Conversation
There was a problem hiding this comment.
Pull Request Overview
This PR removes baseline configurations for Guardian and 1ES Pipeline Templates to force the re-creation of BinSkim issues. The goal is to surface security issues that were previously baselined and ensure they are properly addressed or updated.
- Removes all baselined security findings from Guardian configuration
- Clears pipeline auto-baselining configuration for multiple security tools
Reviewed Changes
Copilot reviewed 2 out of 2 changed files in this pull request and generated no comments.
| File | Description |
|---|---|
.config/guardian/.gdnbaselines |
Complete removal of all baselined security findings including PowerShell script analyzer and BinSkim violations |
.config/1espt/PipelineAutobaseliningConfig.yml |
Removal of auto-baselining configuration for multiple security analysis tools (credscan, binskim, spotbugs, eslint, etc.) |
Tip: Customize your code reviews with copilot-instructions.md. Create the file or learn how to get started.
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## main #7526 +/- ##
==========================================
- Coverage 69.02% 69.02% -0.01%
==========================================
Files 1482 1482
Lines 274092 274092
Branches 28266 28266
==========================================
- Hits 189200 189183 -17
- Misses 77503 77526 +23
+ Partials 7389 7383 -6
Flags with carried forward coverage won't be shown. Click here to find out more. 🚀 New features to boost your workflow:
|
|
For this since it's just removing baselines it should be OK, but in the future please schedule official builds to test changes that only impact official build pipelines. You can do this by pushing a branch to the internal mirror and queueing a build. |
Me & @rokonec came into conclusions that removing these should re-create BinSkim issues and not cause issues with other tooling. Baselines should contain entries for all active issues or issues already fixed since last baseline. Since we currently only have BinSkim entries in there we expect that after merging following will happen:
after this we should move permanent errors into suppression file and close out the issues