Pipelines: exclude in-repo .ps1 scripts from CodeSign post-analysis (#40541)
The Guardian CodeSign tool was scanning all .ps1 files in the source tree and failing the release build on diagnostic / dev / test helper scripts that aren't shipped (the OneBranch codesign targetGlob already restricts signing to .dll/.exe/.sys/.msi/.msix/.appx/.nupkg). Set ob_sdl_codeSignValidation_excludes to skip **\*.ps1 at the pipeline level for the release, nightly, and PR OneBranch pipelines, and combine with the existing testbin\** exclude in build-job.yml. Co-authored-by: Ben Hillis <benhill@ntdev.microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Ben Hillis committed
May 14, 2026 at 23:34 UTC
b011cf7785d4d89ff1aabbffa4b9ca7ff10a10ba
4 files changed
+4
-2
.pipelines/build-job.yml
+1
-2
@@ -70,8 +70,7 @@ jobs:
70
ob_artifactBaseName: 'drop_wsl'
71
ob_artifactSuffix: '${{ parameters.artifactSuffix }}'
72
packageStagingDir: '$(Build.SourcesDirectory)\packageStagingDir'
73
- ${{ if parameters.includeTestArtifacts }}:
74
- ob_sdl_codeSignValidation_excludes: -|**testbin\**
73
+ ob_sdl_codeSignValidation_excludes: -|**\*.ps1;-|**\testbin\**
74
${{ if parameters.includeCodeQL }}:
75
Codeql.PublishDatabaseLog: true
76
Codeql.SourceRoot: src
.pipelines/wsl-build-nightly-onebranch.yml
+1
@@ -11,6 +11,7 @@ schedules:
11
variables:
12
WindowsContainerImage: "onebranch.azurecr.io/windows/ltsc2022/vse2022:latest"
13
WindowsHostVersion: '1ESWindows2022'
14
+ ob_sdl_codeSignValidation_excludes: -|**\*.ps1
15
16
resources:
17
repositories:
.pipelines/wsl-build-pr-onebranch.yml
+1
@@ -7,6 +7,7 @@ trigger:
7
variables:
8
WindowsContainerImage: "onebranch.azurecr.io/windows/ltsc2022/vse2022:latest"
9
WindowsHostVersion: '1ESWindows2022'
10
+ ob_sdl_codeSignValidation_excludes: -|**\*.ps1
11
12
resources:
13
repositories:
.pipelines/wsl-build-release-onebranch.yml
+1
@@ -21,6 +21,7 @@ trigger:
21
variables:
22
WindowsContainerImage: "onebranch.azurecr.io/windows/ltsc2022/vse2022:latest"
23
WindowsHostVersion: '1ESWindows2022'
24
+ ob_sdl_codeSignValidation_excludes: -|**\*.ps1
25
26
resources:
27
repositories: