Changed Dependency to Allow Linux Build and Added OneBranch Pipeline

.ci/compliance.yml

@@ -0,0 +1,146 @@
+steps:
+
+- powershell: |
+    $powerShellPath = Join-Path -Path $env:AGENT_TEMPDIRECTORY -ChildPath 'powershell'
+    Invoke-WebRequest -Uri https://raw.githubusercontent.com/PowerShell/PowerShell/master/tools/install-powershell.ps1 -outfile ./install-powershell.ps1
+    ./install-powershell.ps1 -Destination $powerShellPath
+    $vstsCommandString = "vso[task.setvariable variable=PATH]$powerShellPath;$env:PATH"
+    Write-Host "sending " + $vstsCommandString
+    Write-Host "##$vstsCommandString"
+  displayName: Install PowerShell Core
+
+- task: DownloadBuildArtifacts@0
+  displayName: 'Download artifacts'
+  inputs:
+    buildType: current
+    downloadType: specifc
+    itemPattern: '**/*.nupkg'
+    downloadPath: '$(System.ArtifactsDirectory)'
+
+- pwsh: |
+    Get-ChildItem -Path "$(System.ArtifactsDirectory)" -Recurse
+  displayName: Capture artifacts directory
+
+- pwsh: |
+    $modulePath = Join-Path -Path $env:AGENT_TEMPDIRECTORY -ChildPath 'TempModules'
+    if (Test-Path -Path $modulePath) {
+      Write-Verbose -Verbose "Deleting existing temp module path: $modulePath"
+      Remove-Item -Path $modulePath -Recurse -Force -ErrorAction Ignore
+    }
+    if (! (Test-Path -Path $modulePath)) {
+      Write-Verbose -Verbose "Creating new temp module path: $modulePath"
+      $null = New-Item -Path $modulePath -ItemType Directory
+    }
+  displayName: Create temporary module path
+
+- pwsh: |
+    $modulePath = Join-Path -Path $env:AGENT_TEMPDIRECTORY -ChildPath 'TempModules'
+    Write-Verbose -Verbose "Install PowerShellGet V3 to temp module path"
+    Save-Module -Name PowerShellGet -Path $modulePath -MinimumVersion 3.0.0-beta10 -AllowPrerelease -Force
+    Write-Verbose -Verbose "Install PlatyPS to temp module path"
+    Save-Module -Name "platyPS" -Path $modulePath -Force
+    Write-Verbose -Verbose "Install PSScriptAnalyzer to temp module path"
+    Save-Module -Name "PSScriptAnalyzer" -Path $modulePath -RequiredVersion 1.18.0 -Force
+    Write-Verbose -Verbose "Install Pester 4.X to temp module path"
+    Save-Module -Name "Pester" -MaximumVersion 4.99 -Path $modulePath -Force
+    Write-Verbose -Verbose "Install PSPackageProject to temp module path"
+    Save-Module -Name PSPackageProject -Path $modulePath -Force
+  displayName: Install PSPackageProject and dependencies
+
+- pwsh: |
+    $modulePath = Join-Path -Path $env:AGENT_TEMPDIRECTORY -ChildPath 'TempModules'
+    $env:PSModulePath = $modulePath + [System.IO.Path]::PathSeparator + $env:PSModulePath
+    $sourceName = 'pspackageproject-local-repo'
+    Register-PackageSource -Name $sourceName -Location "$(System.ArtifactsDirectory)" -ProviderName PowerShellGet -Force -ErrorAction Ignore
+    Get-PackageSource -Name $sourceName
+    $config = Get-PSPackageProjectConfiguration
+    $buildOutputPath = $config.BuildOutputPath
+    $null = New-Item -ItemType Directory -Path $buildOutputPath -Verbose
+    $moduleName = $config.ModuleName
+    Write-Verbose -Verbose "Saving package $sourceName to $($config.BuildOutputPath)"
+    Save-Package -Name $moduleName -Source $sourceName -ProviderName PowerShellGet -Path $config.BuildOutputPath -AllowPrereleaseVersions -Force
