When using 1ES pipeline templates (templates-official), every publish artifact execution triggers additional security scans. To reduce this overhead, you should gather all publishing outputs into the $(Build.ArtifactStagingDirectory) and utilize the 1ES outputParentDirectory feature.
Implementation Steps:
- Ensure all publish artifacts are located in
$(Build.ArtifactStagingDirectory). - Use the
templateContext.outputs parameter in templates-official/jobs/jobs.yml to define your outputs.
Note: Multiple outputs are only applicable to 1ES PT publishing (using templates-official).
# azure-pipelines.yml
extends:
template: azure-pipelines/MicroBuild.1ES.Official.yml@MicroBuildTemplate
parameters:
stages:
- stage: build
jobs:
- template: /eng/common/templates-official/jobs/jobs.yml@self
parameters:
# 1ES makes use of outputs to reduce security task injection overhead
templateContext:
outputs:
- output: pipelineArtifact
displayName: 'Publish logs from source'
continueOnError: true
condition: always()
targetPath: $(Build.ArtifactStagingDirectory)/artifacts/log
artifactName: Logs
jobs:
- job: Windows
steps:
- script: echo "friendly neighborhood" > artifacts/marvel/spiderman.txt
# copy build outputs to artifact staging directory for publishing
- task: CopyFiles@2
displayName: Gather build output
inputs:
SourceFolder: '$(System.DefaultWorkingDirectory)/artifacts/marvel'
Contents: '**'
TargetFolder: '$(Build.ArtifactStagingDirectory)/artifacts/marvel'