Fix release build codesign failure by scoping targetGlob to binaries (#40324)
The OneBranch Official template's Guardian codesign validation defaults to scanning .ps1/.psm1/.vbs/.js scripts, which causes 14 CodeSign.MissingSigningCert errors on unsigned tool/test scripts. Restrict codesign.targetGlob to only signed binary and package extensions (.dll, .exe, .sys, .msi, .msix, .msixbundle, .appx, .nupkg). Co-authored-by: Ben Hillis <benhill@ntdev.microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Ben Hillis committed
Apr 27, 2026 at 16:07 UTC
45622c654e2c10c73b81efeba5236a772446f870
1 file changed
+4
.pipelines/wsl-build-release-onebranch.yml
+4
@@ -35,6 +35,10 @@ extends:
35
globalSdl:
36
credscan:
37
enabled: true
38
+ codesign:
39
+ enabled: true
40
+ break: true
41
+ targetGlob: '**\*.dll;**\*.exe;**\*.sys;**\*.msi;**\*.msix;**\*.msixbundle;**\*.appx;**\*.nupkg'
42
perStage:
43
credscan:
44
enabled: true