script-module-compliance.yml

parameters:
  # component-governance
  sourceScanPath: '$(Build.SourcesDirectory)'
  # credscan
  suppressionsFile: ''
  # TermCheck
  targetArgument: '$(Build.SourcesDirectory)'
  optionsUEPATH: ''
  optionsRulesDBPath: ''
  optionsFTPath: ''
  # tsa-upload
  codeBaseName: ''
  # selections
  APIScan: true # set to false when not using Windows APIs.

steps:
- template: template-compliance/auto-applicability.yml

- template: template-compliance/component-governance.yml
  parameters:
    sourceScanPath: ${{ parameters.sourceScanPath }}

- template: template-compliance/credscan.yml
  parameters:
    suppressionsFile: ${{ parameters.suppressionsFile }}

- template: template-compliance/TermCheck.yml
  parameters:
    targetArgument: ${{ parameters.targetArgument }}
    optionsUEPATH: ${{ parameters.optionsUEPATH }}
    optionsRulesDBPath: ${{ parameters.optionsRulesDBPath }}
    optionsFTPath: ${{ parameters.optionsFTPath  }}

- template: template-compliance/vulnerability-assessment.yml

- template: template-compliance/publish-security-logs.yml

- template: template-compliance/tsa-upload.yml
  parameters:
    codeBaseName: ${{ parameters.codeBaseName }}

- template: template-compliance/sdtreport.yml
  parameters:
    APIScan: ${{ parameters.APIScan }}
    # script modules should not distribute binaries
    BinSkim: false
    CredScan: true
    TermCheck: true