Skip to content

Commit 2f40aae

Browse files
authored
Add branch export (#80)
* Add branch export
1 parent 674be99 commit 2f40aae

24 files changed

Lines changed: 830 additions & 133 deletions
Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
Branch strategy based suppression
2+
=================================
3+
4+
Using PSRule suppression groups for branch strategies.
5+
------------------------------------------------------
6+
7+
Since version 0.4.0 PSRule.Rules.AzureDevOps exports all branches
8+
for a repository and inspects them with the full set of rules. Under
9+
normal circumstances, you don't want to run all rules against all
10+
branches. You will typically want users to work in feature branches that
11+
do not have the same requirements as the main, release or your custom
12+
branches.
13+
14+
PSRule offers a feature called suppression groups that allows you to
15+
suppress rules for _targets_, in our case branches. This allows you to
16+
define a set of suppression groups that can be applied to branches
17+
based on a branch name pattern.
18+
19+
For example, you can define a suppression group called `feature` that
20+
suppresses all rules for branches that start with `refs/heads/feature/`.
21+
Place the file in the root from where you run PSRule with an extension
22+
of `.Rule.yaml`.
23+
24+
``` yaml
25+
---
26+
# Synopsis: Feature branch does not need protection
27+
apiVersion: github.com/microsoft/PSRule/v1
28+
kind: SuppressionGroup
29+
metadata:
30+
name: 'feature'
31+
spec:
32+
expiresOn: null
33+
rule:
34+
- 'Azure.DevOps.Repo.Branch.HasBranchPolicy'
35+
if:
36+
name: '.'
37+
contains: 'refs/heads/feature/'
38+
```
39+
40+
The synopsis is optional and can be used to describe
41+
the suppression group. It will be displayed when running
42+
PSRule as the suppression group is applied. Read more on suppression
43+
groups in the [PSRule documentation](https://microsoft.github.io/PSRule/v2/concepts/PSRule/en-US/about_PSRule_SuppressionGroups/).

src/PSRule.Rules.AzureDevOps/Functions/DevOps.Repos.ps1

Lines changed: 72 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -42,6 +42,55 @@ Function Get-AzDevOpsRepos {
4242
Export-ModuleMember -Function Get-AzDevOpsRepos
4343
# End of Function Get-AzDevOpsRepos
4444

45+
<#
46+
.SYNOPSIS
47+
Get Azure DevOps branches for a repo
48+
49+
.DESCRIPTION
50+
Get Azure DevOps branches for a repo using Azure DevOps Rest API
51+
52+
.PARAMETER Project
53+
Project name for Azure DevOps
54+
55+
.PARAMETER Repository
56+
Repository name for Azure DevOps
57+
58+
.EXAMPLE
59+
Get-AzDevOpsBranches -Project $Project -Repository $Repository
60+
#>
61+
Function Get-AzDevOpsBranches {
62+
[CmdletBinding()]
63+
[OutputType([System.Object[]])]
64+
param (
65+
[Parameter(Mandatory)]
66+
[string]
67+
$Project,
68+
[Parameter(Mandatory)]
69+
[string]
70+
$Repository
71+
)
72+
if ($null -eq $script:connection) {
73+
throw "Not connected to Azure DevOps. Run Connect-AzDevOps first"
74+
}
75+
$Organization = $script:connection.Organization
76+
$header = $script:connection.GetHeader()
77+
Write-Verbose "Getting branches for repo $Repository in project $Project"
78+
$uri = "https://dev.azure.com/$Organization/_apis/git/repositories/$Repository/refs?filter=heads&api-version=7.2-preview.2"
79+
Write-Verbose "URI: $uri"
80+
try {
81+
$response = Invoke-RestMethod -Uri $uri -Method Get -Headers $header
82+
# If the response is a string and not an object, throw an exception for authentication failure or project not found
83+
if ($response -is [string]) {
84+
throw "Authentication failed or project not found"
85+
}
86+
}
87+
catch {
88+
throw $_.Exception.Message
89+
}
90+
return @($response.value)
91+
}
92+
Export-ModuleMember -Function Get-AzDevOpsBranches
93+
4594
<#
4695
.SYNOPSIS
4796
Get Azure DevOps branch policy for a branch in a repo
@@ -381,6 +430,26 @@ function Export-AzDevOpsReposAndBranchPolicies {
381430
$readmeExists = ((Test-AzDevOpsFileExists -Project $Project -Repository $repo.id -Path "README.md") -or (Test-AzDevOpsFileExists -Project $Project -Repository $repo.id -Path "README"))
382431
$repo | Add-Member -MemberType NoteProperty -Name ReadmeExists -Value $readmeExists
383432

