feat(esrp): configure ADO pipelines with Client ID and team contacts by imran-siddique · Pull Request #359 · microsoft/agent-governance-toolkit

imran-siddique · 2026-03-24T01:23:00Z

Fill ESRP pipeline placeholders:

Client ID: \�458522c-0359-4e92-9887-5fee1607c0c7\
Service connection: \�gt-esrp-release\
Owners/Approvers: \�gt@microsoft.com\

Remaining TODOs (marked in code):

Key Vault name (pending PRSS cert generation)
Auth/Sign cert names (pending SAW access)

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Add EU AI Act, Colorado AI Act, and GPAI obligations timeline with AGT coverage mapping. Reference Microsoft Purview DSPM for AI as complementary data governance layer. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…toolkit

The Scorecard API rejects workflows with write permissions at the workflow level. id-token: write and security-events: write must be scoped to the job level only. Restores permissions: read-all at workflow level while keeping job-level write permissions intact. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…ft#324) Add Google-style docstrings with Args, Returns, Raises, Attributes, and Example sections to MCPMessageType, MCPAdapter, and MCPServer classes. Also enhances docstrings for key methods including handle_message, _handle_tools_call, _handle_resources_read, and _map_tool_to_action. Fixes microsoft#316

Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>

…icrosoft#326)

…s (dependency confusion) (microsoft#325) - Replace !pip install agent-os with !pip install -e ../.. in all 6 notebooks; agent-os is not on PyPI and installing it from PyPI is a dependency confusion vector - Replace zendesk-sdk/freshdesk-sdk with zenpy/freshdesk (the real published SDKs) in customer-service/requirements.txt - Remove hashlib-compat from healthcare-hipaa/requirements.txt; hashlib is stdlib and hashlib-compat is not a real PyPI package

…stall agent-os with agent-os-kernel Replace all remaining instances of `pip install agent-os` (unregistered on PyPI) with `pip install agent-os-kernel` (the actual package) across docs, examples, TypeScript extensions, CLI source, tests, and SVG assets. Also fixes `pip install emk` references to point to `agent-os-kernel[full]` since emk is a submodule, not a standalone PyPI package. Completes the fix started in PR microsoft#325 which only covered notebooks. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Dify 65K→133K, AutoGen 42K→55K, CrewAI 28K→46K, Semantic Kernel 24K→27K, LangGraph 24K→27K, Haystack 22K→24K, Agent Framework 7.6K→8K. Added star counts for OpenAI Agents SDK (20K) and Google ADK (18K). Sorted by stars descending. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…toolkit

…it CI - scripts/check_dependency_confusion.py: Pre-commit hook that scans for pip install commands referencing unregistered PyPI packages. Maintains an allowlist of known registered packages. - .github/workflows/weekly-security-audit.yml: Weekly CI job running dependency confusion scan, security skills scan, and weak crypto check. Uploads reports as artifacts with 90-day retention. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…icrosoft#349) * docs: add testing guide for external testers and customers Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: add regulatory alignment table and Purview positioning to README Add EU AI Act, Colorado AI Act, and GPAI obligations timeline with AGT coverage mapping. Reference Microsoft Purview DSPM for AI as complementary data governance layer. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * fix(ci): restore read-all at workflow level for Scorecard verification The Scorecard API rejects workflows with write permissions at the workflow level. id-token: write and security-events: write must be scoped to the job level only. Restores permissions: read-all at workflow level while keeping job-level write permissions intact. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: add comprehensive docstrings to mcp_adapter.py classes (microsoft#324) Add Google-style docstrings with Args, Returns, Raises, Attributes, and Example sections to MCPMessageType, MCPAdapter, and MCPServer classes. Also enhances docstrings for key methods including handle_message, _handle_tools_call, _handle_resources_read, and _map_tool_to_action. Fixes microsoft#316 * ci: add markdown link checker workflow (microsoft#323) Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> * feat: add policy evaluation heatmap to SRE dashboard (microsoft#309) (microsoft#326) * fix: remove unregistered PyPI packages from notebooks and requirements (dependency confusion) (microsoft#325) - Replace !pip install agent-os with !pip install -e ../.. in all 6 notebooks; agent-os is not on PyPI and installing it from PyPI is a dependency confusion vector - Replace zendesk-sdk/freshdesk-sdk with zenpy/freshdesk (the real published SDKs) in customer-service/requirements.txt - Remove hashlib-compat from healthcare-hipaa/requirements.txt; hashlib is stdlib and hashlib-compat is not a real PyPI package * fix(security): complete dependency confusion fix — replace all pip install agent-os with agent-os-kernel Replace all remaining instances of `pip install agent-os` (unregistered on PyPI) with `pip install agent-os-kernel` (the actual package) across docs, examples, TypeScript extensions, CLI source, tests, and SVG assets. Also fixes `pip install emk` references to point to `agent-os-kernel[full]` since emk is a submodule, not a standalone PyPI package. Completes the fix started in PR microsoft#325 which only covered notebooks. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * docs: update framework star counts to current values Dify 65K→133K, AutoGen 42K→55K, CrewAI 28K→46K, Semantic Kernel 24K→27K, LangGraph 24K→27K, Haystack 22K→24K, Agent Framework 7.6K→8K. Added star counts for OpenAI Agents SDK (20K) and Google ADK (18K). Sorted by stars descending. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Parsa Faraji Alamouti <165321600+parsa-faraji@users.noreply.github.com> Co-authored-by: Matt Van Horn <mvanhorn@users.noreply.github.com> Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com> Co-authored-by: Zeel Desai <72783325+zeel2104@users.noreply.github.com> Co-authored-by: Xavier Garceau-Aranda <xavier.garceau-aranda@posteo.net>

