ADO pipeline changes for OpenSSF Best Practices (#193)

Author: walbourn

README.md

@@ -82,6 +82,10 @@ For the latest version of DirectXMath, bug reports, etc. please visit the projec
 
 ## Release Notes
 
+FOR SECURITY ADVISORIES, see [GitHub](https://github.com/microsoft/DirectXMath/security/advisories).
+
+For a full change history, see [CHANGELOG.md](https://github.com/microsoft/DirectXMath/blob/main/CHANGELOG.md).
+
 * The clang/LLVM toolset currently does not respect the ``float_control`` pragma for SSE instrinsics. Therefore, the use of ``/fp:fast`` is not recommended on clang/LLVM until this issue is fixed. See [55713](https://github.com/llvm/llvm-project/issues/55713).
 
 ## Support
@@ -96,6 +100,8 @@ This project welcomes contributions and suggestions. Most contributions require
 
 When you submit a pull request, a CLA bot will automatically determine whether you need to provide a CLA and decorate the PR appropriately (e.g., status check, comment). Simply follow the instructions provided by the bot. You will only need to do this once across all repos using our CLA.
 
+Tests for new features should also be submitted as a PR to the [Test Suite](https://github.com/walbourn/directxmathtest/wiki) repository.
+
 ## Code of Conduct
 
 This project has adopted the [Microsoft Open Source Code of Conduct](https://opensource.microsoft.com/codeofconduct/). For more information see the [Code of Conduct FAQ](https://opensource.microsoft.com/codeofconduct/faq/) or contact [opencode@microsoft.com](mailto:opencode@microsoft.com) with any additional questions or comments.

build/DirectXMath-GitHub-Dev17.yml

@@ -12,22 +12,38 @@ schedules:
     include:
     - main
 
-trigger: none
+trigger:
+  branches:
+    include:
+    - main
+  paths:
+    exclude:
+    - '*.md'
+    - LICENSE
+    - CMake*
+    - '.nuget/*'
+    - build/*.cmake
+    - build/*.in
 
 pr:
   branches:
     include:
     - main
   paths:
-    include:
-    - build/DirectXMath-GitHub-Dev17.yml
+    exclude:
+    - '*.md'
+    - LICENSE
+    - CMake*
+    - '.nuget/*'
+    - build/*.cmake
+    - build/*.in
+  drafts: false
 
 resources:
   repositories:
   - repository: self
     type: git
     ref: refs/heads/main
-    trigger: none
 
 name: $(Year:yyyy).$(Month).$(DayOfMonth)$(Rev:.r)
 

build/DirectXMath-GitHub.yml

@@ -47,13 +47,13 @@ resources:
 
 name: $(Year:yyyy).$(Month).$(DayOfMonth)$(Rev:.r)
 
+pool:
+  vmImage: windows-2019
+
 variables:
   Codeql.Enabled: false
   GITHUB_PAT: $(GITHUBPUBLICTOKEN)
 
-pool:
-  vmImage: windows-2019
-
 jobs:
 - job: BUILD_DEV16
   displayName: 'Visual Studio 2019 (v142)'

build/DirectXMath-SDL.yml

@@ -13,7 +13,14 @@ schedules:
     - main
 
 trigger: none
-pr: none
+
+pr:
+  branches:
+    include:
+    - main
+  paths:
+    include:
+    - build/DirectXMath-SDL.yml
 
 resources:
   repositories:
@@ -26,6 +33,7 @@ name: $(Year:yyyy).$(Month).$(DayOfMonth)$(Rev:.r)
 variables:
   Codeql.Enabled: true
   Codeql.Language: cpp
+  VC_PATH: 'C:\Program Files\Microsoft Visual Studio\2022\Enterprise\VC'
   VS_GENERATOR: 'Visual Studio 17 2022'
   GITHUB_PAT: $(GITHUBPUBLICTOKEN)
 
@@ -86,3 +94,41 @@ jobs:
       GdnBreakPolicyMinSev: 'Error'
   - task: ComponentGovernanceComponentDetection@0
     displayName: Component Detection
+
+- job: VC_PREFAST
+  displayName: 'Build using /analyze (PREFAST)'
+  workspace:
+    clean: all
+  steps:
+  - checkout: self
+    clean: true
+    fetchTags: false
+  - task: CmdLine@2
+    displayName: Fetch Tests
+    inputs:
+      script: git clone --quiet --no-tags https://%GITHUB_PAT%@github.com/walbourn/directxmathtest.git Tests
+  - task: CmdLine@2
+    displayName: Setup environment for CMake to use VS
+    inputs:
+      script: |
+        call "$(VC_PATH)\Auxiliary\Build\vcvars64.bat"
+        echo ##vso[task.setvariable variable=WindowsSdkVerBinPath;]%WindowsSdkVerBinPath%
+        echo ##vso[task.prependpath]%VSINSTALLDIR%Common7\IDE\CommonExtensions\Microsoft\CMake\Ninja
+        echo ##vso[task.prependpath]%VCINSTALLDIR%Tools\Llvm\x64\bin
+        echo ##vso[task.prependpath]%WindowsSdkBinPath%x64
+        echo ##vso[task.prependpath]%WindowsSdkVerBinPath%x64
+        echo ##vso[task.prependpath]%VCToolsInstallDir%bin\Hostx64\x64
+        echo ##vso[task.setvariable variable=EXTERNAL_INCLUDE;]%EXTERNAL_INCLUDE%
+        echo ##vso[task.setvariable variable=INCLUDE;]%INCLUDE%
+        echo ##vso[task.setvariable variable=LIB;]%LIB%
+
+  - task: CMake@1
+    displayName: CMake Config
+    inputs:
+      cwd: '$(Build.SourcesDirectory)/Tests/headertest'
+      cmakeArgs: --preset=x64-Debug -DENABLE_CODE_ANALYSIS=ON
+  - task: CMake@1
+    displayName: CMake Build
+    inputs:
+      cwd: '$(Build.SourcesDirectory)/Tests/headertest'
+      cmakeArgs: --build out/build/x64-Debug