Skip to content

Commit b9bba24

Browse files
bewithgauravDavid-Engelsaurabh500
authored
CHORE: Update 1ES ADO Pipelines (#325)
### Work Item / Issue Reference <!-- IMPORTANT: Please follow the PR template guidelines below. For mssql-python maintainers: Insert your ADO Work Item ID below (e.g. AB#37452) For external contributors: Insert Github Issue number below (e.g. #149) Only one reference is required - either GitHub issue OR ADO Work Item. --> <!-- mssql-python maintainers: ADO Work Item --> > [AB#40479](https://sqlclientdrivers.visualstudio.com/c6d89619-62de-46a0-8b46-70b92a84d85e/_workitems/edit/40479) <!-- External contributors: GitHub Issue --> > GitHub Issue: #<ISSUE_NUMBER> ------------------------------------------------------------------- ### Summary <!-- Insert your summary of changes below. Minimum 10 characters required. --> Sync ADO Repo with GH Changes: This pull request introduces a comprehensive set of Secure Development Lifecycle (SDL) configuration files to the repository. These files establish baseline settings for automated security and compliance tools (TSA, CredScan, PoliCheck, Guardian), define which code paths and file types are included or excluded from scanning, and document the configuration for future maintenance. This setup helps ensure that only production code is scanned for credentials and terminology issues, while test, example, and documentation files are safely excluded. **SDL Tool Configuration and Documentation:** * Added `.config/SDL_CONFIGURATION.md`, providing detailed documentation for how TSA, CredScan, and PoliCheck are configured, what paths are included/excluded, and maintenance guidance for the team. * Introduced `.config/tsaoptions.json` to configure Threat and Security Assessment (TSA) for the project, specifying project details, notification settings, and codebase scanning patterns. **Security and Compliance Exclusions:** * Added `.config/CredScanSuppressions.json` to suppress false positives from credential scanning in non-production code (tests, benchmarks, engineering, and pipeline files). * Added `.config/PolicheckExclusions.xml` to exclude specific folders and files (tests, benchmarks, docs, examples, build artifacts, virtual environments, and standard documentation files) from politically incorrect term scanning. **Guardian Baseline Integration:** * Added `.gdn/.gdnbaselines` to establish Guardian security baselines, including signatures and metadata for compliance tracking. --------- Co-authored-by: David Engel <dengel1012@gmail.com> Co-authored-by: MerlinBot <MerlinBot> Co-authored-by: Saurabh Singh (SQL Drivers) <saurabh.singh@microsoft.com>
1 parent d442386 commit b9bba24

25 files changed

+2979
-6
lines changed

‎.config/CredScanSuppressions.json‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
{
2+
"tool": "Credential Scanner",
3+
"suppressions": [
4+
{
5+
"file": "tests/*",
6+
"justification": "Test projects contain sample credentials and should be skipped"
7+
},
8+
{
9+
"file": "benchmarks/*",
10+
"justification": "Benchmark code may include test connection strings"
11+
},
12+
{
13+
"file": "eng/*",
14+
"justification": "Engineering and pipeline configuration files"
15+
},
16+
{
17+
"file": "OneBranchPipelines/*",
18+
"justification": "OneBranch pipeline configuration files"
19+
}
20+
]
21+
}

‎.config/PolicheckExclusions.xml‎

Lines changed: 11 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,11 @@
1+
<PoliCheckExclusions>
2+
<!-- Each of these exclusions is a folder name - if \[name]\ exists in the file path, it will be skipped -->
3+
<Exclusion Type="FolderPathFull">
4+
tests|benchmarks|eng|OneBranchPipelines|examples|docs|build-artifacts|dist|__pycache__|myvenv|testenv
5+
</Exclusion>
6+
7+
<!-- The file(s) named with any of these specified file names will be skipped during the scan regardless which folder they are in -->
8+
<Exclusion Type="FileName">
9+
CHANGELOG.md|README.md|LICENSE|NOTICE.txt|ROADMAP.md|CODE_OF_CONDUCT.md|CONTRIBUTING.md|SECURITY.md|SUPPORT.md
10+
</Exclusion>
11+
</PoliCheckExclusions>

‎.config/tsaoptions.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
{
2+
"instanceUrl": "https://sqlclientdrivers.visualstudio.com",
3+
"projectName": "mssql-python",
4+
"areaPath": "mssql-python",
5+
"iterationPath": "mssql-python",
6+
"notificationAliases": [
7+
"mssql-python@microsoft.com"
8+
],
9+
"repositoryName": "mssql-python",
10+
"codebaseName": "Microsoft Python Driver for SQL Server",
11+
"allTools": true,
12+
"includePathPatterns": "mssql_python/*, setup.py, requirements.txt",
13+
"excludePathPatterns": "tests/*, benchmarks/*, eng/*, OneBranchPipelines/*"
14+
}

‎.gdn/.gdnbaselines‎

Lines changed: 300 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,300 @@
1+
{
2+
"hydrated": false,
3+
"properties": {
4+
"helpUri": "https://eng.ms/docs/microsoft-security/security/azure-security/cloudai-security-fundamentals-engineering/security-integration/guardian-wiki/microsoft-guardian/general/baselines"
5+
},
6+
"version": "1.0.0",
7+
"baselines": {
8+
"default": {
9+
"name": "default",
10+
"createdDate": "2025-11-10 15:00:51Z",
11+
"lastUpdatedDate": "2025-11-10 15:00:51Z"
12+
}
13+
},
14+
"results": {
15+
"aade958c0f923536ba575ebaaf1ce15a85f6c45b73e7785c2c15fb5a2c94408e": {
16+
"signature": "aade958c0f923536ba575ebaaf1ce15a85f6c45b73e7785c2c15fb5a2c94408e",
17+
"alternativeSignatures": [
18+
"c59f521d29345c75983ad0e494c2e55e3a4c41ac35b7163da488a9f78c864f63"
19+
],
20+
"memberOf": [
21+
"default"
22+
],
23+
"createdDate": "2025-11-10 15:00:51Z"
24+
},
25+
"a7d351fb49883535cfb307e2a4f77636ae5e54a94af99406f96d2558bd643edc": {
26+
"signature": "a7d351fb49883535cfb307e2a4f77636ae5e54a94af99406f96d2558bd643edc",
27+
"alternativeSignatures": [],
28+
"memberOf": [
29+
"default"
30+
],
31+
"createdDate": "2025-11-10 15:00:51Z"
32+
},
33+
"1ba31ce1ab7a0b18ae9e504ad24c48f235eab0e6dcb3ad960a7a89b9c48b077a": {
34+
"signature": "1ba31ce1ab7a0b18ae9e504ad24c48f235eab0e6dcb3ad960a7a89b9c48b077a",
35+
"alternativeSignatures": [],
36+
"memberOf": [
37+
"default"
38+
],
39+
"createdDate": "2025-11-10 15:00:51Z"
40+
},
41+
"f7e51f21d47b749dd39359b75955ad1c0cf382c0a78426bcb31539bc0a88374b": {
42+
"signature": "f7e51f21d47b749dd39359b75955ad1c0cf382c0a78426bcb31539bc0a88374b",
43+
"alternativeSignatures": [],
44+
"memberOf": [
45+
"default"
46+
],
47+
"createdDate": "2025-11-10 15:00:51Z"
48+
},
49+
"57bee1c81911d2ba66861c1deebf33ec0ec5fa5d946666748017493ead017d53": {
50+
"signature": "57bee1c81911d2ba66861c1deebf33ec0ec5fa5d946666748017493ead017d53",
51+
"alternativeSignatures": [],
52+
"memberOf": [
53+
"default"
54+
],
55+
"createdDate": "2025-11-10 15:00:51Z"
56+
},
57+
"278585c30d0968e80928c1d86455aa32481e0b97b0cdbba1f20073e70398a0b8": {
58+
"signature": "278585c30d0968e80928c1d86455aa32481e0b97b0cdbba1f20073e70398a0b8",
59+
"alternativeSignatures": [],
60+
"memberOf": [
61+
"default"
62+
],
63+
