[ci] Add exclusions for PoliCheck and CredScan

scripts/azure-templates-stages.yml

@@ -906,65 +906,45 @@ stages:
             installDotNet: false
             shouldPublish: false
             postBuildSteps:
-              - task: CredScan@2
+              - task: CredScan@3
                 displayName: Analyze source for credentials
                 condition: always()
                 inputs:
-                  toolMajorVersion: 'V2'
-              - task: PoliCheck@1
+                  suppressionsFile: $(Build.SourcesDirectory)\scripts\guardian\CredScanSuppressions.json
+              - task: PoliCheck@2
                 displayName: Run PoliCheck
                 condition: always()
                 inputs:
                   inputType: 'Basic'
                   targetType: 'F'
-              - task: SdtReport@1
+                  optionsUEPATH: $(Build.SourcesDirectory)\scripts\guardian\PoliCheckExclusions.xml
+              - task: SdtReport@2
                 displayName: Create security analysis report
                 condition: always()
                 inputs:
-                  AllTools: false
-                  APIScan: false
-                  BinSkim: false
-                  CodesignValidation: false
-                  CredScan: true
-                  FortifySCA: false
-                  FxCop: false
-                  ModernCop: false
-                  MSRD: false
-                  PoliCheck: true
-                  RoslynAnalyzers: false
-                  SDLNativeRules: false
-                  Semmle: false
-                  TSLint: false
-                  ToolLogsNotFoundAction: 'Standard'
+                  GdnExportAllTools: false
+                  GdnExportGdnToolCredScan: true
+                  GdnExportGdnToolPoliCheck: true
+                  GdnExportOutputSuppressionFile: source.gdnsuppress
               - task: PublishSecurityAnalysisLogs@3
                 displayName: Publish security analysis logs
                 condition: always()
-              - task: TSAUpload@1
+              - pwsh: |
+                  $tsaConfig = '$(Build.SourcesDirectory)\scripts\guardian\tsaoptions-v2.json'
+                  $tsaConfigJson = Get-Content $tsaConfig | ConvertFrom-Json
+                  $tsaConfigJson | Add-Member -Type NoteProperty -Name 'SuppressionFiles' -Value @("$(Build.SourcesDirectory)\scripts\guardian\source.gdnsuppress")
+                  $tsaConfigJson | Add-Member -Type NoteProperty -Name 'SuppressionSets' -Value @("default")
+                  $tsaConfigJson | ConvertTo-Json | Out-File $tsaConfig
+                  cat $tsaConfig
+                displayName: Update TSA suppressions
+                condition: always()
+              - task: TSAUpload@2
                 displayName: Publish TSA logs
                 condition: always()
                 continueOnError: true
                 inputs:
-                  tsaVersion: 'TsaV2'
-                  codebase: 'NewOrUpdate'
-                  tsaEnvironment: 'PROD'
-                  codeBaseName: 'SkiaSharp_main'
-                  notificationAlias: 'xamacomd@microsoft.com'
-                  notifyAlwaysV2: false
-                  instanceUrlForTsaV2: 'DEVDIV'
-                  projectNameDEVDIV: 'DevDiv'
-                  areaPath: 'DevDiv\VS Client - Runtime SDKs\SkiaSharp'
-                  iterationPath: 'DevDiv\Future Backlog'
-                  uploadAPIScan: false
-                  uploadBinSkim: false
-                  uploadCredScan: true
-                  uploadFortifySCA: false
-                  uploadFxCop: false
-                  uploadModernCop: false
-                  uploadPoliCheck: true
-                  uploadPREfast: false
-                  uploadRoslyn: false
-                  uploadTSLint: false
-                  uploadAsync: true
+                  GdnPublishTsaOnboard: true
+                  GdnPublishTsaConfigFile: $(Build.SourcesDirectory)\scripts\guardian\tsaoptions-v2.json
 
   - ${{ if eq(parameters.buildPipelineType, 'tests') }}:
     - stage: finalize

scripts/guardian/CredScanSuppressions.json

@@ -0,0 +1,37 @@
+{
+    "tool": "Credential Scanner",
+    "suppressions": [
+        {
+            "file": "externals\\skia\\third_party\\externals\\microhttpd\\doc\\examples\\basicauthentication.c",
+            "_justification": "Open Source resource that we do not own."
+        },
+        {
+            "file": "externals\\skia\\third_party\\externals\\microhttpd\\src\\datadir\\cert-and-key-for-wireshark.pem",
+            "_justification": "Open Source resource that we do not own."
+        },
+        {
+            "file": "externals\\skia\\third_party\\externals\\microhttpd\\src\\datadir\\cert-and-key.pem",
+            "_justification": "Open Source resource that we do not own."
+        },
+        {
+            "file": "externals\\skia\\third_party\\externals\\microhttpd\\src\\testcurl\\https\\host1.key",
+            "_justification": "Open Source resource that we do not own."
+        },
+        {
+            "file": "externals\\skia\\third_party\\externals\\microhttpd\\src\\testcurl\\https\\host2.key",
+            "_justification": "Open Source resource that we do not own."
+        },
+        {
+            "file": "externals\\skia\\third_party\\externals\\microhttpd\\src\\testcurl\\https\\key.pem",
+            "_justification": "Open Source resource that we do not own."
+        },
+        {
+            "file": "externals\\skia\\third_party\\externals\\sdl\\VisualC-WinRT\\tests\\loopwave\\loopwave_VS2012_TemporaryKey.pfx",
+            "_justification": "Open Source resource that we do not own."
+        },
+        {
+            "file": "externals\\skia\\third_party\\externals\\sdl\\VisualC-WinRT\\tests\\testthread\\testthread_VS2012_TemporaryKey.pfx",
+            "_justification": "Open Source resource that we do not own."
+        }
+    ]
+}

scripts/guardian/PoliCheckExclusions.xml

@@ -0,0 +1,10 @@
+<PoliCheckExclusions>
+  <!-- Each of these exclusions is a folder name - if \[name]\ exists in the file path, it will be skipped -->
+  <Exclusion Type="FolderPathFull">DEPOT_TOOLS|THIRD_PARTY</Exclusion>
+  <!-- Each of these exclusions is a folder name - if any folder or file starts with "\[name]", it will be skipped -->
+  <!-- <Exclusion Type="FolderPathStart">ABC|XYZ</Exclusion> -->
+  <!-- Each of these file types will be completely skipped for the entire scan -->
+  <!-- <Exclusion Type="FileType">.ABC|.XYZ</Exclusion> -->
+  <!-- The specified file names will be skipped during the scan regardless which folder they are in -->
+  <!--  <Exclusion Type="FileName">ABC.TXT|XYZ.CS</Exclusion> -->
+</PoliCheckExclusions>