433+
# Get all branches for the repo
434+
$branches = Get-AzDevOpsBranches -Project $Project -Repository $repo.id
435+
# add branch policies for each branch to the branches object
436+
$branches = $branches | ForEach-Object {
437+
$branch = $_
438+
$branchPolicy = @(Get-AzDevOpsBranchPolicy -Project $Project -Repository $repo.id -Branch $branch.name)
439+
$branch | Add-Member -MemberType NoteProperty -Name BranchPolicy -Value $branchPolicy
440+
$branch
441+
}
442+
# Add an ObjectType Azure.DevOps.Repo.Branch to each branch object
443+
$branches = $branches | ForEach-Object {
444+
$branch = $_
445+
$branch | Add-Member -MemberType NoteProperty -Name ObjectType -Value "Azure.DevOps.Repo.Branch"
446+
# Add ObjectName to branch object
447+
$branch | Add-Member -MemberType NoteProperty -Name ObjectName -Value ("{0}.{1}.{2}.{3}" -f $Organization,$Project,$repo.name,$branch.name)
448+
$branch
449+
}
450+
451+
452+
384453
# Add a property indicating if a file named LICENSE or LICENSE.md exists in the repo
385454
$licenseExists = ((Test-AzDevOpsFileExists -Project $Project -Repository $repo.id -Path "LICENSE") -or (Test-AzDevOpsFileExists -Project $Project -Repository $repo.id -Path "LICENSE.md"))
386455
$repo | Add-Member -MemberType NoteProperty -Name LicenseExists -Value $licenseExists
@@ -404,8 +473,9 @@ function Export-AzDevOpsReposAndBranchPolicies {
404473
}
405474

406475
# Export repo object to JSON file
407-
Write-Verbose "Exporting repo $($repo.name) to JSON as file $($repo.name).ado.repo.json"
408-
$repo | ConvertTo-Json -Depth 100 | Out-File -FilePath "$OutputPath\$($repo.name).ado.repo.json"
476+
Write-Verbose "Exporting repo $($repo.name) and its branches to JSON as file $($repo.name).ado.repo.json"
477+
$branches += $repo
478+
$branches | ConvertTo-Json -Depth 100 | Out-File -FilePath "$OutputPath\$($repo.name).ado.repo.json"
409479
}
410480
}
411481
}

src/PSRule.Rules.AzureDevOps/en/Azure.DevOps.Repos.BranchPolicyAllowSelfApproval.md renamed to src/PSRule.Rules.AzureDevOps/en/Azure.DevOps.Repos.Branch.BranchPolicyAllowSelfApproval.md

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,20 +1,20 @@
11
---
22
category: Microsoft Azure DevOps Repos
33
severity: Critical
4-
online version: https://github.com/cloudyspells/PSRule.Rules.AzureDevOps/blob/main/src/PSRule.Rules.AzureDevOps/en/AzureDevOps.Repos.BranchPolicyAllowSelfApproval.md
4+
online version: https://github.com/cloudyspells/PSRule.Rules.AzureDevOps/blob/main/src/PSRule.Rules.AzureDevOps/en/Azure.DevOps.Repos.Branch.BranchPolicyAllowSelfApproval.md
55
---
66

7-
# AzureDevOps.Repos.BranchPolicyAllowSelfApproval
7+
# Azure.DevOps.Repos.Branch.BranchPolicyAllowSelfApproval
88

99
## SYNOPSIS
1010

1111
Change authors should not be allowed to approve their own changes.
1212

1313
## DESCRIPTION
1414

15-
The branch policy should not allow creators to approve their own changes.
16-
This will help ensure that the code in the default branch is of a high quality
17-
and that the team's Git workflow is followed.
15+
The branch policy should not allow creators to approve
16+
their own changes. This will help ensure that the code in the default branch
17+
is of a high quality and that the team's Git workflow is followed.
1818

1919
Mininum TokenType: `ReadOnly`
2020

src/PSRule.Rules.AzureDevOps/en/Azure.DevOps.Repos.BranchPolicyCommentResolution.md renamed to src/PSRule.Rules.AzureDevOps/en/Azure.DevOps.Repos.Branch.BranchPolicyCommentResolution.md

