Skip to content

Commit afc2423

Browse files
aishwaryabhaishwaryabh
authored
Fixing in-proc pipeline (#4250)
* add check for security vulnerability * fixing inproc pipeline * updating pipeline utilities to be the same * skipping dotnetZip cve * updating version to be latest * skipping npm install for unit test * changing working directory * changing build sched * my cat deleted the extra 2 by stepping on my keyboard lol * fixing typo * update actual pipeline with working directory changes
1 parent f36e553 commit afc2423

File tree

8 files changed

+71
-41
lines changed

8 files changed

+71
-41
lines changed

‎check-vulnerabilities.ps1

+42-16
Original file line numberDiff line numberDiff line change
@@ -1,33 +1,59 @@
1-
$projectPath = ".\src\Azure.Functions.Cli"
21
$projectFileName = ".\Azure.Functions.Cli.csproj"
32
$logFilePath = "..\..\build.log"
4-
if (-not (Test-Path $projectPath))
5-
{
6-
throw "Project path '$projectPath' does not exist."
7-
}
3+
$skipCveFilePath = "..\..\skipPackagesCve.json"
84

9-
cd $projectPath
105

116
$cmd = "restore"
127
Write-Host "dotnet $cmd"
138
dotnet $cmd | Tee-Object $logFilePath
149

15-
$cmd = "list", "package", "--include-transitive", "--vulnerable"
10+
$cmd = "list", "package", "--include-transitive", "--vulnerable", "--format", "json"
1611
Write-Host "dotnet $cmd"
1712
dotnet $cmd | Tee-Object $logFilePath
1813

19-
$result = Get-content $logFilePath | select-string "has no vulnerable packages given the current sources"
14+
# Parse JSON output
15+
$logContent = Get-Content $logFilePath -Raw | ConvertFrom-Json
16+
$topLevelPackages = $logContent.projects.frameworks.topLevelPackages
2017

21-
$logFileExists = Test-Path $logFilePath -PathType Leaf
22-
if ($logFileExists)
23-
{
24-
Remove-Item $logFilePath
18+
# Load skip-cve.json
19+
$skipCveContent = Get-Content $skipCveFilePath -Raw | ConvertFrom-Json
20+
$skipPackages = $skipCveContent.packages
21+
22+
# Validate files in skipPackagesCve.json are still valid security vulnerabilities
23+
$topLevelPackageIds = $topLevelPackages.id
24+
$invalidSkips = $skipPackages | Where-Object { $_ -notin $topLevelPackageIds }
25+
26+
if ($invalidSkips.Count -gt 0) {
27+
Write-Host "The following packages in 'skipPackagesCve.json' do not exist in the vulnerable packages list: $($invalidSkips -join ', '). Please remove these packages from the JSON file."
28+
Exit 1
29+
}
30+
31+
# Filter vulnerabilities
32+
$vulnerablePackages = @()
33+
foreach ($package in $topLevelPackages) {
34+
if ($skipPackages -notcontains $package.id) {
35+
$vulnerablePackages += $package
36+
}
2537
}
2638

27-
cd ../..
39+
# Check for remaining vulnerabilities
40+
if ($vulnerablePackages.Count -gt 0) {
41+
Write-Host "Security vulnerabilities found (excluding skipped packages):"
42+
$vulnerablePackages | ForEach-Object {
43+
Write-Host "Package: $($_.id)"
44+
Write-Host "Version: $($_.resolvedVersion)"
45+
$_.vulnerabilities | ForEach-Object {
46+
Write-Host "Severity: $($_.severity)"
47+
Write-Host "Advisory: $($_.advisoryurl)"
48+
}
49+
}
50+
Exit 1
51+
} else {
52+
Write-Host "No security vulnerabilities found (excluding skipped packages)."
53+
}
2854

29-
if (!$result)
55+
$logFileExists = Test-Path $logFilePath -PathType Leaf
56+
if ($logFileExists)
3057
{
31-
Write-Host "Vulnerabilities found"
32-
Exit 1
58+
Remove-Item $logFilePath
3359
}