+    Write-Verbose -Verbose "Writing BUILD_SOURCE variable"
+    $vstsCommandString = "vso[task.setvariable variable=BUILD_SOURCE]$($config.BuildOutputPath)"
+    Write-Host "sending " + $vstsCommandString
+    Write-Host "##$vstsCommandString"
+  displayName: Extract product artifact
+
+- pwsh: |
+    $modulePath = Join-Path -Path $env:AGENT_TEMPDIRECTORY -ChildPath 'TempModules'
+    $env:PSModulePath = $modulePath + [System.IO.Path]::PathSeparator + $env:PSModulePath
+    $config = Get-PSPackageProjectConfiguration
+    dir "$($config.BuildOutputPath)/*" -r 2>$null
+  displayName: 'BuildOutputPath directory'
+
+- task: ms.vss-governance-buildtask.governance-build-task-component-detection.ComponentGovernanceComponentDetection@0
+  displayName: 'Component Detection'
+  inputs:
+    sourceScanPath: '$(Build.SourcesDirectory)'
+    snapshotForceEnabled: true
+
+- task: securedevelopmentteam.vss-secure-development-tools.build-task-antimalware.AntiMalware@3
+  displayName: 'Run Defender Scan'
+
+- task: securedevelopmentteam.vss-secure-development-tools.build-task-credscan.CredScan@2
+  displayName: 'Run CredScan'
+  inputs:
+    toolMajorVersion: V2
+    debugMode: false
+  continueOnError: true
+
+- task: securedevelopmentteam.vss-secure-development-tools.build-task-binskim.BinSkim@3
+  displayName: 'Run BinSkim '
+  inputs:
+    InputType: Basic
+    AnalyzeTarget: '$(BUILD_SOURCE)\Microsoft.PowerShell.ThreadJob\Microsoft.PowerShell.ThreadJob.dll'
+    AnalyzeSymPath: 'SRV*'
+    AnalyzeVerbose: true
+    AnalyzeHashes: true
+    AnalyzeStatistics: true
+  continueOnError: true
+
+- task: securedevelopmentteam.vss-secure-development-tools.build-task-policheck.PoliCheck@1
+  displayName: 'Run PoliCheck'
+  inputs:
+    targetType: F
+    optionsFC: 0
+    optionsXS: 0
+    optionsPE: '1|2|3|4'
+    optionsHMENABLE: 0
+#      optionsRulesDBPath: '$(Build.SourcesDirectory)\tools\terms\PowerShell-Terms-Rules.mdb'
+#      optionsFTPATH: '$(Build.SourcesDirectory)\tools\terms\FileTypeSet.xml'
+    toolVersion: 5.8.2.1
+  continueOnError: true
+
+- task: securedevelopmentteam.vss-secure-development-tools.build-task-publishsecurityanalysislogs.PublishSecurityAnalysisLogs@2
+  displayName: 'Publish Security Analysis Logs to Build Artifacts'
+  continueOnError: true
+
+- task: securedevelopmentteam.vss-secure-development-tools.build-task-uploadtotsa.TSAUpload@1
+  displayName: 'TSA upload to Codebase: PSThreadJob_201912 Stamp: Azure'
+  inputs:
+    tsaStamp: Azure
+    codeBaseName: PSThreadJob_202004
+    tsaVersion: TsaV2
+    uploadFortifySCA: false
+    uploadFxCop: false
+    uploadModernCop: false
+    uploadPREfast: false
+    uploadRoslyn: false
+    uploadTSLint: false
+    uploadAPIScan: false
+
+- task: securedevelopmentteam.vss-secure-development-tools.build-task-report.SdtReport@1
+  displayName: 'Create Security Analysis Report'
+  inputs:
+    TsvFile: false
+    APIScan: false
+    BinSkim: false
+    CredScan: true
+    PoliCheck: true
+    PoliCheckBreakOn: Severity2Above
+
+- pwsh: |
+    Unregister-PSRepository -Name 'pspackageproject-local-repo' -ErrorAction Ignore
+  displayName: Unregister temporary PSRepository
+  condition: always()

