Utilize CredScan suppressions file #3616
Conversation
There was a problem hiding this comment.
Pull request overview
This PR enables the use of an existing CredScan suppressions file by adding a reference to it in the official build pipeline configuration. The suppressions file (.config/CredScanSuppressions.json) was previously checked in but not referenced, causing CredScan to flag false positives in test code and certificates across multiple repositories including source-build-reference-packages, aspnetcore, and msbuild.
Key Changes:
- Added
credscanconfiguration block to the SDL section of the official build pipeline - Configured
suppressionsFileproperty to point to the existing.config/CredScanSuppressions.jsonfile
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
|
The change validation failure is unrelated, merging. |
|
credscan is not enabled by default anymore (it was replaced with 1ES Secret Scanning), before that credscan automatically respected the .config/CredScanSuppression.json so this should be a no-op now. @NikolaMilosavljevic can you link the place where you saw errors? |
This suppression method works in individual repos, i.e. This doesn't show in builds, only on s360 board. |
|
Hmm, |
|
/backport to release/10.0.1xx |
|
Started backporting to |
6 participants
CredScan suppressions file was checked in, but wasn't referenced in YML. This should fix issues in
source-build-reference-packages,aspnetcoreandmsbuild@wtgodbe @rainersigwald