search

microsoft / security-devops-azdevops

Microsoft Security DevOps extension for Azure DevOps.
MIT License
60 stars 16 forks source link

Execution of pipeline with security devops -task fails if Node6 tasks disabled #44

Open JanneRantala opened 1 year ago

JanneRantala commented 1 year ago

Our organization has "Disable Node6 tasks" turned on for security reasons at organization level. With this turned on, pipeline won't even start execution because of an error which says

"The pipeline is not valid. Job Job: Step 'MicrosoftSecurityDevOps' references task 'MicrosoftSecurityDevOps' at version '1.6.0' contains an execution handler that relies on NodeJS version '6' which is restricted by your administrator."

dotpaul commented 1 year ago

Should be fixed with #34; please let @davidknise know if not

JanneRantala commented 1 year ago

@davidknise This is still an issue in version 1.7.1

The pipeline is not valid. Job Job: Step 'MicrosoftSecurityDevOps' references task 'MicrosoftSecurityDevOps' at version '1.7.1' contains an execution handler that relies on NodeJS version '6' which is restricted by your administrator.

JanneRantala commented 10 months ago

When we could expect a fix for this, @dotpaul @davidknise? Issue still exists with latest 1.8.0 release.

koesper commented 8 months ago

Still an issue, in 1.10.0 ?

JanneRantala commented 8 months ago

Still an issue, in 1.10.0 ?

Yes:

"The pipeline is not valid. Job Job: Step 'MicrosoftSecurityDevOps' references task 'MicrosoftSecurityDevOps' at version '1.10.0' contains an execution handler that relies on NodeJS version '6' which is restricted by your administrator."

JanneRantala commented 7 months ago

Could someone from Microsoft give some estimate when this would be fixed? @dotpaul? @davidknise? Someone? After several months this is still an issue and currently blocks our use of this feature.

yo1-markenstein commented 4 months ago

With version 1.11.1 the issue still exist. Can't use this task in our organization. Note that nodejs 6 is disabled for security reasons (should be of interest for a security scan task)

reynoldsa commented 3 months ago

Looking into this. We have a theory.

EDIT: issue is confirmed. Looking at a workaround to publish.

reynoldsa commented 3 months ago

Mistakenly closed before release.

reynoldsa commented 3 months ago

This should be fixed now. Please try any failing pipelines again. I will close this issue in a week if there are no further reports.

rantalajanne commented 3 months ago

Can confirm, it's working now. Thanks, @reynoldsa & others!

koesper commented 3 months ago

any idea when the new release is coming? If i understand correctly, this should be fixed in v1.12.1, current release is still v1.11.0

JanneRantala commented 3 months ago

is there a new release coming then?

or should we try v1.11.0?

Version 1.12.1 fixes the problem, it was released yesterday/today.

yo1-markenstein commented 3 months ago

Awesome, working here too. 👌 Thanks @reynoldsa