Update Guardian to latest

eng/common/sdl/sdl.ps1

@@ -0,0 +1,37 @@
+
+function Install-Gdn {
+    param(
+        [string]$Path,
+
+        # If omitted, install the latest version of Guardian, otherwise install that specific version.
+        [string]$Version
+    )
+
+    $ErrorActionPreference = 'Stop'
+    Set-StrictMode -Version 2.0
+    $disableConfigureToolsetImport = $true
+    $global:LASTEXITCODE = 0
+
+    # `tools.ps1` checks $ci to perform some actions. Since the SDL
+    # scripts don't necessarily execute in the same agent that run the
+    # build.ps1/sh script this variable isn't automatically set.
+    $ci = $true
+    . $PSScriptRoot\..\tools.ps1
+
+    $argumentList = @("install", "Microsoft.Guardian.Cli", "-Version $Version", "-Source https://securitytools.pkgs.visualstudio.com/_packaging/Guardian/nuget/v3/index.json", "-OutputDirectory $Path", "-NonInteractive", "-NoCache")
+
+    if ($Version) {
+        $argumentList += "-Version $Version"
+    }
+
+    Start-Process nuget -Verbose -ArgumentList $argumentList -NoNewWindow -Wait
+
+    $gdnCliPath = Get-ChildItem -Filter guardian.cmd -Recurse -Path $Path
+
+    if (!$gdnCliPath)
+    {
+        Write-PipelineTelemetryError -Category 'Sdl' -Message 'Failure installing Guardian'
+    }
+
+    return $gdnCliPath.FullName
+}

eng/common/templates/job/execute-sdl.yml

@@ -37,12 +37,6 @@ jobs:
   condition: eq( ${{ parameters.enable }}, 'true')
   variables:
     - group: DotNet-VSTS-Bot
-    - name: AzDOProjectName
-      value: ${{ parameters.AzDOProjectName }}
-    - name: AzDOPipelineId
-      value: ${{ parameters.AzDOPipelineId }}
-    - name: AzDOBuildId
-      value: ${{ parameters.AzDOBuildId }}
     - template: /eng/common/templates/variables/sdl-variables.yml
     - name: GuardianVersion
       value: ${{ coalesce(parameters.overrideGuardianVersion, '$(DefaultGuardianVersion)') }}

eng/common/templates/post-build/post-build.yml

@@ -236,9 +236,9 @@ stages:
       parameters:
         enable: ${{ parameters.SDLValidationParameters.enable }}
         additionalParameters: ${{ parameters.SDLValidationParameters.params }}
-        continueOnError: ${{ parameters.SDLValidationParameters.continueOnError }}
+        sdlContinueOnError: ${{ parameters.SDLValidationParameters.continueOnError }}
         artifactNames: ${{ parameters.SDLValidationParameters.artifactNames }}
-        downloadArtifacts: ${{ parameters.SDLValidationParameters.downloadArtifacts }}
+        downloadArtifacts: ${{ coalesce(parameters.SDLValidationParameters.downloadArtifacts, 'false') }}
 
 - ${{ if ne(parameters.publishAssetsImmediately, 'true') }}:
   - stage: publish_using_darc

eng/common/templates/steps/execute-codeql.yml

@@ -1,24 +1,50 @@
 parameters:
   # Language that should be analyzed. Defaults to csharp
-  language: csharp
+  - name: language
+    displayName: Analysis language
+    type: string
+    default: csharp
+
   # Build Commands
-  buildCommands: ''
-  overrideParameters: ''                                       # Optional: to override values for parameters.
-  additionalParameters: ''                                     # Optional: parameters that need user specific values eg: '-SourceToolsList @("abc","def") -ArtifactToolsList @("ghi","jkl")'
+  - name: buildCommands
+    type: string
+    default: ''
+
+  # Optional: to override values for parameters.
+  - name: overrideParameters
+    type: string
+    default: ''
+
+  # Optional: parameters that need user specific values eg: '-SourceToolsList @("abc","def") -ArtifactToolsList @("ghi","jkl")'
+  - name: additionalParameters
+    type: string
+    default: ''
+
   # Optional: if specified, restore and use this version of Guardian instead of the default.
-  overrideGuardianVersion: ''
+  - name: overrideGuardianVersion
+    type: string
+    default: ''
+
   # Optional: if true, publish the '.gdn' folder as a pipeline artifact. This can help with in-depth
   # diagnosis of problems with specific tool configurations.
-  publishGuardianDirectoryToPipeline: false
+  - name: publishGuardianDirectoryToPipeline
+    type: boolean
+    default: false
+
   # The script to run to execute all SDL tools. Use this if you want to use a script to define SDL
   # parameters rather than relying on YAML. It may be better to use a local script, because you can
   # reproduce results locally without piecing together a command based on the YAML.
-  executeAllSdlToolsScript: 'eng/common/sdl/execute-all-sdl-tools.ps1'
+  - name: executeAllSdlToolsScript
+    type: string
+    default: 'eng/common/sdl/execute-all-sdl-tools.ps1'
+
   # There is some sort of bug (has been reported) in Azure DevOps where if this parameter is named
   # 'continueOnError', the parameter value is not correctly picked up.
   # This can also be remedied by the caller (post-build.yml) if it does not use a nested parameter
   # optional: determines whether to continue the build if the step errors;
-  sdlContinueOnError: false
+  - name: sdlContinueOnError
+    type: boolean
+    default: false
 
