Skip to content

[build] Scope BinSkim scanning to build output only #10940

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
jonathanpeppers merged 1 commit into from
Mar 16, 2026
Merged

[build] Scope BinSkim scanning to build output only #10940

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions build-tools/automation/azure-pipelines.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -60,6 +60,8 @@ extends:
enableAllTools: false
binskim:
scanOutputDirectoryOnly: true
# Only scan actual build output, not test assemblies under bin/Test*
analyzeTargetGlob: +|bin\Build*\**
Copy link
Copy Markdown
Member Author

@jonathanpeppers jonathanpeppers Mar 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🤖 ⚠️ CI / SDL — This glob correctly excludes bin/Test* assemblies (fixing BA2021 noise), but CI still fails because BA2007 fires on bin/BuildRelease/net10.0/{arm64,x64}/libZipSharpNative-3-3.dll — which matches bin\Build*\**.

Options to get CI green:

  1. Add a .gdnbaselines file to baseline BA2007 for libZipSharpNative (the -wd4996 comes from the upstream libzip CMake build and isn't trivially fixable).
  2. Or add a second exclude pattern: analyzeTargetGlob: +|bin\Build*\** -|**\libZipSharpNative*

Without one of these, this PR alone won't unblock CI.

Copy link
Copy Markdown
Member Author

@jonathanpeppers jonathanpeppers Mar 16, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is an improvement to not find tons of issues when MSBuild test lanes fail.

We should actually fix libZipSharp separately.

codeql:
compiled:
enabled: false
Expand Down
Loading