.ci/templates/sign.yml

@@ -0,0 +1,79 @@
+parameters:
+  - name: "buildOutputPath"
+    default: "$(Build.ArtifactStagingDirectory)\\build"
+  - name: "signOutputPath"
+    default: "$(Build.ArtifactStagingDirectory)\\signed"
+  - name: "certificateId"
+    default: "CP-230012"
+  - name: "pattern"
+    default: "*.dll,*.exe"
+
+steps:
+- task: UseDotNet@2
+  displayName: 'Install .NET Core sdk 2.x for ESRP'
+  inputs:
+    version: 2.x
+
+- pwsh: |
+    [string] $CertificateId = "${{ parameters.certificateId }}"
+    Write-Verbose "CertificateId - $CertificateId" -Verbose
+
+    [string] $VariableName = "EsrpJson"
+
+    [string] $SigningServer = '$(SigningServer)'
+    Write-Verbose "SigningServer - $SigningServer" -Verbose
+
+    $esrpParameters = @(
+    @{
+        ParameterName  = "OpusName"
+        ParameterValue = "Microsoft"
+    }
+    @{
+        ParameterName  = "OpusInfo"
+        ParameterValue = "http://www.microsoft.com"
+    }
+    @{
+        ParameterName  = "PageHash"
+        ParameterValue = "/NPH"
+    }
+    @{
+        ParameterName  = "FileDigest"
+        ParameterValue = "/fd sha256"
+    }
+    @{
+        ParameterName  = "TimeStamp"
+        ParameterValue = "/tr ""$SigningServer"" /td sha256"
+    }
+    )
+
+    $esrp = @(@{
+    keyCode = $CertificateId
+    operationSetCode = "SigntoolSign"
+    parameters = $esrpParameters
+    toolName = "signtool.exe"
+    toolVersion = "6.2.9304.0"
+    })
+
+    $vstsCommandString = "vso[task.setvariable variable=$VariableName][$($esrp | ConvertTo-Json -Compress)]"
+    Write-Verbose -Message ("sending " + $vstsCommandString) -Verbose
+    Write-Host "##$vstsCommandString"
+  displayName: Generate signing JSON
+  condition: and(and(and(succeeded(), eq(variables['Build.Reason'], 'Manual')), ne(variables['SkipSigning'], 'True')), ne(variables['SigningServer'], ''))
+
+- pwsh: |
+    Write-Verbose "BUILD_OUTPUT_PATH- ${{ parameters.buildOutputPath}}" -Verbose
+    Write-Verbose "SIGNED_OUTPUT_PATH- ${{ parameters.signOutputPath }}" -Verbose
+    Copy-Item ${{ parameters.buildOutputPath }}\* ${{ parameters.signOutputPath }}\ -Recurse -Force -Verbose
+  displayName: Prepare output folder
+  timeoutInMinutes: 10
+
+- task: SFP.build-tasks.custom-build-task-1.EsrpCodeSigning@1
+  displayName: Sign files
+  inputs:
+    ConnectedServiceName: pwshSigning
+    FolderPath: '${{ parameters.signOutputPath }}'
+    UseMinimatch: false
+    signConfigType: inlineSignParams
+    inlineOperation: $(EsrpJson)
+    Pattern: ${{ parameters.pattern }}
+  condition: and(and(and(succeeded(), eq(variables['Build.Reason'], 'Manual')), ne(variables['SkipSigning'], 'True')), ne(variables['SigningServer'], ''))

.config/tsaoptions.json

@@ -0,0 +1,8 @@
+{
+  "instanceUrl": "https://msazure.visualstudio.com",
+  "projectName": "One",
+  "areaPath": "One\\MGMT\\Compute\\Powershell\\Powershell\\PowerShell Core\\ThreadJob",
+  "codebaseName": "TFSMSAzure_ThreadJob",
+  "notificationAliases": [ "[email protected]", "[email protected]" ],
+  "tools": [ "CredScan", "PoliCheck", "BinSkim" ]
+}

.github/dependabot.yml

@@ -0,0 +1,16 @@
+version: 2
+updates:
+  - package-ecosystem: "nuget" # See documentation for possible values
+    directory: "/src/code" # Location of package manifests
+    schedule:
+      interval: "daily"
+
+  - package-ecosystem: github-actions
+    directory: /
+    schedule:
+      interval: daily
+
+  - package-ecosystem: nuget
+    directory: /
+    schedule:
+      interval: daily

.gitignore

@@ -19,3 +19,5 @@ xhtml/
 **/.vscode/**
 **/out/**
 **/bin/**
+.vs/**/*
+**/*.sln