- agentmesh → agentmesh-platform (5 files) - agentmesh-governance → agent-governance-toolkit - agent-os-observability → agent-os-kernel[observability] - hashlib.md5 → hashlib.sha256 (3 files) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

…toolkit

Fill ESRP pipeline placeholders with: - Client ID: a458522c-0359-4e92-9887-5fee1607c0c7 - Service connection: agt-esrp-release - Owners/Approvers: agt@microsoft.com TODO remaining (this week): - Key Vault name (pending PRSS cert generation) - Auth/Sign cert names (pending SAW access) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

github-actions

🤖 AI Agent: code-reviewer

Code Review for PR: `feat(esrp): configure ADO pipelines with Client ID and team contacts`

🔴 CRITICAL

Hardcoded Client ID and Service Connection
- The esrpClientId (a458522c-0359-4e92-9887-5fee1607c0c7) and esrpServiceConnection (agt-esrp-release) are hardcoded in the pipeline configuration. This introduces a security risk if the repository is public or if the pipeline logs are accessible to unauthorized users.
- Actionable Fix: Use Azure DevOps pipeline secrets or environment variables to securely store and retrieve sensitive values like esrpClientId and esrpServiceConnection. For example:
```
variables:
  esrpClientId: $(ESRP_CLIENT_ID)
  esrpServiceConnection: $(ESRP_SERVICE_CONNECTION)
```
Key Vault Name and Certificate Names
- The esrpKeyVaultName and esrpSignCertName are placeholders (agt-esrp-kv and esrp-sign) with a TODO comment indicating they will be updated later. If these values are not updated before deployment, the pipeline could fail or expose sensitive data.
- Actionable Fix: Ensure that these values are securely retrieved from Azure Key Vault or other secret management solutions before merging this PR. Add validation steps in the pipeline to verify that these values are correctly set.
Potential Exposure of Sensitive Data
- The pipeline configuration includes sensitive information like esrpClientId and esrpServiceConnection. If this repository is public or if logs are not properly secured, these values could be exposed.
- Actionable Fix: Audit the repository's access controls and ensure that sensitive data is not exposed in logs. Use Azure DevOps secure files or secret variables for sensitive configurations.

🟡 WARNING

Backward Compatibility
- The changes in this PR modify the pipeline configuration files (npm-publish.yml and pypi-publish.yml) by replacing placeholders with actual values. If these pipelines are already in use, the changes could potentially break existing workflows if the new values are incorrect or incomplete.
- Actionable Fix: Test the updated pipelines in a staging environment before merging to ensure they work as expected. Additionally, communicate these changes to all stakeholders to avoid disruptions.

💡 SUGGESTIONS

Add Validation for Required Variables
- To prevent pipeline failures due to missing or incorrect values, add validation steps to check that all required variables (e.g., esrpKeyVaultName, esrpSignCertName, esrpClientId) are set correctly before proceeding with the pipeline.
- Example:
```
- script: |
    if [ -z "$esrpKeyVaultName" ] || [ -z "$esrpSignCertName" ] || [ -z "$esrpClientId" ]; then
      echo "Error: Required ESRP variables are not set."
      exit 1
    fi
  displayName: "Validate ESRP Variables"
```
Document Remaining TODOs
- The PR mentions that the Key Vault name and certificate names will be updated after PRSS cert generation. However, there is no clear indication of who is responsible for this or when it will be completed.
- Actionable Suggestion: Add a follow-up task or issue to track the completion of these TODOs. This will ensure that these placeholders are not forgotten.
Use Descriptive Variable Names
- The variable names like esrpSignCertName and esrpKeyVaultName are somewhat generic. Consider using more descriptive names that indicate their specific purpose, such as esrpPrssKeyVaultName or esrpPrssSignCertName.
Add Comments for Future Developers
- Add comments to explain the purpose of each variable and how they are used in the pipeline. This will help future developers understand the configuration and avoid accidental misconfigurations.
Automate Key Vault Integration
- Instead of manually updating the Key Vault name and certificate names, consider automating the process using Azure CLI or ARM templates. This will reduce the risk of human error and streamline the deployment process.