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,14 +1,15 @@
11
---
22
category: Microsoft Azure DevOps Repos
33
severity: Important
4-
online version: https://github.com/cloudyspells/PSRule.Rules.AzureDevOps/blob/main/src/PSRule.Rules.AzureDevOps/en/Azure.DevOps.Repos.BranchPolicyCommentResolution.md
4+
online version: https://github.com/cloudyspells/PSRule.Rules.AzureDevOps/blob/main/src/PSRule.Rules.AzureDevOps/en/Azure.DevOps.Repos.Branch.BranchPolicyCommentResolution.md
55
---
66

7-
# Azure.DevOps.Repos.BranchPolicyCommentResolution
7+
# Azure.DevOps.Repos.Branch.BranchPolicyCommentResolution
88

99
## SYNOPSIS
1010

11-
A policy should be configured to require comments for pull requests to be resolved.
11+
A policy should be configured to require comments for pull requests to be
12+
resolved.
1213

1314
## DESCRIPTION
1415

src/PSRule.Rules.AzureDevOps/en/Azure.DevOps.Repos.BranchPolicyEnforceLinkedWorkItems.md renamed to src/PSRule.Rules.AzureDevOps/en/Azure.DevOps.Repos.Branch.BranchPolicyEnforceLinkedWorkItems.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
---
22
category: Microsoft Azure DevOps Repos
33
severity: Informational
4-
online version: https://github.com/cloudyspells/PSRule.Rules.AzureDevOps/blob/main/src/PSRule.Rules.AzureDevOps/en/Azure.DevOps.Repos.BranchPolicyEnforceLinkedWorkItems.md
4+
online version: https://github.com/cloudyspells/PSRule.Rules.AzureDevOps/blob/main/src/PSRule.Rules.AzureDevOps/en/Azure.DevOps.Repos.Branch.BranchPolicyEnforceLinkedWorkItems.md
55
---
66

7-
# Azure.DevOps.Repos.BranchPolicyEnforceLinkedWorkItems
7+
# Azure.DevOps.Repos.Branch.BranchPolicyEnforceLinkedWorkItems
88

99
## SYNOPSIS
1010

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
---
2+
category: Microsoft Azure DevOps Repos
3+
severity: Critical
4+
online version: https://github.com/cloudyspells/PSRule.Rules.AzureDevOps/blob/main/src/PSRule.Rules.AzureDevOps/en/Azure.DevOps.Repos.Branch.BranchPolicyIsEnabled.md
5+
---
6+
7+
# Azure.DevOps.Repos.Branch.BranchPolicyIsEnabled
8+
9+
## SYNOPSIS
10+
11+
The repository's branch should have a branch policy enabled.
12+
13+
## DESCRIPTION
14+
15+
A branch policy is a set of rules that govern the quality of the code and
16+
the team's Git workflow. Branch policies can enforce your team's code quality
17+
and change management standards. They can also help your team find and fix
18+
bugs earlier in the development cycle.
19+
20+
A branch policy can be enabled for the default branch of a repository. This
21+
will help ensure that the code in the default branch is of a high quality and
22+
that the team's Git workflow is followed.
23+
24+
Mininum TokenType: `ReadOnly`
25+
26+
## RECOMMENDATION
27+
28+
Make sure that the branch policy is enabled for the default branch of your
29+
repository. This will help ensure that the code in the default branch is of
30+
a high quality and that the team's Git workflow is followed.
31+
32+
## LINKS
33+
34+
- [Create a branch policy](https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops)
35+
- [Branch policies](https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies-overview?view=azure-devops)
36+
- [Azure DevOps Security best practices](https://learn.microsoft.com/en-us/azure/devops/organizations/security/security-best-practices?view=azure-devops#secure-azure-repos)

src/PSRule.Rules.AzureDevOps/en/Azure.DevOps.Repos.BranchPolicyMergeStrategy.md renamed to src/PSRule.Rules.AzureDevOps/en/Azure.DevOps.Repos.Branch.BranchPolicyMergeStrategy.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
---
22
category: Microsoft Azure DevOps Repos
33
severity: Important
4-
online version: https://github.com/cloudyspells/PSRule.Rules.AzureDevOps/blob/main/src/PSRule.Rules.AzureDevOps/en/Azure.DevOps.Repos.BranchPolicyMergeStrategy.md
4+
online version: https://github.com/cloudyspells/PSRule.Rules.AzureDevOps/blob/main/src/PSRule.Rules.AzureDevOps/en/Azure.DevOps.Repos.Branch.BranchPolicyMergeStrategy.md
55
---
66

