add audit mode to ci (#948)

* add audit mode to ci

.gitignore

@@ -18,7 +18,6 @@
 x64/
 x86/
 ARM64/
-build/
 bld/
 [Bb]in/
 [Oo]bj/

build/pipelines/ci.yml

@@ -19,6 +19,10 @@ pr:
 name: 0.0.$(Date:yyMM).$(Date:dd)$(Rev:rr)
 
 jobs:
+  - template: ./templates/build-console-audit-job.yml
+    parameters:
+      platform: x64
+
   - template: ./templates/build-console-ci.yml
     parameters:
       platform: x64

build/pipelines/release.yml

@@ -16,6 +16,10 @@ variables:
 name: 'Terminal_$(date:yyMM).$(date:dd)$(rev:rrr)'
 
 jobs:
+  - template: ./templates/build-console-audit-job.yml
+    parameters:
+      platform: x64
+
   - template: ./templates/build-console-int.yml
     parameters:
       platform: x64

build/pipelines/templates/build-console-audit-job.yml

@@ -0,0 +1,53 @@
+parameters:
+  platform: ''
+  additionalBuildArguments: ''
+
+jobs:
+- job: Build${{ parameters.platform }}AuditMode
+  displayName: Static Analysis Build ${{ parameters.platform }}
+  variables:
+    BuildConfiguration: AuditMode
+    BuildPlatform: ${{ parameters.platform }}
+  pool: { vmImage: vs2017-win2016 }
+
+  steps:
+  - checkout: self
+    submodules: true
+    clean: true
+
+  - task: NuGetToolInstaller@0
+    displayName: Ensure NuGet 4.8.1
+    inputs:
+      versionSpec: 4.8.1
+
+  # In the Microsoft Azure DevOps tenant, NuGetCommand is ambiguous.
+  # This should be `task: NuGetCommand@2`
+  - task: 333b11bd-d341-40d9-afcf-b32d5ce6f23b@2
+    displayName: Restore NuGet packages
+    inputs:
+      command: restore
+      feedsToUse: config
+      configPath: NuGet.config
+      restoreSolution: OpenConsole.sln
+      restoreDirectory: '$(Build.SourcesDirectory)\packages'
+
+  - task: 333b11bd-d341-40d9-afcf-b32d5ce6f23b@2
+    displayName: 'NuGet restore packages for CI'
+    inputs:
+      command: restore
+      restoreSolution: build/.nuget/packages.config
+      feedsToUse: config
+      externalFeedCredentials: 'TAEF NuGet Feed'
+      nugetConfigPath: build/config/NuGet.config
+      restoreDirectory: '$(Build.SourcesDirectory)/packages'
+
+  - task: VSBuild@1
+    displayName: 'Build solution **\OpenConsole.sln'
+    inputs:
+      solution: '**\OpenConsole.sln'
+      vsVersion: 15.0
+      platform: '$(BuildPlatform)'
+      configuration: '$(BuildConfiguration)'
+      msbuildArgs: ${{ parameters.additionalBuildArguments }}
+      clean: true
+      maximumCpuCount: true

build/pipelines/templates/build-console-ci.yml

@@ -4,8 +4,8 @@ parameters:
   additionalBuildArguments: ''
 
 jobs:
-- job: Build${{ parameters.platform }}
-  displayName: Build ${{ parameters.platform }}
+- job: Build${{ parameters.platform }}${{ parameters.configuration }}
+  displayName: Build ${{ parameters.platform }} ${{ parameters.configuration }}
   variables:
     BuildConfiguration: ${{ parameters.configuration }}
     BuildPlatform: ${{ parameters.platform }}

build/pipelines/templates/build-console-int.yml

@@ -4,8 +4,8 @@ parameters:
   additionalBuildArguments: ''
 
 jobs:
-- job: Build${{ parameters.platform }}
-  displayName: Build ${{ parameters.platform }}
+- job: Build${{ parameters.platform }}${{ parameters.configuration }}
+  displayName: Build ${{ parameters.platform }} ${{ parameters.configuration }}
   variables:
     BuildConfiguration: ${{ parameters.configuration }}
     BuildPlatform: ${{ parameters.platform }}

build/pipelines/templates/release-sign-and-bundle.yml

@@ -6,16 +6,18 @@ jobs:
   displayName: Sign and Deploy for ${{ parameters.configuration }}
 
   dependsOn:
-    - Buildx64
-    - Buildx86
-    - Buildarm64
+    - Buildx64AuditMode
+    - Buildx64Release
+    - Buildx86Release
+    - Buildarm64Release
   condition: |
     and
     (
-      in(dependencies.Buildx64.result,   'Succeeded', 'SucceededWithIssues', 'Skipped'),
-      in(dependencies.Buildx86.result,   'Succeeded', 'SucceededWithIssues', 'Skipped'),
-      in(dependencies.Buildarm64.result, 'Succeeded', 'SucceededWithIssues', 'Skipped')
-    ) 
+      in(dependencies.Buildx64AuditMode.result, 'Succeeded', 'SucceededWithIssues', 'Skipped'),
+      in(dependencies.Buildx64Release.result,   'Succeeded', 'SucceededWithIssues', 'Skipped'),
+      in(dependencies.Buildx86Release.result,   'Succeeded', 'SucceededWithIssues', 'Skipped'),
+      in(dependencies.Buildarm64Release.result, 'Succeeded', 'SucceededWithIssues', 'Skipped')
+    )
 
