Add APIScan to SDL pipeline
Open
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 431
- Forks
- 44
- Avg merge
- 21h 18m
- Merged PRs (30d)
- 30
Description
An internal compliance item says we need to enable APIScan. https://devdiv.visualstudio.com/DevDiv/_wiki/wikis/DevDiv.wiki/32485/APIScan
Some prereqs:
- APIScan requires PDBs. (There may be more binary requirements that I don't know about.)
- Arcade might not handle it: https://github.com/dotnet/arcade/issues/7300
We may need to integrate PDB generation for our Go toolset binaries in an unusual way to get this scanning done.
Contributor guide
No contributing guide indexed for this repository
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the linked APIScan compliance guidance and the referenced Arcade issue. Determine the complete binary prerequisites beyond PDBs and how PDB generation for the Go toolset binaries would fit the SDL pipeline. Done means APIScan is enabled for the pipeline and the required binaries are successfully scanned.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- build-system, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100