‎eng/ci/templates/official/jobs/build-test.yml

+5-6
Original file line numberDiff line numberDiff line change
@@ -82,9 +82,11 @@ jobs:
8282
.\validateWorkerVersions.ps1
8383
displayName: 'Validate worker versions'
8484
condition: ne(variables['skipWorkerVersionValidation'], 'true')
85-
- pwsh: |
86-
.\check-vulnerabilities.ps1
87-
displayName: "Check for security vulnerabilities"
85+
- task: PowerShell@2
86+
displayName: "Run Check Vulnerabilities Script"
87+
inputs:
88+
filePath: '$(Build.SourcesDirectory)/check-vulnerabilities.ps1'
89+
workingDirectory: '$(Build.SourcesDirectory)/src/Azure.Functions.Cli'
8890
- pwsh: |
8991
.\build.ps1
9092
env:
@@ -96,9 +98,6 @@ jobs:
9698
TELEMETRY_INSTRUMENTATION_KEY: $(TELEMETRY_INSTRUMENTATION_KEY)
9799
IntegrationBuildNumber: $(INTEGRATIONBUILDNUMBER)
98100
displayName: 'Executing build script'
99-
- pwsh: |
100-
.\check-vulnerabilities.ps1
101-
displayName: "Check for security vulnerabilities"
102101
103102
- template: ci/sign-files.yml@eng
104103
parameters:

‎eng/ci/templates/public/jobs/build-test-public.yml

+5-4
Original file line numberDiff line numberDiff line change
@@ -43,7 +43,11 @@ jobs:
4343
- pwsh: |
4444
.\validateWorkerVersions.ps1
4545
displayName: 'Validate worker versions'
46-
condition: ne(variables['skipWorkerVersionValidation'], 'true')
46+
- task: PowerShell@2
47+
displayName: "Run Check Vulnerabilities Script"
48+
inputs:
49+
filePath: '$(Build.SourcesDirectory)/check-vulnerabilities.ps1'
50+
workingDirectory: '$(Build.SourcesDirectory)/src/Azure.Functions.Cli'
4751
- pwsh: |
4852
.\build.ps1
4953
env:
@@ -53,9 +57,6 @@ jobs:
5357
IsPublicBuild: true
5458
IsCodeqlBuild: false
5559
displayName: 'Executing build script'
56-
- pwsh: |
57-
.\check-vulnerabilities.ps1
58-
displayName: "Check for security vulnerabilities"
5960
- task: PublishTestResults@2
6061
inputs:
6162
testResultsFormat: 'VSTest'

‎pipelineUtilities.psm1

+3-3
Original file line numberDiff line numberDiff line change
@@ -74,8 +74,8 @@ $DotnetSDKVersionRequirements = @{
7474
}
7575
# Update .NET 9 patch once .NET 9 has been released out of preview
7676
'9.0' = @{
77-
MinimalPatch = '100-preview.6.24328.19'
78-
DefaultPatch = '100-preview.6.24328.19'
77+
MinimalPatch = '100-rc.1.24452.12'
78+
DefaultPatch = '100-rc.1.24452.12'
7979

8080
}
8181
}
@@ -124,7 +124,7 @@ function Install-DotnetVersion($Version,$Channel) {
124124
if ($IsWindows) {
125125
& .\$installScript -InstallDir "$env:ProgramFiles/dotnet" -Channel $Channel -Version $Version
126126
# Installing .NET into x86 directory since the E2E App runs the tests on x86 and looks for the specified framework there
127-
& .\$installScript -InstallDir "$env:ProgramFiles (x86)/dotnet" -Channel $Channel -Version $Version
127+
& .\$installScript -InstallDir "$env:ProgramFiles (x86)/dotnet" -Channel $Channel -Version $Version -Architecture x86
128128
} else {
129129
bash ./$installScript --install-dir /usr/share/dotnet -c $Channel -v $Version
130130
}

‎skipPackagesCve.json

+5
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,5 @@
1+
{
2+
"packages": [
3+
"DotNetZip"
4+
]
5+
}

