Skip to content

Conversation

krwq
Copy link
Member

@krwq krwq commented Oct 13, 2025

Me & @rokonec came into conclusions that removing these should re-create BinSkim issues and not cause issues with other tooling. Baselines should contain entries for all active issues or issues already fixed since last baseline. Since we currently only have BinSkim entries in there we expect that after merging following will happen:

  • automatic PR with baselines update
  • BinSkim issues created

after this we should move permanent errors into suppression file and close out the issues

@Copilot Copilot AI review requested due to automatic review settings October 13, 2025 09:26
Copy link
Contributor

@Copilot Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull Request Overview

This PR removes baseline configurations for Guardian and 1ES Pipeline Templates to force the re-creation of BinSkim issues. The goal is to surface security issues that were previously baselined and ensure they are properly addressed or updated.

  • Removes all baselined security findings from Guardian configuration
  • Clears pipeline auto-baselining configuration for multiple security tools

Reviewed Changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.

File Description
.config/guardian/.gdnbaselines Complete removal of all baselined security findings including PowerShell script analyzer and BinSkim violations
.config/1espt/PipelineAutobaseliningConfig.yml Removal of auto-baselining configuration for multiple security analysis tools (credscan, binskim, spotbugs, eslint, etc.)

Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.

@codecov
Copy link

codecov bot commented Oct 13, 2025

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 69.02%. Comparing base (694bc60) to head (65481ac).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files
@@            Coverage Diff             @@
##             main    #7526      +/-   ##
==========================================
- Coverage   69.02%   69.02%   -0.01%     
==========================================
  Files        1482     1482              
  Lines      274092   274092              
  Branches    28266    28266              
==========================================
- Hits       189200   189183      -17     
- Misses      77503    77526      +23     
+ Partials     7389     7383       -6     
Flag Coverage Δ
Debug 69.02% <ø> (-0.01%) ⬇️
production 63.30% <ø> (-0.01%) ⬇️
test 89.47% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.
see 10 files with indirect coverage changes

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@ericstj
Copy link
Member

ericstj commented Oct 13, 2025

For this since it's just removing baselines it should be OK, but in the future please schedule official builds to test changes that only impact official build pipelines. You can do this by pushing a branch to the internal mirror and queueing a build.

@ericstj ericstj merged commit 7b60281 into dotnet:main Oct 13, 2025
25 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants