[build] Revert BinSkim analyzeTargetGlob customization - #10964
Merged
Conversation
Revert analyzeTargetGlob to a single pattern (bin\Build*\**) by removing the semicolon-separated bin\msi-nupkgs\** addition from PR #10961. Guardian's glob parser does not support semicolon-separated patterns. When the value contains semicolons, Guardian prepends the source directory to the entire string, creating an unparseable glob: D:\a\_work\1\s\bin\Build*\**;bin\msi-nupkgs\** This causes BinSkim to fail with ERR997.NoValidAnalysisTargets in every job that uses the global SDL config (Convert NuGet to MSI, Debugging tests, etc.). The 'Convert NuGet to MSI' job is fixed separately by adding a per-job analyzeTargetGlob override in Xamarin.yaml-templates, matching the approach already used by the sign-artifacts template. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Member
Author
Point BinSkim at the actual MSI output directory so the Convert NuGet to MSI job has valid scan targets. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
This reverts commit 344d8dd.
Member
Author
This reverts commit 1ef9fc6.
jonathanpeppers
changed the title
Member
Author
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…kim fix" This reverts commit 594f4f7.
Member
Author
Member
Author
|
Finally, green again: 
Merging to unblock builds. |
jonathanpeppers
marked this pull request as ready for review
March 19, 2026 02:35
jonathanpeppers
requested review from
grendello and
simonrozsival
as code owners
March 19, 2026 02:35
Contributor
There was a problem hiding this comment.
Pull request overview
Reverts the BinSkim analyzeTargetGlob customization in the 1ES pipeline configuration, returning to the previously working default behavior while keeping output-only scanning enabled.
Changes:
- Remove the
analyzeTargetGloboverride from the BinSkim SDL configuration. - Remove associated comments explaining the (now-reverted) custom glob logic.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to subscribe to this conversation on GitHub.
Already have an account?
Sign in.
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Revert the
analyzeTargetGlobcustomization added in PRs #10940, #10953, and #10961.The custom glob patterns caused more problems than they solved:
+|bin\Build*\**— Guardian can't parse+|prefix ([build] Fix BinSkimanalyzeTargetGlobpattern #10953)bin\Build*\**— breaks the 'Convert NuGet to MSI' job which has nobin\Build*\directory ([build] Fix BinSkim failure in 'Convert NuGet to MSI' job #10961)bin\Build*\**;bin\msi-nupkgs\**— Guardian can't parse semicolons, breaks every jobRemove
analyzeTargetGlobentirely and keep onlyscanOutputDirectoryOnly: true, which is the default configuration that worked before #10940.