fix(sdl): add expirationDate to guardian baseline result entries

[Evgenii (Vaiz)]

🤖 Clawpilot here! Posted automatically by Clawpilot (an AI agent), not by a human. Please verify before acting.

Follow-up to #124. Same underlying bug.

What #124 got wrong

#124 added the missing createdDate and that half worked — the The CreatedDate of the result ... is empty errors are gone. But it deliberately left expirationDate off, arguing that a vendored bundle should not need periodic renewal. The SDL policy does not allow that choice, and the next publish run on main failed on precisely it:

##[error]Result with signature <76fd7a25...> on file <guardian_baselines.gdnbaselines>
is not compliant with the provided policy. Reason: undefined.
-- Additional arguments:You must provide a valid expiration date for @microsoft/sdl/no-inner-html

Still Baselined results: 0, still Guardian exited with an error exit code: 8.

createdDate and expirationDate are both required for this rule. #124 cited an existing baseline whose expiry had lapsed as evidence that dated baselines are a hazard; it is actually evidence that the field is mandatory.

Choosing the window

Rather than guess a second time, this follows what other repositories under the same SDL policy already use for @microsoft/sdl/no-inner-html baselines. The windows observed there are 90, 180 and 200 days.

This uses 90 days — 2026-11-27 — the shortest and most conservative of them, so it satisfies any cap the policy applies.

Effects

• Guardian should apply all three baseline entries and stop breaking the publish pipeline on main.
• The baseline lapses on 2026-11-27 and the build will break again then. That is forced by the policy, not chosen. The justification on each entry now says so, with the date, so whoever hits it next does not have to re-derive any of this.
• The durable fix is to stop scanning the vendored path at all rather than renewing a baseline every quarter. The SDL configuration is not in this repository — it comes from the pipeline template this repo extends, so adding an ESLint exclusion for crates/cargo-gamma-lib/src/vendor/ has to happen there. That template is shared with at least one other repository, so it is a wider change and out of scope for this unblock; it is tracked separately.
• Nothing outside the SDL gate is touched.

Verification

JSON validated; field order matches other baseline entries that pass this policy today.

As with #124 this cannot be checked locally — the Guardian CLI and the .gdn result files exist only on the CI agent. Confirmation is the next publish run reporting Baselined results: 3 and Active results: 0. Given #124 fixed one required field and revealed a second, I will watch the next run rather than treat the merge as the end of it.

/cc Pato Sandaña (@psandana) Martin Taillefer (@geeknoid)

[Copilot]

Pull request overview

Updates the Guardian baseline configuration to satisfy M365 SDL policy requirements for ESLint @microsoft/sdl/no-inner-html baseline entries, unblocking the repo’s SDL/Guardian gate for the vendored JS bundle findings.

Changes:

• Add expirationDate to each of the three existing baseline result entries.
• Expand the justification text to record the policy requirement and the renewal date (2026-11-27).

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Codecov Comments Bot (codecov-commenter)]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.7%. Comparing base (17f0aea) to head (4145e3d).

❌ Your project status has failed because the head coverage (97.7%) is below the target coverage (100.0%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files

@@          Coverage Diff          @@
##            main    #126   +/-   ##
=====================================
  Coverage   97.7%   97.7%           
=====================================
  Files        286     286           
  Lines      62460   62460           
=====================================
  Hits       61033   61033           
  Misses      1427    1427           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.