Summary of Actions

🔴 Use secure methods (e.g., Azure DevOps secrets) to store sensitive values like esrpClientId and esrpServiceConnection.
🔴 Ensure esrpKeyVaultName and esrpSignCertName are updated before merging.
🟡 Test the updated pipelines in a staging environment to ensure backward compatibility.
💡 Add validation steps for required variables in the pipeline.
💡 Document and track the remaining TODOs for Key Vault and certificate updates.
💡 Use more descriptive variable names for clarity.
💡 Consider automating Key Vault integration to reduce manual steps.

Let me know if you need further clarification or assistance!

github-actions · 2026-03-24T01:23:27Z

🤖 AI Agent: security-scanner — Security Analysis of the Pull Request

Security Analysis of the Pull Request

🔴 CRITICAL: Credential Exposure

Issue: The esrpClientId value (a458522c-0359-4e92-9887-5fee1607c0c7) is hardcoded in the pipeline configuration files (npm-publish.yml and pypi-publish.yml). This exposes sensitive information directly in the repository, which could potentially be exploited by attackers if the repository is public or if access is compromised.
Attack Vector: If an attacker gains access to the repository, they could extract the esrpClientId and use it to impersonate the application or gain unauthorized access to resources tied to this client ID.
Fix: Remove the hardcoded esrpClientId from the pipeline configuration files and instead store it securely in an environment variable or a secret management system like Azure Key Vault. Reference the secret in the pipeline using a secure mechanism, such as $(esrpClientId).

🟠 HIGH: Key Vault Name and Certificate Name Placeholder

Issue: The esrpKeyVaultName and esrpSignCertName are placeholders (agt-esrp-kv and esrp-sign) with a TODO comment indicating they will be updated later. If these placeholders are not updated before deployment, the pipeline could fail or use incorrect resources, leading to potential security risks.
Attack Vector: If the placeholders are not replaced with the actual Key Vault name and certificate name, the pipeline may fail to retrieve the required certificates for signing, or worse, it could retrieve incorrect or malicious certificates if the placeholders match existing resources.
Fix: Ensure that the placeholders are replaced with the correct values before merging this PR. Add a validation step in the pipeline to verify that these variables are properly configured before execution.

🟠 HIGH: Policy Engine Circumvention

Issue: The ESRP configuration relies on variables (esrpOwners and esrpApprovers) to define the owners and approvers for the pipeline. These values are currently set to agt@microsoft.com, which might not enforce strict access control or multi-party approval.
Attack Vector: If the esrpOwners and esrpApprovers values are not properly validated or enforced, a malicious actor could potentially bypass the approval process by compromising the email account or by exploiting weak access control mechanisms.
Fix: Implement a mechanism to validate the esrpOwners and esrpApprovers values against a predefined list of authorized users or groups. Additionally, enforce multi-party approval in the pipeline to ensure that no single individual can approve a release.

🟡 MEDIUM: Trust Chain Weakness

Issue: The PR mentions that the Key Vault name and certificate names are pending PRSS cert generation and SAW access. This indicates that the trust chain for the ESRP signing process is not yet fully established.
Attack Vector: If the certificates are not securely generated, stored, or accessed, an attacker could compromise the signing process, leading to the signing of malicious code or unauthorized access to sensitive resources.
Fix: Ensure that the PRSS certificates are generated in a secure environment and stored in a secure Key Vault. Access to the Key Vault should be restricted to authorized identities only, and all access should be logged and monitored.

🟡 MEDIUM: Supply Chain Risk

Issue: The pipeline configuration does not explicitly specify versions for dependencies or tools used in the build and release process. This could lead to dependency confusion or typosquatting attacks.
Attack Vector: An attacker could publish a malicious package with a similar name to a dependency or tool used in the pipeline. If the pipeline inadvertently pulls the malicious package, it could compromise the build or release process.
Fix: Explicitly specify the versions of all dependencies and tools used in the pipeline. Use package integrity verification mechanisms (e.g., hash verification) to ensure the authenticity of the dependencies.

