search

microsoft / azure-pipelines-agent

Azure Pipelines Agent 🚀
MIT License
1.7k stars 857 forks source link

[enhancement]: Cleanup old bin and externals folders after successful agent update #4588

Open BryanAldrich opened 6 months ago

BryanAldrich commented 6 months ago

Describe your feature request here

This is separate from the _work folder cleanup maintenance tasks and pertains to the agent itself only.

Our security reviews flagged several bin/externals folders as containing vulnerable applications. These were found in folders no longer needed as the agent version had already updated and moved past them. However, I cannot find anything about a maintenance or cleanup task that runs to keep the agents tidy (like agent pools have for the _work folder).

I am running agent 3.232.1 agent on a self-hosted agents (3 full agents 20 or so deployment agents) with Azure DevOps server 2020 update 1.1

Thanks,

Bryan

kirill-ivlev commented 6 months ago

Hi @BryanAldrich , thanks for reporting and such amazing suggestion! We are working on more prioritized issues at the moment, but will get back to this one soon.

JtMotoX commented 3 months ago

Our agents are also getting flagged for multiple vulnerabilities, primarily log4j being present in the 2.x external directories.

NicolasDionB commented 2 months ago

Maybe this could be added to the scheduled maintenance job. We also would like to have this feature!