeoutInMinutes: 120 |
| 94 | + variables: |
| 95 | + - template: templates/variables/globals.yml |
| 96 | + pool: |
| 97 | + # CredScan build task is Windows only (https://aka.ms/credscan). |
| 98 | + vmImage: 'windows-2019' |
| 99 | + steps: |
| 100 | + - task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0 |
| 101 | + # ComponentGovernance is currently unable to run on pull requests of public projects. Running on non-PR |
| 102 | + # builds should be sufficient. |
| 103 | + # Only run if building all libraries succeeded. |
| 104 | + condition: and(succeeded(), ne(variables['Build.Reason'], 'PullRequest')) |
| 105 | + displayName: 'Component Detection' |
| 106 | + |
| 107 | + # Put cred scan step before install and build packages to avoid the tool scans generated folder like /target. |
| 108 | + - task: securedevelopmentteam.vss-secure-development-tools.build-task-credscan.CredScan@3 |
| 109 | + displayName: 'Run CredScan' |
| 110 | + inputs: |
| 111 | + suppressionsFile: 'eng\CredScanSuppression.json' |
| 112 | + condition: succeededOrFailed() |
| 113 | + - task: securedevelopmentteam.vss-secure-development-tools.build-task-publishsecurityanalysislogs.PublishSecurityAnalysisLogs@3 |
| 114 | + displayName: 'Publish Security Analysis Logs' |
| 115 | + condition: succeededOrFailed() |
| 116 | + - task: securedevelopmentteam.vss-secure-development-tools.build-task-postanalysis.PostAnalysis@2 |
| 117 | + displayName: 'Post Analysis' |
| 118 | + inputs: |
| 119 | + GdnBreakAllTools: false |
| 120 | + GdnBreakGdnToolCredScan: true |
| 121 | + GdnBreakGdnToolCredScanSeverity: Error |
| 122 | + GdnBreakBaselineFiles: $(Build.SourcesDirectory)\eng\java.gdnbaselines |
| 123 | + GdnBreakBaselines: baseline |
| 124 | + # Used for generating baseline file. |
| 125 | + # GdnBreakOutputBaselineFile: java |
| 126 | + # GdnBreakOutputBaseline: baseline |
| 127 | + condition: succeededOrFailed() |
120 | 128 | # Run link verification at the end as it will run no matter the pipeline passing or failing. |
121 | 129 | # If this task fails with an error it shouldn't prevent aggregate reports from being generated. |
122 | 130 | - template: ../common/pipelines/templates/steps/verify-links.yml |
123 | 131 | parameters: |
124 | 132 | Directory: "" |
125 | 133 | CheckLinkGuidance: $true |
126 | 134 | Condition: succeededOrFailed() |
127 | | - - publish: $(Build.ArtifactStagingDirectory) |
128 | | - condition: succeededOrFailed() |
129 | | - displayName: 'Publish Report Artifacts' |
130 | | - artifact: reports |
|
0 commit comments