"createdDate": "2025-11-10 15:00:51Z"
64+
},
65+
"974a35997c6b2cdbb802ee711e2265e93f2f788f7ab976c05fbf7894e9248855": {
66+
"signature": "974a35997c6b2cdbb802ee711e2265e93f2f788f7ab976c05fbf7894e9248855",
67+
"alternativeSignatures": [],
68+
"memberOf": [
69+
"default"
70+
],
71+
"createdDate": "2025-11-10 15:00:51Z"
72+
},
73+
"6064d60cf011d4ef6771441256423be8099dafb8d1f11cc066365115c18f51ab": {
74+
"signature": "6064d60cf011d4ef6771441256423be8099dafb8d1f11cc066365115c18f51ab",
75+
"alternativeSignatures": [],
76+
"memberOf": [
77+
"default"
78+
],
79+
"createdDate": "2025-11-10 15:00:51Z"
80+
},
81+
"6b32b6a40b729abe443c04556b5a1c8fdcbbd27f1b6ae1d0d44ac75fa0dd38d5": {
82+
"signature": "6b32b6a40b729abe443c04556b5a1c8fdcbbd27f1b6ae1d0d44ac75fa0dd38d5",
83+
"alternativeSignatures": [],
84+
"memberOf": [
85+
"default"
86+
],
87+
"createdDate": "2025-11-10 15:00:51Z"
88+
},
89+
"8ef0a26f4366de0ec76cc6e929cceae58295937b3dce9d31471657091c9c9986": {
90+
"signature": "8ef0a26f4366de0ec76cc6e929cceae58295937b3dce9d31471657091c9c9986",
91+
"alternativeSignatures": [],
92+
"memberOf": [
93+
"default"
94+
],
95+
"createdDate": "2025-11-10 15:00:51Z"
96+
},
97+
"f1fa10a58cac2aca8946aba45e4a1d10f8ef6b86b433ed49b58910d3205149cc": {
98+
"signature": "f1fa10a58cac2aca8946aba45e4a1d10f8ef6b86b433ed49b58910d3205149cc",
99+
"alternativeSignatures": [],
100+
"memberOf": [
101+
"default"
102+
],
103+
"createdDate": "2025-11-10 15:00:51Z"
104+
},
105+
"39c0c5997e05cc2c4bbd182acf975698088e87d358e196008147ffafde9f43e2": {
106+
"signature": "39c0c5997e05cc2c4bbd182acf975698088e87d358e196008147ffafde9f43e2",
107+
"alternativeSignatures": [],
108+
"memberOf": [
109+
"default"
110+
],
111+
"createdDate": "2025-11-10 15:00:51Z"
112+
},
113+
"097d40852758d2660cdc7865c1b9cb638ec9165685773916e960efca725bb6cd": {
114+
"signature": "097d40852758d2660cdc7865c1b9cb638ec9165685773916e960efca725bb6cd",
115+
"alternativeSignatures": [],
116+
"memberOf": [
117+
"default"
118+
],
119+
"createdDate": "2025-11-10 15:00:51Z"
120+
},
121+
"9f83def0a176d3aa7dc47f6443ab546ba717e2b16a552e229784b171a18e55f5": {
122+
"signature": "9f83def0a176d3aa7dc47f6443ab546ba717e2b16a552e229784b171a18e55f5",
123+
"alternativeSignatures": [],
124+
"memberOf": [
125+
"default"
126+
],
127+
"createdDate": "2025-11-10 15:00:51Z"
128+
},
129+
"86966d5f6215bf5ae8c1b4d894caa6b69cc678374ab7a2321695dca35fc55923": {
130+
"signature": "86966d5f6215bf5ae8c1b4d894caa6b69cc678374ab7a2321695dca35fc55923",
131+
"alternativeSignatures": [
132+
"4c8f75669e65355d034fcd3be56ebf462134e0ff2fec2605d04bccdb36e68111"
133+
],
134+
"memberOf": [
135+
"default"
136+
],
137+
"createdDate": "2025-11-10 15:00:51Z"
138+
},
139+
"d07377aee65d4515741765e830ea055dfe6df987f8f2f6399dfff1b6928115f5": {
140+
"signature": "d07377aee65d4515741765e830ea055dfe6df987f8f2f6399dfff1b6928115f5",
141+
"alternativeSignatures": [
