From 0ef2620b5c84909749e778be1a2f13bf516a36cd Mon Sep 17 00:00:00 2001 From: Victoria Hall Date: Mon, 3 Aug 2026 11:44:03 -0500 Subject: [PATCH 1/6] add ex vulnerability --- eng/templates/jobs/build.yml | 2 ++ pyproject.toml | 1 + 2 files changed, 3 insertions(+) diff --git a/eng/templates/jobs/build.yml b/eng/templates/jobs/build.yml index b2cdab64..3304653f 100644 --- a/eng/templates/jobs/build.yml +++ b/eng/templates/jobs/build.yml @@ -4,6 +4,8 @@ jobs: strategy: matrix: + Python37: + PYTHON_VERSION: '3.7' Python310: PYTHON_VERSION: '3.10' Python311: diff --git a/pyproject.toml b/pyproject.toml index 42149240..bc99c116 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -23,6 +23,7 @@ classifiers = [ 'Development Status :: 5 - Production/Stable', ] dependencies = [ + "protobuf~=4.25.3; python_version < '3.13'", 'werkzeug~=3.1.3; python_version >= "3.9"', 'werkzeug~=3.0.6; python_version == "3.8"', 'werkzeug; python_version < "3.8"' From 00dc04b099ad54e8ec05805f50b429ccc8156936 Mon Sep 17 00:00:00 2001 From: Victoria Hall Date: Mon, 3 Aug 2026 12:04:19 -0500 Subject: [PATCH 2/6] add ex vulnerability pt2 --- eng/templates/jobs/build.yml | 2 -- 1 file changed, 2 deletions(-) diff --git a/eng/templates/jobs/build.yml b/eng/templates/jobs/build.yml index 3304653f..b2cdab64 100644 --- a/eng/templates/jobs/build.yml +++ b/eng/templates/jobs/build.yml @@ -4,8 +4,6 @@ jobs: strategy: matrix: - Python37: - PYTHON_VERSION: '3.7' Python310: PYTHON_VERSION: '3.10' Python311: From 81386e77557184c2bd388b510a4f6a97a7bd313d Mon Sep 17 00:00:00 2001 From: Victoria Hall Date: Mon, 3 Aug 2026 13:00:31 -0500 Subject: [PATCH 3/6] add ex vulnerability pt3 --- pyproject.toml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index bc99c116..61937785 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -23,7 +23,7 @@ classifiers = [ 'Development Status :: 5 - Production/Stable', ] dependencies = [ - "protobuf~=4.25.3; python_version < '3.13'", + "protobuf~=4.25.3", 'werkzeug~=3.1.3; python_version >= "3.9"', 'werkzeug~=3.0.6; python_version == "3.8"', 'werkzeug; python_version < "3.8"' From 58364984ec62090dd2bc6956e4c84801c986d769 Mon Sep 17 00:00:00 2001 From: Victoria Hall Date: Mon, 3 Aug 2026 15:23:42 -0500 Subject: [PATCH 4/6] why is cg like this --- eng/templates/jobs/build.yml | 1 + .../official/jobs/build-artifacts.yml | 1 + .../official/release/build-artifacts.yml | 5 ++- ...rate-component-governance-requirements.yml | 39 +++++++++++++++++++ 4 files changed, 45 insertions(+), 1 deletion(-) create mode 100644 eng/templates/steps/generate-component-governance-requirements.yml diff --git a/eng/templates/jobs/build.yml b/eng/templates/jobs/build.yml index b2cdab64..b05fda46 100644 --- a/eng/templates/jobs/build.yml +++ b/eng/templates/jobs/build.yml @@ -32,3 +32,4 @@ jobs: python -m pip install build python -m build displayName: 'Build Python SDK for $(PYTHON_VERSION)' + - template: /eng/templates/steps/generate-component-governance-requirements.yml@self diff --git a/eng/templates/official/jobs/build-artifacts.yml b/eng/templates/official/jobs/build-artifacts.yml index ba5af082..c11318d2 100644 --- a/eng/templates/official/jobs/build-artifacts.yml +++ b/eng/templates/official/jobs/build-artifacts.yml @@ -31,3 +31,4 @@ jobs: python -m pip install build python -m build displayName: 'Build Python SDK' + - template: /eng/templates/steps/generate-component-governance-requirements.yml@self diff --git a/eng/templates/official/release/build-artifacts.yml b/eng/templates/official/release/build-artifacts.yml index d05ec7ed..53287ede 100644 --- a/eng/templates/official/release/build-artifacts.yml +++ b/eng/templates/official/release/build-artifacts.yml @@ -72,4 +72,7 @@ jobs: python -m pip install build cd ${{ parameters.projectDirectory }} python -m build - displayName: 