starred/terminal
1
0
Fork 0
mirror of https://github.com/microsoft/terminal.git synced 2026-02-03 21:25:34 +00:00
Code Issues 19.0k Packages Projects Releases 20 Wiki Activity

[PR #11849] [MERGED] Enable Security and Compliance tasks in our Release pipeline #28757

New Issue
Open
opened 2026-01-31 09:30:34 +00:00 by claunia · 0 comments
claunia commented 2026-01-31 09:30:34 +00:00
Owner
Copy Link

📋 Pull Request Information

Original PR: https://github.com/microsoft/terminal/pull/11849
Author: @miniksa
Created: 11/30/2021
Status: ✅ Merged
Merged: 1/5/2022
Merged by: @undefined

Base: main ← Head: dev/miniksa/compliance

📝 Commits (10+)

  • 1977f6b Add compliance task to pipeline
  • a151fed attempt machine version test and change to artifact feed connection
  • d9ffba3 bippity boppity boo
  • 6a63f3c goof less
  • 8b38ccc undo temporary testing stuff
  • 75e5c95 re-sprinkle helix access tokens
  • b9dc74e conditionally append access token
  • ebe8075 use correct method name
  • ffc5dc3 attempt to break out compliance tasks onto 2019 image and temporarily use recycled artifacts to speed this up
  • 1dc142b add checkout bit and nerf dependency

📊 Changes

6 files changed (+262 additions, -12 deletions)

View changed files

📝 .github/actions/spelling/expect/expect.txt (+3 -0)
➕ build/config/PolicheckExclusions.xml (+11 -0)
📝 build/pipelines/release.yml (+11 -4)
➕ build/pipelines/templates/build-console-compliance-job.yml (+224 -0)
📝 src/cascadia/TerminalSettingsModel/CascadiaSettings.cpp (+12 -8)
📝 src/common.build.pre.props (+1 -0)

📄 Description

Enables a series of tasks run against our release pipeline that validate the security and compliance status of our code in an automated fashion. These checks include:

  • Component Governance - (we had this one, it was moved to here) - Inventories open-source components used in our build
  • PREfast - C/C++ static analysis for common code errors and exploits
  • Policheck - Searches source code, comments, and text for words that could be sensitive legally, culturally, or geopolitically
  • Credscan - Looks for credentials left behind in the code/documents and build output files
  • BinSkim - Searches for common vulnerabilities in binaries
  • CheckCFlags - Validates that compile/link flags match the policies recommended by Windows engineering for inclusion into the OS product image
  • CFGCheck/XFGCheck - Validates that the CFG and/or XFG settings were enabled at compile and link time to guard against control flow attacks.

We're also required to run the SBOM one, but that was done in a separate PR and we're still pending the detectors being updated.

References

  • #11948 - Move from CFG to XFG once XFG task folks get back to me on it
  • #11949 - Enable bug filing for SecComp tasks
  • #11950 - Bulk process bugs filed by SecComp tasks
  • #11947 - Validate SBOM when checkers come online

Checklist

🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.