7-
# Azure.DevOps.Repos.BranchPolicyMergeStrategy
7+
# Azure.DevOps.Repos.Branch.BranchPolicyMergeStrategy
88

99
## SYNOPSIS
1010

Lines changed: 38 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,38 @@
1+
---
2+
category: Microsoft Azure DevOps Repos
3+
severity: Severe
4+
online version: https://github.com/cloudyspells/PSRule.Rules.AzureDevOps/blob/main/src/PSRule.Rules.AzureDevOps/en/Azure.DevOps.Repos.Branch.BranchPolicyMinimumReviewers.md
5+
---
6+
7+
# Azure.DevOps.Repos.Branch.BranchPolicyMinimumReviewers
8+
9+
## SYNOPSIS
10+
11+
The repository's branch should have a branch policy with a minimum
12+
number of reviewers.
13+
14+
## DESCRIPTION
15+
16+
Having a minimum number of reviewers for a branch policy helps ensure that the
17+
code in the default branch is of a high quality and that the team's Git
18+
workflow is followed.
19+
20+
You can configure the minimum number of reviewers for this rule by setting the
21+
`branchMinimumApproverCount` configuration value in PSRule. The default
22+
value is `1`.
23+
24+
Mininum TokenType: `ReadOnly`
25+
26+
## RECOMMENDATION
27+
28+
Make sure that the branch policy has a minimum number of reviewers for the
29+
default branch of your repository. This will help ensure that the code in the
30+
default branch is of a high quality and that the team's Git workflow is
31+
followed.
32+
33+
## LINKS
34+
35+
- [Create a branch policy](https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies?view=azure-devops)
36+
- [Branch policies](https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies-overview?view=azure-devops)
37+
- [Minimum number of reviewers](https://docs.microsoft.com/en-us/azure/devops/repos/git/branch-policies-overview?view=azure-devops#minimum-number-of-reviewers)
38+
- [Azure DevOps Security best practices](https://docs.microsoft.com/en-us/azure/devops/user-guide/security-best-practices?view=azure-devops#repositories-and-branches)

src/PSRule.Rules.AzureDevOps/en/Azure.DevOps.Repos.BranchPolicyRequireBuild.md renamed to src/PSRule.Rules.AzureDevOps/en/Azure.DevOps.Repos.Branch.BranchPolicyRequireBuild.md

Lines changed: 4 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,15 @@
11
---
22
category: Microsoft Azure DevOps Repos
33
severity: Severe
4-
online version: https://github.com/cloudyspells/PSRule.Rules.AzureDevOps/blob/main/src/PSRule.Rules.AzureDevOps/en/Azure.DevOps.Repos.BranchPolicyRequireBuild.md
4+
online version: https://github.com/cloudyspells/PSRule.Rules.AzureDevOps/blob/main/src/PSRule.Rules.AzureDevOps/en/Azure.DevOps.Repos.Branch.BranchPolicyRequireBuild.md
55
---
66

7-
# Azure.DevOps.Repos.BranchPolicyRequireBuild
7+
# Azure.DevOps.Repos.Branch.BranchPolicyRequireBuild
88

99
## SYNOPSIS
1010

11-
The branch policy should be configured to require a build or CI pipeline to pass
12-
before changes can be merged into the default branch.
11+
The branch policy should be configured to require a build or CI pipeline to
12+
pass before changes can be merged into the default branch.
1313

1414
## DESCRIPTION
1515

src/PSRule.Rules.AzureDevOps/en/Azure.DevOps.Repos.BranchPolicyResetVotes.md renamed to src/PSRule.Rules.AzureDevOps/en/Azure.DevOps.Repos.Branch.BranchPolicyResetVotes.md

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,10 +1,10 @@
11
---
22
category: Microsoft Azure DevOps Repos
33
severity: Severe
4-
online version: https://github.com/cloudyspells/PSRule.Rules.AzureDevOps/blob/main/src/PSRule.Rules.AzureDevOps/en/AzureDevOps.Repos.BranchPolicyResetVotes.md
4+
online version: https://github.com/cloudyspells/PSRule.Rules.AzureDevOps/blob/main/src/PSRule.Rules.AzureDevOps/en/Azure.DevOps.Repos.Branch.BranchPolicyResetVotes.md
55
---
66

7-
# AzureDevOps.Repos.BranchPolicyResetVotes
7+
# Azure.DevOps.Repos.Branch.BranchPolicyResetVotes
88

99
## SYNOPSIS
1010

0 commit comments

Comments
 (0)