142+
"c0bcaaad531041aae4bc6bd88f452c845de3fb2b3825ab9b7ed1282cf2c548dd"
143+
],
144+
"memberOf": [
145+
"default"
146+
],
147+
"createdDate": "2025-11-10 15:00:51Z"
148+
},
149+
"bb10304b655f6008876c0671e0e8c73a858fc040867f340464dfc479cd9c3ba9": {
150+
"signature": "bb10304b655f6008876c0671e0e8c73a858fc040867f340464dfc479cd9c3ba9",
151+
"alternativeSignatures": [
152+
"ee06cd1fcac7607b9f9103d3572ae7468bb3c43350639c2798a91017851442ed"
153+
],
154+
"memberOf": [
155+
"default"
156+
],
157+
"createdDate": "2025-11-10 15:00:51Z"
158+
},
159+
"7df253f960bd38300d111d29e106cd8c4fbdcb1d9e1420b8f8b5efa702cc0d6b": {
160+
"signature": "7df253f960bd38300d111d29e106cd8c4fbdcb1d9e1420b8f8b5efa702cc0d6b",
161+
"alternativeSignatures": [
162+
"9f54994c0e212ec81244442d324a11d5bc2b20233eeef67e251767186fd0743e"
163+
],
164+
"memberOf": [
165+
"default"
166+
],
167+
"createdDate": "2025-11-10 15:00:51Z"
168+
},
169+
"bd9c1992728d9d1798329af6f6dc8ae44d7058a7d8f15b9001c009200ec0aaa3": {
170+
"signature": "bd9c1992728d9d1798329af6f6dc8ae44d7058a7d8f15b9001c009200ec0aaa3",
171+
"alternativeSignatures": [
172+
"1bb6c80c485a4385f09c8fe2ecd7f65b310fcbbc9987456db0c9372f2f9c479d"
173+
],
174+
"memberOf": [
175+
"default"
176+
],
177+
"createdDate": "2025-11-10 15:00:51Z"
178+
},
179+
"e8040349a51b39e6f9eb478d16128184865096ad79e35f1687e8f36bce9d0021": {
180+
"signature": "e8040349a51b39e6f9eb478d16128184865096ad79e35f1687e8f36bce9d0021",
181+
"alternativeSignatures": [
182+
"7ac989754684da6e6398df0fa8e9b38e63d43f536098574e98f8d82f987c9e64"
183+
],
184+
"memberOf": [
185+
"default"
186+
],
187+
"createdDate": "2025-11-10 15:00:51Z"
188+
},
189+
"99dbea9de7468dde3ab131a4c21f572fc19ff010730062451187de094abe9413": {
190+
"signature": "99dbea9de7468dde3ab131a4c21f572fc19ff010730062451187de094abe9413",
191+
"alternativeSignatures": [
192+
"924682483adec7d5d020422beaa8a703b2070d04e0b368a6c1c9fb33f4c0f386"
193+
],
194+
"memberOf": [
195+
"default"
196+
],
197+
"createdDate": "2025-11-10 15:00:51Z"
198+
},
199+
"f15c06eb6496f3eec4ecd667ae96476d7280d3691bee142a9e023b21d184cb7f": {
200+
"signature": "f15c06eb6496f3eec4ecd667ae96476d7280d3691bee142a9e023b21d184cb7f",
201+
"alternativeSignatures": [
202+
"a5b6768732ae9dcb3c8619af98639a1442cf53e8980716d861c40a14d40bcfef"
203+
],
204+
"memberOf": [
205+
"default"
206+
],
207+
"createdDate": "2025-11-10 15:00:51Z"
208+
},
209+
"3e5ff8a2e08d5e9a25ccaa7911b8cc758248fcc23ed7ff01d8f833294b2425dd": {
210+
"signature": "3e5ff8a2e08d5e9a25ccaa7911b8cc758248fcc23ed7ff01d8f833294b2425dd",
211+
"alternativeSignatures": [
212+
"36b8101496f546de6416a5978c611cc5fe309f40977bf78652d73b41b2975ea5"
213+
],
214+
"memberOf": [
215+
"default"
216+
],
217+
"createdDate": "2025-11-10 15:00:51Z"
218+
},
219+
"5e1c753e18bd472af64c82c71aee0dc83d0ddcb3a897522d120b707b56d47401": {
220+
