From 0b32abc25ef421a37cf51b584137b23ac1f7a78c Mon Sep 17 00:00:00 2001
From: chrisnielsen-MS <110426492+chrisnielsen-MS@users.noreply.github.com>
Date: Wed, 14 Dec 2022 15:13:34 -0800
Subject: [PATCH 01/32] Create test-workflow.yml

Signed-off-by: chrisnielsen-MS <110426492+chrisnielsen-MS@users.noreply.github.com>
---
 .github/workflows/test-workflow.yml | 48 +++++++++++++++++++++++++++++
 1 file changed, 48 insertions(+)
 create mode 100644 .github/workflows/test-workflow.yml

diff --git a/.github/workflows/test-workflow.yml b/.github/workflows/test-workflow.yml
new file mode 100644
index 00000000..557c187d
--- /dev/null
+++ b/.github/workflows/test-workflow.yml
@@ -0,0 +1,48 @@
+# test-workflow
+# docs are in the repo
+
+name: Microsoft Security DevOps self-hosted
+on: push
+
+jobs:
+  sample:
+    name: Microsoft Security DevOps
+
+    # MSDOruns on windows-latest.
+    # ubuntu-latest and macos-latest supporting coming soon
+    runs-on: self-hosted
+
+    steps:
+
+      # Checkout your code repository to scan
+    - uses: actions/checkout@v2
+
+    # Ensure a compatible version of dotnet is installed.
+    # The [Microsoft Security DevOps CLI](https://aka.ms/msdodocs) is built with dotnet v3.1.201.
+    # A version greater than or equal to v3.1.201 of dotnet must be installed on the agent in order to run this action.
+    # GitHub hosted runners already have a compatible version of dotnet installed and this step may be skipped.
+    # For self-hosted runners, ensure dotnet version 3.1.201 or later is installed by including this action:
+    # - uses: actions/setup-dotnet@v1
+    #   with:
+    #     dotnet-version: '3.1.x'
+
+    # Run open source static analysis tools
+    - name: Run MSDO
+      uses: microsoft/security-devops-action@v1
+      id: msdo
+
+    # - name: Run MSDO
+    #   uses: davidknise/security-devops-action@main
+    #   id: msdolocal
+
+      # Upload results to the Security tab
+    - name: Upload results to Security tab
+      uses: github/codeql-action/upload-sarif@v1
+      with:
+        sarif_file: ${{ steps.msdo.outputs.sarifFile }}
+
+    #   # Upload results to the Security tab
+    # - name: Upload results to Security tab
+    #   uses: github/codeql-action/upload-sarif@v1
+    #   with:
+    #     sarif_file: ${{ steps.msdolocal.outputs.sarifFile }}

From 92b3c6b826b23c11b1b0413af2b615cffaaaaa18 Mon Sep 17 00:00:00 2001
From: chrisnielsen-MS <110426492+chrisnielsen-MS@users.noreply.github.com>
Date: Wed, 14 Dec 2022 15:32:55 -0800
Subject: [PATCH 02/32] Update test-workflow.yml

Signed-off-by: chrisnielsen-MS <110426492+chrisnielsen-MS@users.noreply.github.com>
---
 .github/workflows/test-workflow.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/test-workflow.yml b/.github/workflows/test-workflow.yml
index 557c187d..b1cd3541 100644
--- a/.github/workflows/test-workflow.yml
+++ b/.github/workflows/test-workflow.yml
@@ -15,7 +15,7 @@ jobs:
     steps:
 
       # Checkout your code repository to scan
-    - uses: actions/checkout@v2
+    - uses: actions/checkout@v3
 
     # Ensure a compatible version of dotnet is installed.
     # The [Microsoft Security DevOps CLI](https://aka.ms/msdodocs) is built with dotnet v3.1.201.
@@ -27,8 +27,8 @@ jobs:
     #     dotnet-version: '3.1.x'
 
     # Run open source static analysis tools
-    - name: Run MSDO
-      uses: microsoft/security-devops-action@v1
+    - name: Run Microsoft Security DevOps Analysis
+      uses: microsoft/security-devops-action@preview
       id: msdo
 
     # - name: Run MSDO

From 00681e07c1394f26e4cddb8353413d1d8a197416 Mon Sep 17 00:00:00 2001
From: chrisnielsen-MS <110426492+chrisnielsen-MS@users.noreply.github.com>
Date: Fri, 16 Dec 2022 09:40:03 -0800
Subject: [PATCH 03/32] Update test-workflow.yml

Signed-off-by: chrisnielsen-MS <110426492+chrisnielsen-MS@users.noreply.github.com>
---
 .github/workflows/test-workflow.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/test-workflow.yml b/.github/workflows/test-workflow.yml
index b1cd3541..dcbc4417 100644
--- a/.github/workflows/test-workflow.yml
+++ b/.github/workflows/test-workflow.yml
@@ -1,7 +1,7 @@
 # test-workflow
 # docs are in the repo
 
-name: Microsoft Security DevOps self-hosted
+name: chrisnielsen test
 on: push
 
 jobs:
@@ -30,6 +30,8 @@ jobs:
     - name: Run Microsoft Security DevOps Analysis
       uses: microsoft/security-devops-action@preview
       id: msdo
+      with:
+        categories: 'sbom'
 
     # - name: Run MSDO
     #   uses: davidknise/security-devops-action@main

From 644a6d44c4cc925e19580ae06c74f4e6f9e55c16 Mon Sep 17 00:00:00 2001
From: Chris Nielsen <chrisnielsen@microsoft.com>
Date: Wed, 4 Jan 2023 15:19:55 -0800
Subject: [PATCH 04/32] Try tools to test sbom tool

---
 .github/workflows/test-workflow.yml | 1 +
 1 file changed, 1 insertion(+)

diff --git a/.github/workflows/test-workflow.yml b/.github/workflows/test-workflow.yml
index dcbc4417..5a18aeeb 100644
--- a/.github/workflows/test-workflow.yml
+++ b/.github/workflows/test-workflow.yml
@@ -32,6 +32,7 @@ jobs:
       id: msdo
       with:
         categories: 'sbom'
+        tools: 'sbomtool'
 
     # - name: Run MSDO
     #   uses: davidknise/security-devops-action@main

From c6fe98a592f43816c92c4a7128d5322f4c1a9c95 Mon Sep 17 00:00:00 2001
From: Chris Nielsen <chrisnielsen@microsoft.com>
Date: Wed, 29 Mar 2023 17:35:08 -0700
Subject: [PATCH 05/32] Updating test yml

---
 .github/workflows/test-workflow.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/test-workflow.yml b/.github/workflows/test-workflow.yml
index 5a18aeeb..1ec1a1fa 100644
--- a/.github/workflows/test-workflow.yml
+++ b/.github/workflows/test-workflow.yml
@@ -1,7 +1,7 @@
 # test-workflow
 # docs are in the repo
 
-name: chrisnielsen test
+name: chrisnielsen test2
 on: push
 
 jobs:

From fe56446748382faed9e9ae9e9d3afb015ecf46af Mon Sep 17 00:00:00 2001
From: Chris Nielsen <chrisnielsen@microsoft.com>
Date: Wed, 29 Mar 2023 17:41:37 -0700
Subject: [PATCH 06/32] Updating test yml

---
 .github/workflows/test-workflow.yml | 3 +--
 1 file changed, 1 insertion(+), 2 deletions(-)

diff --git a/.github/workflows/test-workflow.yml b/.github/workflows/test-workflow.yml
index 1ec1a1fa..bea09500 100644
--- a/.github/workflows/test-workflow.yml
+++ b/.github/workflows/test-workflow.yml
@@ -31,8 +31,7 @@ jobs:
       uses: microsoft/security-devops-action@preview
       id: msdo
       with:
-        categories: 'sbom'
-        tools: 'sbomtool'
+        tools: 'credscan'
 
     # - name: Run MSDO
     #   uses: davidknise/security-devops-action@main

From 40761faf12779253bbfa9f5869b66562e36b3ee6 Mon Sep 17 00:00:00 2001
From: Chris Nielsen <chrisnielsen@microsoft.com>
Date: Wed, 29 Mar 2023 17:55:30 -0700
Subject: [PATCH 07/32] Updating test yml

