azsk / DevOpsKit

MIT License
222 stars 81 forks source link

Support AzSKARMTemplateChecker task on Ubuntu agent #1069

Open warner-aemo opened 4 years ago

warner-aemo commented 4 years ago

Title

Support AzSKARMTemplateChecker task on Ubuntu agent

Description

The Secure DevOps Kit (AzSK) CICD Extensions for Azure documentation does not explicitly require that it is run on a Windows agent, however attempting to run on ubuntu-latest results in an error.

We have been able to manually run the Get-AzSKARMTemplateSecurityStatus cmdlet on ubuntu-latest so I'm not sure why the extension is Windows only.

Steps to reproduce

Create a AzSKARMTemplateChecker to run on a ubuntu agent (microsoft-hosted)

stages:
- stage: Build
  jobs:
  - job: Check
    pool:
      vmImage: 'ubuntu-latest'
    steps:
       - task: AzSKARMTemplateChecker@4
         inputs:
           ARMTemplateFilePath: 'arm-templates/cosmosdb.json'
           ARMTemplateParameterFilePath: 'arm-templates/cosmosdb-params.json'
           Recurse: false

Expected behavior

Expected the task to run successfully.

Actual behavior

2020-06-05T07:10:37.0356854Z ##[section]Starting: AzSKARMTemplateChecker
2020-06-05T07:10:37.0364519Z ==============================================================================
2020-06-05T07:10:37.0364898Z Task         : AzSK ARM Template Checker
2020-06-05T07:10:37.0365221Z Description  : Scan ARM templates for security issues using AzSK.
2020-06-05T07:10:37.0365516Z Version      : 4.0.3
2020-06-05T07:10:37.0365761Z Author       : Microsoft Corporation
2020-06-05T07:10:37.0366105Z Help         : [More Information](http://aka.ms/azskossdocs)
2020-06-05T07:10:37.0366467Z ==============================================================================
2020-06-05T07:10:37.0517333Z ##[error]The current operating system is not capable of running this task. That typically means the task was written for Windows only. For example, written for Windows Desktop PowerShell.
2020-06-05T07:10:37.0531160Z ##[section]Finishing: AzSKARMTemplateChecker
MichaelGuiney-BE commented 3 years ago

Agree. It would be great if linux agents were supported for CI/CD pipelines.