Summary of Findings

🔴 Credential Exposure: Hardcoded esrpClientId in pipeline files. Fix: Use secure environment variables or a secret management system.
🟠 Policy Engine Circumvention: Potential lack of validation for esrpOwners and esrpApprovers. Fix: Validate against authorized users and enforce multi-party approval.
🟠 Key Vault Name and Certificate Name Placeholder: Risk of using incorrect or malicious resources. Fix: Replace placeholders with actual values before merging.
🟡 Trust Chain Weakness: Pending PRSS cert generation and SAW access. Fix: Ensure secure certificate generation and storage.
🟡 Supply Chain Risk: Lack of explicit dependency versions. Fix: Specify exact versions and verify package integrity.

Recommendations

Address the critical issue of hardcoded credentials immediately by removing the esrpClientId from the pipeline files and using a secure storage mechanism.
Ensure that all placeholders are replaced with actual values before merging the PR.
Implement additional validation and approval mechanisms for esrpOwners and esrpApprovers.
Verify the integrity of the trust chain and ensure secure handling of certificates.
Review and lock dependency versions in the pipeline configuration to mitigate supply chain risks.

Let me know if you need further assistance!

imran-siddique and others added 22 commits March 20, 2026 10:56

docs: add testing guide for external testers and customers

9bd6672

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Merge branch 'main' of https://github.com/microsoft/agent-governance-…

3ab4a65

…toolkit

ci: add markdown link checker workflow (microsoft#323)

baeed60

Co-authored-by: Matt Van Horn <455140+mvanhorn@users.noreply.github.com>

feat: add policy evaluation heatmap to SRE dashboard (microsoft#309) (m…

8ee3c81

…icrosoft#326)

Merge branch 'main' of https://github.com/microsoft/agent-governance-…

96b2046

…toolkit

Merge branch 'main' of https://github.com/microsoft/agent-governance-…

3ac1f73

…toolkit

Merge branch 'main' of https://github.com/microsoft/agent-governance-…

d0681ff

…toolkit

Merge branch 'main' of https://github.com/microsoft/agent-governance-…

60bdccd

…toolkit

Merge branch 'main' of https://github.com/microsoft/agent-governance-…

f87284e

…toolkit

Merge branch 'main' of https://github.com/microsoft/agent-governance-…

ad5e9b1

…toolkit

Merge branch 'main' of https://github.com/microsoft/agent-governance-…

77b4f72

…toolkit

Merge branch 'main' of https://github.com/microsoft/agent-governance-…

d3a33a3

…toolkit

github-actions bot added the size/S Small PR (< 50 lines) label Mar 24, 2026

imran-siddique merged commit 7e19719 into microsoft:main Mar 24, 2026
53 checks passed

github-actions bot reviewed Mar 24, 2026

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

feat(esrp): configure ADO pipelines with Client ID and team contacts#359

feat(esrp): configure ADO pipelines with Client ID and team contacts#359
imran-siddique merged 22 commits intomicrosoft:mainfrom
imran-siddique:main

imran-siddique commented Mar 24, 2026

Uh oh!

Uh oh!

github-actions bot left a comment

Uh oh!

github-actions bot commented Mar 24, 2026

Security Analysis of the Pull Request

🔴 CRITICAL: Credential Exposure

🟠 HIGH: Key Vault Name and Certificate Name Placeholder

🟠 HIGH: Policy Engine Circumvention

🟡 MEDIUM: Trust Chain Weakness

🟡 MEDIUM: Supply Chain Risk

Summary of Findings

Recommendations

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Conversation

imran-siddique commented Mar 24, 2026

Uh oh!

Uh oh!

github-actions bot left a comment

Choose a reason for hiding this comment

🤖 AI Agent: code-reviewer

Code Review for PR: feat(esrp): configure ADO pipelines with Client ID and team contacts

🔴 CRITICAL

🟡 WARNING

💡 SUGGESTIONS

Summary of Actions

Uh oh!

github-actions bot commented Mar 24, 2026

Security Analysis of the Pull Request

🔴 CRITICAL: Credential Exposure

🟠 HIGH: Key Vault Name and Certificate Name Placeholder

🟠 HIGH: Policy Engine Circumvention

🟡 MEDIUM: Trust Chain Weakness

🟡 MEDIUM: Supply Chain Risk

Summary of Findings

Recommendations

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

5 participants

Code Review for PR: `feat(esrp): configure ADO pipelines with Client ID and team contacts`