 steps:
 - template: /eng/common/templates/steps/execute-sdl.yml

eng/common/templates/steps/execute-sdl.yml

@@ -8,29 +8,27 @@ parameters:
   condition: ''
 
 steps:
-- ${{ if ne(parameters.overrideGuardianVersion, '') }}:
-  - powershell: |
-      $content = Get-Content $(GuardianPackagesConfigFile)
 
-      Write-Host "packages.config content was:`n$content"
+- task: NuGetAuthenticate@1
+  inputs:
+    nuGetServiceConnections: GuardianConnect
 
-      $content = $content.Replace('$(DefaultGuardianVersion)', '$(GuardianVersion)')
-      $content | Set-Content $(GuardianPackagesConfigFile)
+- task: NuGetToolInstaller@1
+  displayName: Install NuGet.exe
 
-      Write-Host "packages.config content updated to:`n$content"
-    displayName: Use overridden Guardian version ${{ parameters.overrideGuardianVersion }}
+- ${{ if ne(parameters.overrideGuardianVersion, '') }}:
+  - pwsh: |
+      . $(Build.SourcesDirectory)\eng\common\sdl\sdl.ps1
+      $guardianCliLocation = Install-Gdn -Path $(Build.SourcesDirectory)\.artifacts -Version ${{ parameters.overrideGuardianVersion }}
+      Write-Host "##vso[task.setvariable variable=GuardianCliLocation]$guardianCliLocation"
+    displayName: Install Guardian (Overridden)
 
-- task: NuGetToolInstaller@1
-  displayName: 'Install NuGet.exe'
-
-- task: NuGetCommand@2
-  displayName: 'Install Guardian'
-  inputs:
-    restoreSolution: $(Build.SourcesDirectory)\eng\common\sdl\packages.config
-    feedsToUse: config
-    nugetConfigPath: $(Build.SourcesDirectory)\eng\common\sdl\NuGet.config
-    externalFeedCredentials: GuardianConnect
-    restoreDirectory: $(Build.SourcesDirectory)\.packages
+- ${{ if eq(parameters.overrideGuardianVersion, '') }}:
+  - pwsh: |
+      . $(Build.SourcesDirectory)\eng\common\sdl\sdl.ps1
+      $guardianCliLocation = Install-Gdn -Path $(Build.SourcesDirectory)\.artifacts
+      Write-Host "##vso[task.setvariable variable=GuardianCliLocation]$guardianCliLocation"
+    displayName: Install Guardian
 
 - ${{ if ne(parameters.overrideParameters, '') }}:
   - powershell: ${{ parameters.executeAllSdlToolsScript }} ${{ parameters.overrideParameters }}
@@ -40,7 +38,7 @@ steps:
 
 - ${{ if eq(parameters.overrideParameters, '') }}:
   - powershell: ${{ parameters.executeAllSdlToolsScript }}
-      -GuardianPackageName Microsoft.Guardian.Cli.$(GuardianVersion)
+      -GuardianCliLocation $(GuardianCliLocation)
       -NugetPackageDirectory $(Build.SourcesDirectory)\.packages
       -AzureDevOpsAccessToken $(dn-bot-dotnet-build-rw-code-rw)
       ${{ parameters.additionalParameters }}