@samitouri / QOSAMI-WSL-1 / commits / e351f325

Fix recurring TSA onboarding failure in release builds (#41167)

The 1ES Official governed template (v2/Microsoft.Official.yml) force-runs the TSA onboard/upload step even though globalSdl.tsa.enabled was false. With no tsaoptions.json, TSA auto-derives the codebase name 'microsoft_Microsoft.WSL_microsoft/WSL', which contains the illegal characters '.' and '/'. Onboarding therefore fails with PreconditionFailed and 'Guardian exited with an error exit code: 1' on every release build. Add .config/tsaoptions.json with an explicit, sanitized codebase name and wire the release pipeline's globalSdl.tsa to consume it via configFile. Bugs are routed to the WSL area path in the OS project. Co-authored-by: Ben Hillis <benhill@ntdev.microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: aa582972-8aa3-43c9-9fe3-6a9ff2bc1ab2

Ben Hillis committed Jul 24, 2026 at 11:45 UTC e351f325f3733e2ac57fcebb4cc48145670dde0b
2 files changed +18 -1
.config/tsaoptions.json new
+12
@@ -0,0 +1,12 @@
1 +{
2 + "codebaseName": "microsoft_WSL",
3 + "serviceTreeID": "d8846bef-e9b5-4542-bcfc-98ebabac8a7b",
4 + "instanceUrl": "https://microsoft.visualstudio.com/",
5 + "projectName": "OS",
6 + "areaPath": "OS\\Core\\Base\\VMAC - Virtual Machines and Containers\\LOW-Linux on Windows\\WSL",
7 + "notificationAliases": [
8 + "wslteam@microsoft.com"
9 + ],
10 + "validateToolOutput": "None",
11 + "allTools": true
12 +}
.pipelines/wsl-build-release-onebranch.yml
+6 -1
@@ -53,7 +53,12 @@ extends:
53 credscan:
54 enabled: true
55 tsa:
56 - enabled: false
56 + # The 1ES Official governed template force-runs TSA onboarding regardless of this flag.
57 + # Without a config file it auto-derives the codebase name "microsoft_Microsoft.WSL_microsoft/WSL",
58 + # which contains the illegal characters '.' and '/', so onboarding fails with PreconditionFailed
59 + # and breaks every release build. Point TSA at an explicit, sanitized codebase config instead.
60 + enabled: true
61 + configFile: $(Build.SourcesDirectory)\.config\tsaoptions.json
62 evidence:
63 enabled: false
64 git: