Add eng/sdl-tsa-vars.config for TSA integration

[Copilot]

Adds TSA (Team Security Advisor) configuration file for Azure DevOps security scanning integration.

Changes

• Created eng/sdl-tsa-vars.config with configuration values from .config/tsaoptions.json:

  • TSA instance: https://devdiv.visualstudio.com/
  • Project: DEVDIV
  • Area path: DevDiv\ASP.NET Core\Policy Violations
  • Repository/codebase name: dotnetextensions
  • Notification email: aspnetcore-build@microsoft.com

• Configured source scanning tools (PoliCheck, CredScan) and artifact scanning (BinSkim)

• Added suppression file paths for PoliCheck and CredScan

• Set standard values for TsaOnboard, TsaPublish, and TsaCodebaseAdmin

File format follows dotnet/efcore, dotnet/aspnetcore, and dotnet/runtime conventions for Azure Pipelines SDL task integration.

Original prompt

Add eng/sdl-tsa-vars.config to the repository, modeled after similar files in dotnet/efcore, dotnet/aspnetcore, and dotnet/runtime. Use the variable values from .config/tsaoptions.json in dotnet/extensions:

• TsaInstanceURL: https://devdiv.visualstudio.com/
• TsaProjectName: DEVDIV
• TsaNotificationEmail: aspnetcore-build@microsoft.com
• TsaBugAreaPath: "DevDiv\ASP.NET Core\Policy Violations"
• TsaIterationPath: DevDiv
• TsaRepositoryName: dotnetextensions
• TsaCodebaseName: dotnetextensions

Also include standard values for SourceToolsList, ArtifactToolsList, TsaCodebaseAdmin, TsaOnboard, and TsaPublish (see efcore, aspnetcore, runtime for reference).

This pull request was created as a result of the following prompt from Copilot chat.

Add eng/sdl-tsa-vars.config to the repository, modeled after similar files in dotnet/efcore, dotnet/aspnetcore, and dotnet/runtime. Use the variable values from .config/tsaoptions.json in dotnet/extensions:

• TsaInstanceURL: https://devdiv.visualstudio.com/
• TsaProjectName: DEVDIV
• TsaNotificationEmail: aspnetcore-build@microsoft.com
• TsaBugAreaPath: "DevDiv\ASP.NET Core\Policy Violations"
• TsaIterationPath: DevDiv
• TsaRepositoryName: dotnetextensions
• TsaCodebaseName: dotnetextensions

Also include standard values for SourceToolsList, ArtifactToolsList, TsaCodebaseAdmin, TsaOnboard, and TsaPublish (see efcore, aspnetcore, runtime for reference).

---

✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Microsoft Reviewers: Open in CodeFlow

[Copilot]

Pull Request Overview

This PR adds a new SDL (Security Development Lifecycle) TSA (Trust Services Automation) configuration file that configures security scanning tools and their integration with Azure DevOps for the dotnetextensions repository.

Key changes:

• Configures security scanning tools (PoliCheck, CredScan, BinSkim) with TSA integration
• Sets up DevDiv project integration with proper notification channels
• Defines exclusion/suppression file paths for security scan results

Comments suppressed due to low confidence (1)

eng/sdl-tsa-vars.config:1

• The configuration references exclusion/suppression files (.config/PoliCheckExclusions.xml and .config/CredScanSuppressions.json) that may not exist in the repository. Consider either creating these files as part of this PR or documenting that they should be created if security scan results need to be suppressed.

-SourceToolsList @("policheck","credscan")