diff --git a/README.md b/README.md index 60732af..232ccc1 100644 --- a/README.md +++ b/README.md @@ -1,6 +1,7 @@ # Compliance task library -**Contents of this repository are intended for internal Microsoft use.** +**Contents of this repository are intended for use in internal Microsoft Pipelines. +This repository is public so the community can inspect our process and for sharing among teams.** This repository contains Azure DevOPS YAML template for the compliance tasks needed for release products. The step templates can be included in the repository using [multi-checkout](https://docs.microsoft.com/en-us/azure/devops/pipelines/repos/multi-repo-checkout?view=azure-devops). @@ -154,7 +155,7 @@ Details can be found in the PowerShell Maintainers teams channel's Wiki tab. # If "true", use a custom JSON string for ESRP signing. Defaults to "false". useCustomEsrpJson: false # If "true", ESRP will automatically verify your files are signed properly (eg signtool /verify). - # Only supported for authenticode & nuget signing. + # Only supported for authenticode & nuget signing. # Defaults to "false". verifySignature: false # If "true", ESRP will page hash sign your files. @@ -364,3 +365,15 @@ This example uses a custom ESRP malware scanning (Azure DevOps) service name. scanningService: 'FactoryOrchestratorScanning' ``` + +### Daily build Compliance template + +This example add the template for a daily build. +It will automatically skip for PRs. +It should be put near the end of the job. + +```yaml + - template: dailyBuildCompliance.yml@ComplianceRepo + parameters: + sourceScanPath: '$(repoPath)' +``` diff --git a/dailyBuildCompliance.yml b/dailyBuildCompliance.yml new file mode 100644 index 0000000..fd01172 --- /dev/null +++ b/dailyBuildCompliance.yml @@ -0,0 +1,14 @@ +parameters: + - name: sourceScanPath + default: $(Build.SourcesDirectory) + +steps: + - ${{ if ne(variables['Build.Reason'], 'PullRequest') }}: + - template: template-compliance/component-governance.yml + parameters: + sourceScanPath: '${{ parameters.sourceScanPath }}' + + - ${{ if ne(variables['Build.Reason'], 'PullRequest') }}: + - powershell: Write-Host "##vso[build.updatebuildnumber]$env:BUILD_SOURCEBRANCHNAME-$env:BUILD_SOURCEVERSION-$((get-date).ToString("yyyyMMddhhmmss"))" + displayName: Set Build Name for Non-PR + condition: ne(variables['Build.Reason'], 'PullRequest')