   variables:
     BuildConfiguration: ${{ parameters.configuration }}

src/StaticAnalysis.ruleset

@@ -1,4 +1,11 @@
 <?xml version="1.0" encoding="utf-8"?>
 <RuleSet Name="Console Rules" Description="These rules enforce static analysis on console code." ToolsVersion="15.0">
+
   <Include Path="cppcorecheckrules.ruleset" Action="Default" />
+
+  <Rules AnalyzerId="Microsoft.Analyzers.NativeCodeAnalysis" RuleNamespace="Microsoft.Rules.Native">
+    <Rule Id="C6001" Action="Error" />
+    <Rule Id="C6011" Action="Error" />
+  </Rules>
+
 </RuleSet>

src/buffer/out/precomp.h

@@ -21,7 +21,6 @@ Module Name:
 #include "LibraryIncludes.h"
 
 #pragma warning(push)
-#pragma warning(disable: ALL_CPPCORECHECK_WARNINGS)
 #ifndef WIN32_LEAN_AND_MEAN
 #define WIN32_LEAN_AND_MEAN             // Exclude rarely-used stuff from Windows headers
 #endif

src/cascadia/TerminalApp/App.h

@@ -8,8 +8,6 @@
 #include "App.g.h"
 #include "../../cascadia/inc/cppwinrt_utils.h"
 
-#include <wil/filesystem.h>
-
 #include <winrt/Microsoft.Terminal.TerminalControl.h>
 
 #include <winrt/Microsoft.UI.Xaml.Controls.h>

src/cascadia/TerminalApp/CascadiaSettingsSerialization.cpp

@@ -6,8 +6,6 @@
 #include "CascadiaSettings.h"
 #include "../../types/inc/utils.hpp"
 #include <appmodel.h>
-#include <wil/com.h>
-#include <wil/filesystem.h>
 #include <shlobj.h>
 
 using namespace ::TerminalApp;

src/cascadia/TerminalConnection/pch.h

@@ -14,4 +14,3 @@
 
 #include "winrt/Windows.Foundation.h"
 #include <Windows.h>
-#include <wil/result.h>

src/common.build.post.props

@@ -25,4 +25,9 @@
     <Import Project="$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props" Condition="exists('$(UserRootDir)\Microsoft.Cpp.$(Platform).user.props')" Label="LocalAppDataPlatform" />
   </ImportGroup>
   <Import Project="$(VCTargetsPath)\Microsoft.Cpp.targets" />
+  <!-- Exclude our dependencies from static analysis. CAExcludePath can only be
+       set after we've imported Microsoft.Cpp.targets -->
+  <PropertyGroup>
+    <CAExcludePath>$(SolutionDir)\dep\;$(CAExcludePath)</CAExcludePath>
+  </PropertyGroup>
 </Project>

src/common.build.pre.props

@@ -113,8 +113,8 @@
       <PreprocessorDefinitions>WIN32;%(PreprocessorDefinitions)</PreprocessorDefinitions>
     </ClCompile>
   </ItemDefinitionGroup>
-    <!-- For our Audit mode -->
-   <PropertyGroup Condition="'$(Configuration)'=='AuditMode'">
+  <!-- For our Audit mode -->
+  <PropertyGroup Condition="'$(Configuration)'=='AuditMode'">
     <CodeAnalysisRuleSet>$(SolutionDir)\src\StaticAnalysis.ruleset</CodeAnalysisRuleSet>
     <EnableCppCoreCheck>true</EnableCppCoreCheck>
     <RunCodeAnalysis>true</RunCodeAnalysis>

src/inc/LibraryIncludes.h

@@ -3,10 +3,8 @@
 
 #pragma once
 
-#include <CppCoreCheck/Warnings.h>
 
 #pragma warning(push)
-#pragma warning(disable: ALL_CPPCORECHECK_WARNINGS)
 
 // C
 #include <climits>
@@ -44,19 +42,22 @@
 #include <functional>
 
 // WIL
-
 #include <wil/Common.h>
 #include <wil/Result.h>
 #include <wil/resource.h>
 #include <wil/wistd_memory.h>
 #include <wil/com.h>
+#include <wil/filesystem.h>
 
 // GSL
 // Block GSL Multi Span include because it both has C++17 deprecated iterators
 // and uses the C-namespaced "max" which conflicts with Windows definitions.
 #define GSL_MULTI_SPAN_H
 #include <gsl/gsl>
 
+// CppCoreCheck
+#include <CppCoreCheck/Warnings.h>
+
 // IntSafe
 #define ENABLE_INTSAFE_SIGNED_FUNCTIONS
 #include <intsafe.h>

src/propsheet/precomp.h

@@ -48,12 +48,7 @@
 #include "strid.h"
 #include "..\propslib\conpropsp.hpp"
 
-// WIL
 #include <new>
-#include <wil/Common.h>
-#include <wil/Result.h>
-#include <wil/resource.h>
-#include <wil/wistd_memory.h>
 
 // This is currently bubbling up the source tree to our branch
 #ifndef WM_DPICHANGED_BEFOREPARENT