---
 .github/workflows/test-workflow.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/test-workflow.yml b/.github/workflows/test-workflow.yml
index bea09500..8f95e194 100644
--- a/.github/workflows/test-workflow.yml
+++ b/.github/workflows/test-workflow.yml
@@ -1,7 +1,7 @@
 # test-workflow
 # docs are in the repo
 
-name: chrisnielsen test2
+name: chrisnielsen test with new CLI
 on: push
 
 jobs:

From 582a9a753d178a99fc952c72125cc20fcd6b308f Mon Sep 17 00:00:00 2001
From: Chris Nielsen <chrisnielsen@microsoft.com>
Date: Wed, 26 Apr 2023 15:43:25 -0700
Subject: [PATCH 08/32] Update test workflow

---
 .github/workflows/test-workflow.yml | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/test-workflow.yml b/.github/workflows/test-workflow.yml
index 8f95e194..d5f1c0b0 100644
--- a/.github/workflows/test-workflow.yml
+++ b/.github/workflows/test-workflow.yml
@@ -31,7 +31,9 @@ jobs:
       uses: microsoft/security-devops-action@preview
       id: msdo
       with:
-        tools: 'credscan'
+        tools: 'trivy'
+      env:
+        trivy_target: "contosorepository"
 
     # - name: Run MSDO
     #   uses: davidknise/security-devops-action@main

From 7353bc92be1118772a4e6684fe135ef833a9be43 Mon Sep 17 00:00:00 2001
From: Chris Nielsen <chrisnielsen@microsoft.com>
Date: Fri, 5 May 2023 11:11:27 -0700
Subject: [PATCH 09/32] touching test workflow

---
 .github/workflows/test-workflow.yml | 5 +++++
 1 file changed, 5 insertions(+)

diff --git a/.github/workflows/test-workflow.yml b/.github/workflows/test-workflow.yml
index d5f1c0b0..a022a7e4 100644
--- a/.github/workflows/test-workflow.yml
+++ b/.github/workflows/test-workflow.yml
@@ -26,6 +26,11 @@ jobs:
     #   with:
     #     dotnet-version: '3.1.x'
 
+    - name: 'Docker stuff'
+    runs:
+      using: 'docker'
+      image: '**/Dockerfile'
+
     # Run open source static analysis tools
     - name: Run Microsoft Security DevOps Analysis
       uses: microsoft/security-devops-action@preview

From 421dc5050d8c7119fb42a605eb3284332fc47ecf Mon Sep 17 00:00:00 2001
From: Chris Nielsen <chrisnielsen@microsoft.com>
Date: Fri, 5 May 2023 11:15:00 -0700
Subject: [PATCH 10/32] touching test workflow

---
 .github/workflows/test-workflow.yml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/test-workflow.yml b/.github/workflows/test-workflow.yml
index a022a7e4..53cd2a14 100644
--- a/.github/workflows/test-workflow.yml
+++ b/.github/workflows/test-workflow.yml
@@ -27,9 +27,9 @@ jobs:
     #     dotnet-version: '3.1.x'
 
     - name: 'Docker stuff'
-    runs:
-      using: 'docker'
-      image: '**/Dockerfile'
+      runs:
+        using: 'docker'
+        image: '**/Dockerfile'
 
     # Run open source static analysis tools
     - name: Run Microsoft Security DevOps Analysis

From 82e15ed5f42afe0944445694ec98c861d0d37b10 Mon Sep 17 00:00:00 2001
From: Chris Nielsen <chrisnielsen@microsoft.com>
Date: Fri, 5 May 2023 15:41:07 -0700
Subject: [PATCH 11/32] touching test workflow

---
 .github/workflows/test-workflow.yml | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/test-workflow.yml b/.github/workflows/test-workflow.yml
index 53cd2a14..b394737c 100644
--- a/.github/workflows/test-workflow.yml
+++ b/.github/workflows/test-workflow.yml
@@ -27,9 +27,11 @@ jobs:
     #     dotnet-version: '3.1.x'
 
     - name: 'Docker stuff'
-      runs:
-        using: 'docker'
-        image: '**/Dockerfile'
+      uses: docker/build-push-action@v4
+      with:
+        context: ./samples
+        push: false
+        tags: contosofakeimage
 
     # Run open source static analysis tools
     - name: Run Microsoft Security DevOps Analysis
@@ -38,7 +40,7 @@ jobs:
       with:
         tools: 'trivy'
       env:
-        trivy_target: "contosorepository"
+        trivy_target: "contosofakeimage"
 
     # - name: Run MSDO
     #   uses: davidknise/security-devops-action@main

From 47b871c04b9bab52a6326d85f1e5889e04570d1a Mon Sep 17 00:00:00 2001
From: Chris Nielsen <chrisnielsen@microsoft.com>
Date: Thu, 11 May 2023 12:05:54 -0700
Subject: [PATCH 12/32] Touching test workflow

---
 .github/workflows/test-workflow.yml | 18 +++++++++---------
 1 file changed, 9 insertions(+), 9 deletions(-)

diff --git a/.github/workflows/test-workflow.yml b/.github/workflows/test-workflow.yml
index b394737c..a298414e 100644
--- a/.github/workflows/test-workflow.yml
+++ b/.github/workflows/test-workflow.yml
@@ -26,21 +26,21 @@ jobs:
     #   with:
     #     dotnet-version: '3.1.x'
 
-    - name: 'Docker stuff'
-      uses: docker/build-push-action@v4
-      with:
-        context: ./samples
-        push: false
-        tags: contosofakeimage
+    #- name: 'Docker stuff'
+    #  uses: docker/build-push-action@v4
+    #  with:
+    #    context: ./samples
+    #    push: false
+    #    tags: contosofakeimage
 
     # Run open source static analysis tools
     - name: Run Microsoft Security DevOps Analysis
       uses: microsoft/security-devops-action@preview
       id: msdo
       with:
-        tools: 'trivy'
-      env:
-        trivy_target: "contosofakeimage"
+        tools: 'credscan'
+      #env:
+      #  trivy_target: "contosofakeimage"
 
     # - name: Run MSDO
     #   uses: davidknise/security-devops-action@main

From 9f5e8f9a13ae5670ef3bf16790b736e27af129fe Mon Sep 17 00:00:00 2001
From: Chris Nielsen <chrisnielsen@microsoft.com>
Date: Fri, 22 Sep 2023 14:00:25 -0700
Subject: [PATCH 13/32] Touch test-workflow for testing

---
 .github/workflows/test-workflow.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/test-workflow.yml b/.github/workflows/test-workflow.yml
index a298414e..6d4b9f77 100644
--- a/.github/workflows/test-workflow.yml
+++ b/.github/workflows/test-workflow.yml
@@ -1,5 +1,5 @@
 # test-workflow
-# docs are in the repo
+# docs are in the repo 
 
 name: chrisnielsen test with new CLI
 on: push

From e084b9085ad2e74e5a89e34a8789893ae0d738c8 Mon Sep 17 00:00:00 2001
From: Chris Nielsen <chrisnielsen@microsoft.com>
Date: Fri, 22 Sep 2023 14:17:40 -0700
Subject: [PATCH 14/32] Touch test-workflow for debug_drop testing

---
 .github/workflows/test-workflow.yml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/test-workflow.yml b/.github/workflows/test-workflow.yml
index 6d4b9f77..95d4f813 100644
--- a/.github/workflows/test-workflow.yml
+++ b/.github/workflows/test-workflow.yml
@@ -4,6 +4,9 @@
 name: chrisnielsen test with new CLI
 on: push
 
+env:
+  GDN_DEBUG_DROP: 'true'
+
 jobs:
   sample:
     name: Microsoft Security DevOps

From 5ed8f1568bcfdf51f168e767099c9e5dd794dbb3 Mon Sep 17 00:00:00 2001
From: Chris Nielsen <chrisnielsen@microsoft.com>
Date: Fri, 22 Sep 2023 16:43:18 -0700
Subject: [PATCH 15/32] Update actions-toolkit version

---
 node_modules/.package-lock.json               |   6 +-
 .../msdo-client.js                            | 107 ++++++++++++++++++
 .../package.json                              |   2 +-
 package-lock.json                             |  14 +--
 package.json                                  |   2 +-
 5 files changed, 119 insertions(+), 12 deletions(-)

diff --git a/node_modules/.package-lock.json b/node_modules/.package-lock.json
index fc3d89d7..f4e76d45 100644
--- a/node_modules/.package-lock.json
+++ b/node_modules/.package-lock.json
@@ -37,9 +37,9 @@
             "license": "MIT"
         },
         "node_modules/@microsoft/security-devops-actions-toolkit": {
-            "version": "1.7.2",
-            "resolved": "https://npm.pkg.github.com/download/@microsoft/security-devops-actions-toolkit/1.7.2/02c4a981c8e32a8493f70b30e5b4e94f7b887c43",
-            "integrity": "sha512-RQfwjcLogpA0IhBM+tWp1PxfqCcr/OzRg/FdBLX3PjWyzCvRXjNPQd5VsXUn67HSCtqOXKbaUE490p4ECUiMbQ==",
+            "version": "1.8.1-beta1",
+            "resolved": "https://npm.pkg.github.com/download/@microsoft/security-devops-actions-toolkit/1.8.1-beta1/587c31668ca0eca658c1bc333070c22cbb50742b",
+            "integrity": "sha512-YHfJpTolHxFULAXr+dBrS9Hcr8vI2AfQto8Mbgs9DhCd9tZQDacF/2/OO6T0xlAVakQc3o9vilZSBILiyPN7GA==",
             "license": "MIT",
             "dependencies": {
                 "@actions/core": "1.10.0",
diff --git a/node_modules/@microsoft/security-devops-actions-toolkit/msdo-client.js b/node_modules/@microsoft/security-devops-actions-toolkit/msdo-client.js
index 8aff228e..c0e7ef0f 100644
--- a/node_modules/@microsoft/security-devops-actions-toolkit/msdo-client.js
+++ b/node_modules/@microsoft/security-devops-actions-toolkit/msdo-client.js
@@ -33,11 +33,13 @@ var __awaiter = (this && this.__awaiter) || function (thisArg, _arguments, P, ge
 };
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.run = void 0;
+const fs = __importStar(require("fs"));
 const path = __importStar(require("path"));
 const process = __importStar(require("process"));
 const core = __importStar(require("@actions/core"));
 const exec = __importStar(require("@actions/exec"));
 const installer = __importStar(require("./msdo-installer"));
+const AdmZip = require("adm-zip");
 const cliVersionDefault = 'Latest';
 function setupEnvironment() {
     return __awaiter(this, void 0, void 0, function* () {
@@ -80,6 +82,15 @@ function run(inputArgs, telemetryEnvironment = 'github') {
     return __awaiter(this, void 0, void 0, function* () {
         let cliFilePath = null;
         let args = [];
+        let debugDrop = process.env.GDN_DEBUG_DROP;
+        const gdnTaskLibFolder = path.resolve(__dirname);
+        core.debug(`gdnTaskLibFolder = ${gdnTaskLibFolder}`);
+        const nodeModulesFolder = path.dirname(path.dirname(gdnTaskLibFolder));
+        core.debug(`nodeModulesFolder = ${nodeModulesFolder}`);
+        const taskFolder = path.dirname(nodeModulesFolder);
+        core.debug(`taskFolder = ${taskFolder}`);
+        const debugFolder = path.join(taskFolder, 'debug');
+        core.debug(`debugFolder = ${debugFolder}`);
         try {
             yield setupEnvironment();
             yield init();
@@ -103,6 +114,15 @@ function run(inputArgs, telemetryEnvironment = 'github') {
             args.push(sarifFile);
             args.push('--telemetry-environment');
             args.push(telemetryEnvironment);
+            core.debug(`GdnDebugDrop = ${debugDrop}`);
+            if (debugDrop) {
+                args.push('--debug-drop');
+                args.push('--debug-drop-path');
+                args.push(debugFolder);
+                const debugFolderEnvVarName = `GDN_DEBUGDROPPATH`;
+                core.debug(`Debug Drop enabled. ${debugFolderEnvVarName}: ${debugFolder}`);
+                process.env[debugFolderEnvVarName] = debugFolder;
+            }
         }
         catch (error) {
             core.error('Exception occurred while initializing MSDO:');
@@ -112,7 +132,37 @@ function run(inputArgs, telemetryEnvironment = 'github') {
         }
         try {
             core.debug('Running Microsoft Security DevOps...');
+            cleanupDirectory(debugFolder);
             yield exec.exec(cliFilePath, args);
