Switch the steps of post-analysis and publish artifact. Convert sarif file extension to csv (Azure#20575)

* Switch the post analysis and publish archifacts. Also, add csv file in aritfacts

Author: sima-zhu

eng/pipelines/aggregate-reports.yml

@@ -110,9 +110,6 @@ jobs:
       inputs:
         suppressionsFile: 'eng\CredScanSuppression.json'
       condition: succeededOrFailed()
-    - task: securedevelopmentteam.vss-secure-development-tools.build-task-publishsecurityanalysislogs.PublishSecurityAnalysisLogs@3
-      displayName: 'Publish Security Analysis Logs'
-      condition: succeededOrFailed()
     - task: securedevelopmentteam.vss-secure-development-tools.build-task-postanalysis.PostAnalysis@2
       displayName: 'Post Analysis'
       inputs:
@@ -126,6 +123,31 @@ jobs:
         # GdnBreakOutputBaseline: baseline
       condition: succeededOrFailed()
       continueOnError: true
+    - pwsh: |
+        $results = (Get-Content "$(Pipeline.workspace)\.gdn\.r\CredScan\001\CredScan-matches.sarif" | ConvertFrom-Json).runs.results
+        $csvRows = @()
+        $pathMatchRegex = ("$(Build.SourcesDirectory)" -replace "\\", "/")
+        $results | ForEach-Object {
+          $csvRows += [pscustomobject]@{
+            ruleId = $_.ruleId
+            ruleIndex = $_.ruleIndex
+            fingerprints = $_.fingerprints
+            message = $_.message
+            properties = $_.properties
+            rank = $_.rank
+            fileName = $_.analysisTarget.uri -replace ".*$pathMatchRegex(.*)", "https://github.com/Azure/azure-sdk-for-java/blob/master/`$1"
+            startLine = $_.locations.physicalLocation.region.startLine
+            startColumn = $_.locations.physicalLocation.region.startColumn
+            endLine = $_.locations.physicalLocation.region.endLine
+            endColumn = $_.locations.physicalLocation.region.endColumn
+            level = $_.level
+          }
+        } 
+        $csvRows | Export-Csv -Path "$(Pipeline.workspace)\.gdn\.r\CredScan\001\CredScan-matches.csv" -NoTypeInformation
+      displayName: Add converted csv file for CredScan-matches.sarif
+    - task: securedevelopmentteam.vss-secure-development-tools.build-task-publishsecurityanalysislogs.PublishSecurityAnalysisLogs@3
+      displayName: 'Publish Security Analysis Logs'
+      condition: succeededOrFailed()
     # Run link verification at the end as it will run no matter the pipeline passing or failing.
     # If this task fails with an error it shouldn't prevent aggregate reports from being generated.
     - template: ../common/pipelines/templates/steps/verify-links.yml