microsoft / coe-starter-kit

Other
755 stars 225 forks source link

[ALM Accelerator - Feature]: Implementing Code Security Check Tools in ALM Accelerator Pipelines #7243

Open tomjosbin opened 11 months ago

tomjosbin commented 11 months ago

Is your feature request related to a problem? Please describe.

Hi Team,

It would be helpful if we can implement more code check tools part from Solution Checker.

For example SonarCube / Checkmarx or Apiiro could help.

This is important as the platform is evolving faster and we do have more components as well as vulnerabilities.

Describe the solution you'd like

Hi Team,

It would be helpful if we can implement more code check tools part from Solution Checker.

For example SonarCube / Checkmarx or Apiiro could help.

This is important as the platform is evolving faster and we do have more components as well as vulnerabilities.

Describe alternatives you've considered

No response

Additional context?

No response

AB#1713

mikefactorial commented 11 months ago

Hey @tomjosbin, thanks for the suggestion here. Some background and thoughts I have.

It's always been our thought that these types of additional checks would be implemented as hooks or more generically as what we've referred to as custom hook templates (https://github.com/microsoft/coe-alm-accelerator-templates/tree/main/Pipelines/Templates/Hooks/CustomTemplates). Since these, obviously, wouldn't be incorporated into the standard pipeline templates or the OOB hooks as they are specific to organizations' requirements. The idea of implementing a generic custom hook template that could be incorporated into a hook by ALM Accelerator users would open up a sort of library of things that could be contributed back to the ALM Accelerator by the community (i.e. someone builds a useful hook for their organization they may think of sharing it back to the ALM Accelerator as a custom hook template).

@RajeevPentyala a good place to start with this might be to create a generic hook template that can be hooked in on the PR build with just a simple example check (e.g. verify PR comment is > 100 characters or something trivial) and then others with specific checks could build off of that.