"signature": "5e1c753e18bd472af64c82c71aee0dc83d0ddcb3a897522d120b707b56d47401",
221+
"alternativeSignatures": [
222+
"099fe23e23d95c8f957773101e24a53187e6cf67ccd2ae3944e65fddf95cf3c2"
223+
],
224+
"memberOf": [
225+
"default"
226+
],
227+
"createdDate": "2025-11-10 15:00:51Z"
228+
},
229+
"8636faecde898cdc690b9804ed240276ea631134588b99be21a509c3bcf8f5c6": {
230+
"signature": "8636faecde898cdc690b9804ed240276ea631134588b99be21a509c3bcf8f5c6",
231+
"alternativeSignatures": [
232+
"3d4b23500b78a0f0c4365d5fe9dc9773b07a653b6154bc2ec6e3df1147058e9f"
233+
],
234+
"memberOf": [
235+
"default"
236+
],
237+
"createdDate": "2025-11-10 15:00:51Z"
238+
},
239+
"83bd28e26677f06338e89530f916ac93bf0760f1ce328f1c3dd407863a74ad27": {
240+
"signature": "83bd28e26677f06338e89530f916ac93bf0760f1ce328f1c3dd407863a74ad27",
241+
"alternativeSignatures": [
242+
"bf49ba09d629e0b78e7d4ee56afc7347a7ba0cb727fed893f53f09be4466ebb5"
243+
],
244+
"memberOf": [
245+
"default"
246+
],
247+
"createdDate": "2025-11-10 15:00:51Z"
248+
},
249+
"5808b18c90fbe2874ded2e82d381b7fe425a5f472c4f123559923319de9adf44": {
250+
"signature": "5808b18c90fbe2874ded2e82d381b7fe425a5f472c4f123559923319de9adf44",
251+
"alternativeSignatures": [
252+
"0cc5b7885e75304a9951f4b22666fcafbfe5aafba268c6bcfdada2ef4b35bcfc"
253+
],
254+
"memberOf": [
255+
"default"
256+
],
257+
"createdDate": "2025-11-10 15:00:51Z"
258+
},
259+
"b4280c9ec7953fca7e333ae67821bb25616127bcaad96bb449fe2a777a2a754b": {
260+
"signature": "b4280c9ec7953fca7e333ae67821bb25616127bcaad96bb449fe2a777a2a754b",
261+
"alternativeSignatures": [
262+
"0a6d7dc7d76c5ec589cdceaba4bce1c6c7c1b54582900f305a5f35bfb606ca3e"
263+
],
264+
"memberOf": [
265+
"default"
266+
],
267+
"createdDate": "2025-11-10 15:00:51Z"
268+
},
269+
"9ebd52ffe5444d94809a5aaddfd754d8bce0085910516171b226a630f71a2cf6": {
270+
"signature": "9ebd52ffe5444d94809a5aaddfd754d8bce0085910516171b226a630f71a2cf6",
271+
"alternativeSignatures": [
272+
"3b2519103c3722c7c8a7fb8c639a57ebb6884441638f7a9cdcb49d788987b902"
273+
],
274+
"memberOf": [
275+
"default"
276+
],
277+
"createdDate": "2025-11-10 15:00:51Z"
278+
},
279+
"9a0821feaabde36ea784d6caad810916d21e950c4745162e04994faa5774fa3f": {
280+
"signature": "9a0821feaabde36ea784d6caad810916d21e950c4745162e04994faa5774fa3f",
281+
"alternativeSignatures": [
282+
"5ee6cebbc49bb7e376d0776ea55cf64f16bf3006e82048ccb7b6bcc174bd88b4"
283+
],
284+
"memberOf": [
285+
"default"
286+
],
287+
"createdDate": "2025-11-10 15:00:51Z"
288+
},
289+
"42007d4363dd45ea940c7a3dc4e76c13644982eb9d5879d89e7d6d79285b4be9": {
290+
"signature": "42007d4363dd45ea940c7a3dc4e76c13644982eb9d5879d89e7d6d79285b4be9",
291+
"alternativeSignatures": [
292+
"a6571b410651c2e09642232ecb65d8212dd7106cd268c5a90d5e5a4e61ff178f"
293+
],
294+
"memberOf": [
295+
"default"
296+
],
297+
"createdDate": "2025-11-10 15:00:51Z"
298+
}
299+
}
300+
}

0 commit comments

Comments
 (0)