release/vNext

.github/workflows/on-push-verification.yml

@@ -1,29 +1,25 @@
 # pull request action verification
 
-name: MSDO on-push-verification windows-latest
-on: push
+name: MSDO On Push Verification
+on:
+  push:
+    branches:
+      - '*'
 
 jobs:
   sample:
-    name: Microsoft Security DevOps Analysis
+    name: MSDO on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
 
-    # MSDO runs on windows-latest.
-    # ubuntu-latest and macos-latest supporting coming soon
-    runs-on: windows-latest
+    strategy:
+      matrix:
+        os: [windows-latest, ubuntu-latest]
 
     steps:
 
       # Checkout your code repository to scan
     - uses: actions/checkout@v3
 
-      # Install dotnet, used by MSDO
-    - uses: actions/setup-dotnet@v3
-      with:
-        dotnet-version: |
-          3.1.x
-          5.0.x
-          6.0.x
-
       # Run analyzers
     - name: Run Microsoft Security DevOps Analysis
       uses: ./

.github/workflows/sample-workflow-ubuntu-latest.yml → .github/workflows/sample-workflow.yml

@@ -1,33 +1,26 @@
-name: MSDO ubuntu-latest
+name: MSDO Sample Workflow
 on:
   push:
     branches:
       - main
 
 jobs:
   sample:
-    name: Microsoft Security DevOps Analysis
+    name: MSDO on ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
 
-    # MSDO runs on windows-latest.
-    # ubuntu-latest and macos-latest supporting coming soon
-    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        os: [windows-latest, ubuntu-latest]
 
     steps:
 
       # Checkout your code repository to scan
     - uses: actions/checkout@v3
 
-      # Install dotnet, used by MSDO
-    - uses: actions/setup-dotnet@v3
-      with:
-        dotnet-version: |
-          3.1.x
-          5.0.x
-          6.0.x
-
       # Run analyzers
     - name: Run Microsoft Security DevOps Analysis
-      uses: microsoft/security-devops-action@preview
+      uses: microsoft/security-devops-action@v1
       id: msdo
 
       # Upload alerts to the Security tab

.npmrc

@@ -0,0 +1,2 @@
+registry=https://registry.npmjs.org/
+@microsoft:registry=https://npm.pkg.github.com/

README.md

@@ -4,8 +4,7 @@ Microsoft Security DevOps (MSDO) is a command line application which integrates
 
 Run locally. Run remotely.
 
-![Microsoft Security DevOps windows-latest](https://github.com/microsoft/security-devops-action/workflows/MSDO%20windows-latest/badge.svg)  
-![Microsoft Security DevOps ubuntu-latest](https://github.com/microsoft/security-devops-action/workflows/MSDO%20ubuntu-latest/badge.svg)
+![Microsoft Security DevOps](https://github.com/microsoft/security-devops-action/workflows/MSDO%20Sample%20Workflow/badge.svg)  
 
 This action runs the [Microsoft Security DevOps CLI](https://aka.ms/msdo-nuget) for security analysis:
 
@@ -17,10 +16,6 @@ This action runs the [Microsoft Security DevOps CLI](https://aka.ms/msdo-nuget)
 * Normalized processing of results into the SARIF format
 * Build breaks and more
 
-# Limitations
-
-The Microsoft Security DevOps action is currently in beta and runs on the `windows-latest` queue, as well as Windows self hosted agents. `ubuntu-latest` support coming soon.
-
 # Usage
 
 See [action.yml](action.yml)
@@ -31,19 +26,12 @@ Run **Microsoft Security DevOps (MSDO)** with the default policy and recommended
 
 ```yaml
 steps:
+
 - uses: actions/checkout@v3
-- uses: actions/setup-dotnet@v3
-  with:
-    dotnet-version: |
-      5.0.x
-      6.0.x
+
 - name: Run Microsoft Security DevOps
-  uses: microsoft/security-devops-action@preview
+  uses: microsoft/security-devops-action@v1
   id: msdo
-- name: Upload results to Security tab
-  uses: github/codeql-action/upload-sarif@v2
-  with:
-    sarif_file: ${{ steps.msdo.outputs.sarifFile }}
 ```
 
 ## Upload Results to the Security tab

gulpfile.js

@@ -0,0 +1,24 @@
+const gulp = require('gulp');
+const shell = require('gulp-shell');
+const ts = require('gulp-typescript');
+
+const tsProject = ts.createProject('tsconfig.json');
+
+function clean(cb) {
+    import('del')
+        .then((del) => del.deleteSync(['lib']))
+        .then(() => cb());
+}
+
+function compile(cb) {
+    tsProject
+        .src()
+        .pipe(tsProject()).js
+        .pipe(gulp.dest('lib'));
+    cb();
+}
+
+exports.clean = clean;
+exports.compile = compile;
+exports.build = gulp.series(clean, compile);
+exports.default = exports.build;