## 📋 Pull Request Information **Original PR:** https://github.com/microsoft/terminal/pull/11849 **Author:** [@miniksa](https://github.com/miniksa) **Created:** 11/30/2021 **Status:** ✅ Merged **Merged:** 1/5/2022 **Merged by:** [@undefined](undefined) **Base:** `main` ← **Head:** `dev/miniksa/compliance` --- ### 📝 Commits (10+) - [`1977f6b`](https://github.com/microsoft/terminal/commit/1977f6bdf90863927e02d7aeddebf8a5c20619ef) Add compliance task to pipeline - [`a151fed`](https://github.com/microsoft/terminal/commit/a151fed43fee04e0c3219e154dc658bc9e7a1f18) attempt machine version test and change to artifact feed connection - [`d9ffba3`](https://github.com/microsoft/terminal/commit/d9ffba3a50e6d0284379252f02a4b6939c5868fe) bippity boppity boo - [`6a63f3c`](https://github.com/microsoft/terminal/commit/6a63f3c28b3f9dc14c1102f4ceaa5985215516fe) goof less - [`8b38ccc`](https://github.com/microsoft/terminal/commit/8b38ccc8ca0885ac4b7eccaad523ac583523d512) undo temporary testing stuff - [`75e5c95`](https://github.com/microsoft/terminal/commit/75e5c9504f3b94bf57f94cdf11b6d1c10297cb0b) re-sprinkle helix access tokens - [`b9dc74e`](https://github.com/microsoft/terminal/commit/b9dc74e3e572df33336eef4ddcd27a071a8dc69d) conditionally append access token - [`ebe8075`](https://github.com/microsoft/terminal/commit/ebe8075c13fda96993df7c56af16990cb697fd8f) use correct method name - [`ffc5dc3`](https://github.com/microsoft/terminal/commit/ffc5dc36a58f787e228c015ece85729eb56005f4) attempt to break out compliance tasks onto 2019 image and temporarily use recycled artifacts to speed this up - [`1dc142b`](https://github.com/microsoft/terminal/commit/1dc142b3b0a6846ef676b8d703f993963e9eca2b) add checkout bit and nerf dependency ### 📊 Changes **6 files changed** (+262 additions, -12 deletions) <details> <summary>View changed files</summary> 📝 `.github/actions/spelling/expect/expect.txt` (+3 -0) ➕ `build/config/PolicheckExclusions.xml` (+11 -0) 📝 `build/pipelines/release.yml` (+11 -4) ➕ `build/pipelines/templates/build-console-compliance-job.yml` (+224 -0) 📝 `src/cascadia/TerminalSettingsModel/CascadiaSettings.cpp` (+12 -8) 📝 `src/common.build.pre.props` (+1 -0) </details> ### 📄 Description Enables a series of tasks run against our release pipeline that validate the security and compliance status of our code in an automated fashion. These checks include: - Component Governance - (we had this one, it was moved to here) - Inventories open-source components used in our build - PREfast - C/C++ static analysis for common code errors and exploits - Policheck - Searches source code, comments, and text for words that could be sensitive legally, culturally, or geopolitically - Credscan - Looks for credentials left behind in the code/documents and build output files - BinSkim - Searches for common vulnerabilities in binaries - CheckCFlags - Validates that compile/link flags match the policies recommended by Windows engineering for inclusion into the OS product image - CFGCheck/XFGCheck - Validates that the CFG and/or XFG settings were enabled at compile and link time to guard against control flow attacks. We're also required to run the SBOM one, but that was done in a separate PR and we're still pending the detectors being updated. ## References - #11948 - Move from CFG to XFG once XFG task folks get back to me on it - #11949 - Enable bug filing for SecComp tasks - #11950 - Bulk process bugs filed by SecComp tasks - #11947 - Validate SBOM when checkers come online ## Checklist - [x] - Fixes #10735 - [x] - Fixes #908 - [x] - I work here - [x] - If it fits, it sits. --- <sub>🔄 This issue represents a GitHub Pull Request. It cannot be merged through Gitea due to API limitations.</sub>
claunia added the pull-request label 2026-01-31 09:30:34 +00:00
Sign in to join this conversation.
No Branch/Tag Specified
Branches Tags
Labels
Clear labels
⛺ Reserved
A11yCO
A11yMAS
A11ySev1
A11ySev2
A11ySev3
A11yTTValidated
A11yUsable
A11yVoiceAccess
A11yWCAG
Area-Accessibility
Area-AtlasEngine
Area-AzureShell
Area-Build
Area-Build
Area-Chat
Area-CmdPal
Area-CodeHealth
Area-Commandline
Area-CookedRead
Area-DefApp
Area-Extensibility
Area-Fonts
Area-GroupPolicy
Area-i18n
Area-Input
Area-Interaction
Area-Interop
Area-Localization
Area-Output
Area-Performance
Area-Portable
Area-Quality
Area-Remoting
Area-Rendering
Area-Schema
Area-Server
Area-Settings
Area-SettingsUI
Area-ShellExtension
Area-ShellExtension
Area-ShellExtension
Area-Suggestions
Area-Suggestions
Area-TerminalConnection
Area-TerminalControl
Area-Theming
Area-UserInterface
Area-VT
Area-Windowing
Area-WPFControl
AutoMerge
Blocking-Ingestion
Culprit-Centennial
Culprit-WinUI
Disability-All
Disability-Blind
Disability-LowVision
Disability-Mobility
External-Blocked-WinUI3
Fixed
Gathering-Data
good first issue
HCL-E+D
HCL-WindowsTerminal
Help Wanted
Impact-Compatibility
Impact-Compliance
Impact-Correctness
Impact-Visual
In-PR
InclusionBacklog
InclusionBacklog-Windows TerminalWin32
InclusionCommitted-202206
Issue-Bug
Issue-Docs
Issue-Feature
Issue-Feature
Issue-Question
Issue-Samples
Issue-Scenario
Issue-Task
Needs-Attention
Needs-Author-Feedback
Needs-Bisect
Needs-Discussion
Needs-Repro
Needs-Tag-Fix
Needs-Tag-Fix
Needs-Triage
No-Recent-Activity
Priority-0
Priority-1
Priority-2
Priority-3
Product-Cmd.exe
Product-Colortool
Product-Colortool
Product-Colortool
Product-Conhost
Product-Conpty
Product-Meta
Product-Powershell
Product-Terminal
Product-WSL
pull-request
Mirrored from GitHub Pull Request
 Resolution-Answered
Resolution-By-Design
Resolution-Duplicate
Resolution-External
Resolution-Fix-Available
Resolution-Fix-Committed
Resolution-No-Repro
Resolution-Won't-Fix
Severity-Blocking
Severity-Crash
Severity-DataLoss
spam
this-will-be-a-breaking-change
Tracking-External
WindowsTerminal_Win32
Work-Item
zAskModeBug
zInbox-Bug
No Label pull-request
Milestone
No items
No Milestone
Projects
Clear projects
No project
Assignees
Clear assignees
claunia
No Assignees
1 Participants
Notifications
Due Date
No due date set.
Dependencies

No dependencies set.

Reference: starred/terminal#28757
Delete Branch "%!s()"

Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?