‎src/Azure.Functions.Cli/Azure.Functions.Cli.csproj

+9-10
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
<Project Sdk="Microsoft.NET.Sdk" InitialTargets="ExcludeWorkersFromReadyToRun">
1+
<Project Sdk="Microsoft.NET.Sdk" InitialTargets="ExcludeWorkersFromReadyToRun">
22
<PropertyGroup>
33
<OutputType>Exe</OutputType>
44
<TargetFrameworks>net6.0;net8.0</TargetFrameworks>
@@ -66,9 +66,9 @@
6666
<EmbeddedResource Include="StaticResources\Dockerfile.dotnet8Isolated">
6767
<LogicalName>$(AssemblyName).Dockerfile.dotnet8Isolated</LogicalName>
6868
</EmbeddedResource>
69-
<EmbeddedResource Include="StaticResources\Dockerfile.dotnet9Isolated">
69+
<EmbeddedResource Include="StaticResources\Dockerfile.dotnet9Isolated">
7070
<LogicalName>$(AssemblyName).Dockerfile.dotnet9Isolated</LogicalName>
71-
</EmbeddedResource>
71+
</EmbeddedResource>
7272
<EmbeddedResource Include="StaticResources\ExtensionsProj.csproj.template">
7373
<LogicalName>$(AssemblyName).ExtensionsProj.csproj</LogicalName>
7474
</EmbeddedResource>
@@ -287,15 +287,14 @@
287287
<PackageReference Include="Microsoft.ApplicationInsights" Version="2.22.0" />
288288
<PackageReference Include="Microsoft.AspNetCore.DataProtection" Version="2.2.0" />
289289
<PackageReference Include="Microsoft.Azure.DurableTask.AzureStorage.Internal" Version="1.4.0" />
290-
<PackageReference Include="Microsoft.Azure.WebJobs.Script.WebHost" Version="4.35.4" />
290+
<PackageReference Include="Microsoft.Azure.WebJobs.Script.WebHost" Version="4.37.0" />
291291
<PackageReference Include="Microsoft.Build" Version="17.0.0" />
292292
<PackageReference Include="Microsoft.Identity.Client" Version="4.61.3" />
293293
<PackageReference Include="Newtonsoft.Json" Version="13.0.3" />
294294
<PackageReference Include="NuGet.Packaging" Version="5.11.6" />
295295
<PackageReference Include="System.Formats.Asn1" Version="6.0.1" />
296296
<PackageReference Include="WindowsAzure.Storage" Version="9.3.1" />
297297
<PackageReference Include="YamlDotNet" Version="6.0.0" />
298-
299298
<!-- Transitive dependency -->
300299
<PackageReference Include="System.Text.Json" Version="8.0.5" />
301300
</ItemGroup>
@@ -307,12 +306,12 @@
307306
<PackageReference Include="System.Text.Json" Version="8.0.5" />
308307
</ItemGroup>
309308
<ItemGroup Condition="'$(NoWorkers)' != 'true'">
310-
<PackageReference Include="Microsoft.Azure.Functions.JavaWorker" Version="2.14.0" />
311-
<PackageReference Include="Microsoft.Azure.Functions.NodeJsWorker" Version="3.10.0" />
309+
<PackageReference Include="Microsoft.Azure.Functions.JavaWorker" Version="2.17.0" />
310+
<PackageReference Include="Microsoft.Azure.Functions.NodeJsWorker" Version="3.10.1" />
312311
<PackageReference Include="Microsoft.Azure.Functions.PowerShellWorker.PS7.0" Version="4.0.3148" />
313-
<PackageReference Include="Microsoft.Azure.Functions.PowerShellWorker.PS7.2" Version="4.0.3220" />
314-
<PackageReference Include="Microsoft.Azure.Functions.PowerShellWorker.PS7.4" Version="4.0.3219" />
315-
<PackageReference Include="Microsoft.Azure.Functions.PythonWorker" Version="4.29.0" />
312+
<PackageReference Include="Microsoft.Azure.Functions.PowerShellWorker.PS7.2" Version="4.0.4025" />
313+
<PackageReference Include="Microsoft.Azure.Functions.PowerShellWorker.PS7.4" Version="4.0.4026" />
314+
<PackageReference Include="Microsoft.Azure.Functions.PythonWorker" Version="4.34.0" />
316315
</ItemGroup>
317316
<Target Name="ExcludeWorkersFromReadyToRun">
318317
<CreateItem Include="%(None.Filename)%(None.Extension)" Condition="$([System.String]::new('%(None.TargetPath)').StartsWith('workers'))" PreserveExistingMetadata="false">

‎test/Azure.Functions.Cli.Tests/E2E/InitTests.cs

+1-1
Original file line numberDiff line numberDiff line change
@@ -45,7 +45,7 @@ public Task init_with_worker_runtime(string workerRuntime)
4545

4646
return CliTester.Run(new RunConfiguration
4747
{
48-
Commands = new[] { $"init . --worker-runtime {workerRuntime}" },
48+
Commands = new[] { $"init . --worker-runtime {workerRuntime} --skip-npm-install" },
4949
CheckFiles = files.ToArray(),
5050
OutputContains = new[]
5151
{

‎validateWorkerVersions.ps1

+1-1
Original file line numberDiff line numberDiff line change
@@ -59,7 +59,7 @@ if (-Not $hostVersion) {
5959

6060
function getHostFileContent([string]$filePath) {
6161
$uri = "https://raw.githubusercontent.com/Azure/azure-functions-host/v$hostVersion/$filePath"
62-
return removeBomIfExists((Invoke-WebRequest -Uri $uri -MaximumRetryCount 5 -RetryIntervalSec 2).Content)
62+
return removeBomIfExists((Invoke-WebRequest -Uri $uri).Content)
6363
}
6464
$hostCsprojContent = getHostFileContent "src/WebJobs.Script/WebJobs.Script.csproj"
6565
$pythonPropsContent = getHostFileContent "build/python.props"

0 commit comments

Comments
 (0)