1es-unofficial.yml

# This unofficial template will always run CG in "what if" mode, which will not submit results to the CG. SDL tools may
# also be disabled for testing purposes.
#
# When extending this template, pipelines using a repository resource containing versions files for image caching must
# do the following:
#
# - Do not rely on any source code from the versions repo so as to not circumvent SDL and CG guidelines
# - The versions repo resource must be named `InternalVersionsRepo` or `PublicVersionsRepo` to avoid SDL scans
# - The versions repo must be checked out to `$(Build.SourcesDirectory)/versions` to avoid CG scans
#
# If the pipeline is not using a separate repository resource, ensure that there is no source code checked out in
# `$(Build.SourcesDirectory)/versions`, as it will not be scanned.

parameters:
- name: disableSDL
  type: boolean
  default: false
  displayName: Disable SDL
- name: stages
  type: stageList
  default: []
  # 1ES Pipeline Template parameters
- name: serviceConnections
  type: object
  default: []
- name: pool
  type: object
  default:
    name: $(default1ESInternalPoolName)
    image: $(default1ESInternalPoolImage)
    os: linux
- name: sourceAnalysisPool
  type: object
  default:
    name: $(defaultSourceAnalysisPoolName)
    image: $(defaultSourceAnalysisPoolImage)
    os: windows

resources:
  repositories:
  - repository: 1ESPipelineTemplates
    type: git
    name: 1ESPipelineTemplates/1ESPipelineTemplates
    ref: refs/tags/release

extends:
  template: /eng/common/templates/task-prefix-decorator.yml@self
  parameters:
    # Use a unique task prefix for unofficial pipelines
    taskPrefix: "🟦"
    baseTemplate: v1/1ES.Unofficial.PipelineTemplate.yml@1ESPipelineTemplates
    templateParameters:
      pool: ${{ parameters.pool }}
      sdl:
        binskim:
          enabled: true
        componentgovernance:
          ignoreDirectories: $(Build.SourcesDirectory)/versions
          whatIf: true
          showAlertLink: true
        enableAllTools: ${{ not(parameters.disableSDL) }}
        policheck:
          enabled: true
        sbom:
          enabled: true
        sourceRepositoriesToScan:
          exclude:
          - repository: InternalVersionsRepo
          - repository: PublicVersionsRepo
        sourceAnalysisPool: ${{ parameters.sourceAnalysisPool }}
        tsa:
          enabled: true
    stages:
    - template: /eng/common/templates/stages/setup-service-connections.yml@self
      parameters:
        pool: ${{ parameters.pool }}
        serviceConnections: ${{ parameters.serviceConnections }}
    - ${{ parameters.stages }}