'Build ${{ parameters.projectDisplayName }}' \ No newline at end of file + displayName: 'Build ${{ parameters.projectDisplayName }}' + - template: /eng/templates/steps/generate-component-governance-requirements.yml@self + parameters: + projectDirectory: ${{ parameters.projectDirectory }} \ No newline at end of file diff --git a/eng/templates/steps/generate-component-governance-requirements.yml b/eng/templates/steps/generate-component-governance-requirements.yml new file mode 100644 index 00000000..f84287b0 --- /dev/null +++ b/eng/templates/steps/generate-component-governance-requirements.yml @@ -0,0 +1,39 @@ +parameters: + - name: projectDirectory + type: string + default: '.' + +steps: + - bash: | + if ! python -c "import tomllib" 2>/dev/null; then + python -m pip install tomli + fi + + python - <<'PY' + from pathlib import Path + + try: + import tomllib + except ModuleNotFoundError: + import tomli as tomllib + + pyproject = tomllib.loads(Path("pyproject.toml").read_text(encoding="utf-8")) + optional_dependencies = pyproject["project"].get("optional-dependencies", {}) + requirements = [ + *pyproject["build-system"].get("requires", []), + *pyproject["project"].get("dependencies", []), + *( + dependency + for group in optional_dependencies.values() + for dependency in group + ), + ] + requirements = list(dict.fromkeys(requirements)) + Path("requirements.txt").write_text( + "\n".join(requirements) + "\n", + encoding="utf-8", + ) + print(f"Generated requirements.txt with {len(requirements)} direct dependencies") + PY + displayName: 'Generate Component Governance requirements' + workingDirectory: $(Build.SourcesDirectory)/${{ parameters.projectDirectory }} \ No newline at end of file From c3961678b2141871ce338443f322355727ec61b8 Mon Sep 17 00:00:00 2001 From: Victoria Hall Date: Mon, 3 Aug 2026 15:33:33 -0500 Subject: [PATCH 5/6] FAIL --- eng/ci/library-release.yml | 5 +++++ eng/ci/official-build.yml | 5 +++++ eng/ci/public-build.yml | 4 ++++ 3 files changed, 14 insertions(+) diff --git a/eng/ci/library-release.yml b/eng/ci/library-release.yml index 9d7e1a25..202a7bd9 100644 --- a/eng/ci/library-release.yml +++ b/eng/ci/library-release.yml @@ -32,6 +32,11 @@ extends: name: 1es-pool-azfunc image: 1es-windows-2022 os: windows + sdl: + componentgovernance: + alertWarningLevel: Medium + failOnAlert: true + verbosity: Normal stages: - stage: ReleaseV1_BumpVersion diff --git a/eng/ci/official-build.yml b/eng/ci/official-build.yml index d4f4e9a7..b8077fad 100644 --- a/eng/ci/official-build.yml +++ b/eng/ci/official-build.yml @@ -38,6 +38,11 @@ extends: name: 1es-pool-azfunc image: 1es-windows-2022 os: windows + sdl: + componentgovernance: + alertWarningLevel: Medium + failOnAlert: true + verbosity: Normal stages: - stage: Build diff --git a/eng/ci/public-build.yml b/eng/ci/public-build.yml index 074d0eb9..1a51cf6d 100644 --- a/eng/ci/public-build.yml +++ b/eng/ci/public-build.yml @@ -36,6 +36,10 @@ extends: compiled: enabled: true # still only runs for default branch runSourceLanguagesInSourceAnalysis: true + componentgovernance: + alertWarningLevel: Medium + failOnAlert: true + verbosity: Normal settings: skipBuildTagsForGitHubPullRequests: ${{ variables['System.PullRequest.IsFork'] }} From 95f3381f73cc2417caa37511c533bed51e9c28b0 Mon Sep 17 00:00:00 2001 From: Victoria Hall Date: Mon, 3 Aug 2026 15:37:22 -0500 Subject: [PATCH 6/6] yay! --- pyproject.toml | 1 - 1 file changed, 1 deletion(-) diff --git a/pyproject.toml b/pyproject.toml index 61937785..42149240 100644 --- a/pyproject.toml +++ b/pyproject.toml @@ -23,7 +23,6 @@ classifiers = [ 'Development Status :: 5 - Production/Stable', ] dependencies = [ - "protobuf~=4.25.3", 'werkzeug~=3.1.3; python_version >= "3.9"', 'werkzeug~=3.0.6; python_version == "3.8"', 'werkzeug; python_version < "3.8"'