Skip to content

[release-branch.go1.27] pipeline: exclude stage 0 toolchain from Component Governance - #2495

Merged
George Adams (gdams) merged 1 commit into
microsoft/release-branch.go1.27from
dev/gadams/backport-cg-stage0-go1.27
Sep 4, 2026
Merged

[release-branch.go1.27] pipeline: exclude stage 0 toolchain from Component Governance#2495
George Adams (gdams) merged 1 commit into
microsoft/release-branch.go1.27from
dev/gadams/backport-cg-stage0-go1.27

Conversation

@gdams

Copy link
Copy Markdown
Member

Backport of #2494.

Summary

  • exclude the temporary, non-shipping Stage 0 Go bootstrap toolchain from Component Governance scans
  • regenerate the rolling internal pipeline YAML
  • avoid attributing bootstrap-toolchain findings such as CVE-2026-42508 to this repository

Validation

  • pwsh eng/run.ps1 pipelineymlgen
  • git diff --check HEAD^ HEAD

@gdams
George Adams (gdams) requested a review from a team as a code owner September 4, 2026 08:44
Copilot AI lite review requested due to automatic review settings September 4, 2026 08:44
@azure-pipelines

Copy link
Copy Markdown
Azure Pipelines:
Successfully started running 1 pipeline(s).
There may be pipelines that require an authorized user to comment /azp run to run.

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Copilot review overview

🟢 Approval recommended

The change is narrowly scoped to pipeline YAML configuration, matches the PR’s stated intent, and appears correctly nested within the existing SDL settings.

Review tier: Lite
Findings: None

What changed in this PR

Backports pipeline configuration to exclude the temporary Stage 0 bootstrap toolchain directory from Component Governance scanning in the internal rolling pipeline, preventing non-shipping toolchain findings from being attributed to this repository.

Changes:

  • Add a Component Governance ignoreDirectories entry for eng/artifacts/_goStage0 under SDL configuration.
  • Regenerate/update both the generated and checked-in internal rolling pipeline YAML files to keep them consistent.
File Description
eng/​pipeline/​rolling-internal.gen.yml Adds Component Governance ignore rule for the Stage 0 bootstrap toolchain directory in SDL settings.
eng/​pipeline/​rolling-internal-pipeline.yml Mirrors the same Component Governance ignore rule in the non-generated pipeline YAML.

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@gdams
George Adams (gdams) merged commit b65f947 into microsoft/release-branch.go1.27 Sep 4, 2026
21 of 57 checks passed
@gdams
George Adams (gdams) deleted the dev/gadams/backport-cg-stage0-go1.27 branch September 4, 2026 08:48
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants