Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Attestation single project, recommendation & bug logging custom controls #13

Open
wants to merge 1 commit into
base: master
Choose a base branch
from
Open

Attestation single project, recommendation & bug logging custom controls #13

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
6 changes: 6 additions & 0 deletions 03-Addressing control failures/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -96,6 +96,8 @@ Attestation details for project and its components (build/release/service connec

> **Note:** Control attestation details for project and its components are stored inside the attestation repo present in the project.

> **Recommendation:** Attest controls for only one project in each scan command. If you have controls attested in multiple projects and if you scan these projects via the same command - attestation details of only the first project under scan will be respected.

> *Project Collection Administrator* needs to assign a project in the organization to host attestation details for organization-specific controls. See the next section for more details.

### How to setup attestation repository in a project?
Expand All @@ -105,6 +107,10 @@ In order to setup attestation repository inside a project, follow the below step
1. Navigate to *Repos* section of the project.
2. Create a new Git repository with the name 'ADOScannerAttestation'. Skip this step if this repository already exists.

### Setup signle project to store attestation
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

signle --> single

Single project to store attestation details can be configured in the organization policy.
In order to use single project to store attestatio set EnableMultiProjectAttestation true and ProjectToStoreAttestation "ProjectName" variables in the organization policy controlsettings.json file.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

attestatio ---> attestation

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

signle => single


### How to setup host project to store attestation details for organization-specific controls?

1. Host project to store attestation details for organization-specific controls can be set using a scan parameter named 'AttestationHostProjectName'. Before setting up the host project, ensure this project has 'ADOScanner_Attestation' repository setup.
Expand Down
4 changes: 4 additions & 0 deletions 07-Driving compliance via Bugs/Readme.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -169,6 +169,10 @@ Any bug that has been resolved before can be reactivated if the control failure
```
After setting any one of the above policies, commit the file and add an entry for *ControlSettings.json* in *ServerConfigMetadata.json* (in the repo).

## Customizing bug logging for certain controls

Bug only for specific list of controls can be controled by the organization policy using "CustomControlList". Add controls in the CustomControlList list and use "-AutoBugLog Custom" option in command parameter. It will run bug logging only for the controls which are added in the CustomControlList.
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

controled --> controlled

Bug logging can be restricted to specific controls using "CustomControlList" option in org policy . Add list of controls in the CustomControlList parameter and use "-AutoBugLog Custom" option in command parameter. It will run bug logging only for the controls which are added in the CustomControlList.


## Auto close bugs

Using the *-AutoBugLog* switch, the scanner also evaluates all the passing control scans and checks for their corresponding bugs in the ADO. If such bugs are found, they are closed. This ensures only those bugs remain in your ADO work item whose control failures are to be fixed.
Expand Down