+            let debugStagingDir = '';
+            core.debug(`GdnDebugDrop = ${debugDrop}`);
+            if (debugDrop) {
+                if (fs.existsSync(debugFolder)) {
+                    core.debug("Creating debug drop archive...");
+                    let zippedOutput = getZippedFolder(debugFolder);
+                    const taskFilePath = path.join(taskFolder, `task.json`);
+                    core.debug(`taskFilePath = ${taskFilePath}`);
+                    const taskFile = require(taskFilePath);
+                    const taskName = taskFile.name.toUpperCase();
+                    const instanceDirectory = process.env.GITHUB_WORKSPACE;
+                    debugStagingDir = path.join(instanceDirectory, '.gdn', 'debugdrop');
+                    if (!fs.existsSync(debugStagingDir)) {
+                        core.debug(`Creating missing folder: ${debugStagingDir}`);
+                        fs.mkdirSync(debugStagingDir);
+                    }
+                    let debugDropArtifact = path.join(debugStagingDir, `${taskName}_debug.zip`);
+                    let dupeCount = 0;
+                    while (fs.existsSync(debugDropArtifact)) {
+                        dupeCount += 1;
+                        debugDropArtifact = path.join(debugStagingDir, `${taskName}_${dupeCount}_debug.zip`);
+                    }
+                    fs.copyFileSync(zippedOutput, debugDropArtifact);
+                    core.debug(`Finished creating: ${debugDropArtifact}`);
+                    core.debug(`Cleaning up: ${debugFolder}`);
+                    cleanupDirectory(debugFolder);
+                    core.debug(`Successfully cleaned up debug dump.`);
+                }
+            }
         }
         catch (error) {
             core.setFailed(error);
@@ -121,3 +171,60 @@ function run(inputArgs, telemetryEnvironment = 'github') {
     });
 }
 exports.run = run;
+function getZippedFolder(dir) {
+    core.debug(`Zipping up folder: ${dir}`);
+    let allPaths = getFilePathsRecursively(dir);
+    const zip = new AdmZip();
+    for (let filePath of allPaths) {
+        core.debug(`Adding file to archive: ${filePath}`);
+        zip.addLocalFile(filePath);
+    }
+    let destPath = `${dir}.zip`;
+    core.debug(`Writing to file: ${destPath}`);
+    zip.writeZip(destPath);
+    if (fs.existsSync(destPath)) {
+        core.debug(`Successfully wrote file: ${destPath}`);
+    }
+    else {
+        core.debug(`Something went wrong! File does not exist: ${destPath}`);
+    }
+    return destPath;
+}
+function getFilePathsRecursively(dir) {
+    core.debug(`Searching for files under dir: ${dir}`);
+    var files = [];
+    let fileList = fs.readdirSync(dir);
+    var remaining = fileList.length;
+    if (!remaining)
+        return files;
+    for (let file of fileList) {
+        file = path.resolve(dir, file);
+        let stat = fs.statSync(file);
+        if (stat && stat.isDirectory()) {
+            let f = getFilePathsRecursively(file);
+            files = files.concat(f);
+        }
+        else {
+            files.push(file);
+        }
+        if (!--remaining) {
+            return files;
+        }
+    }
+}
+function cleanupDirectory(dir) {
+    if (!fs.existsSync(dir))
+        return;
+    let items = fs.readdirSync(dir);
+    for (let item of items) {
+        item = path.resolve(dir, item);
+        let stat = fs.statSync(item);
+        if (stat && stat.isDirectory()) {
+            cleanupDirectory(item);
+        }
+        else {
+            fs.unlinkSync(item);
+        }
+    }
+    fs.rmdirSync(dir);
+}
diff --git a/node_modules/@microsoft/security-devops-actions-toolkit/package.json b/node_modules/@microsoft/security-devops-actions-toolkit/package.json
index 0bc16f5a..e6c74f7a 100644
--- a/node_modules/@microsoft/security-devops-actions-toolkit/package.json
+++ b/node_modules/@microsoft/security-devops-actions-toolkit/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@microsoft/security-devops-actions-toolkit",
-    "version": "1.7.2",
+    "version": "1.8.1-beta1",
     "description": "Microsoft Security DevOps for GitHub Actions toolkit.",
     "author": "Microsoft Corporation",
     "license": "MIT",
diff --git a/package-lock.json b/package-lock.json
index ba687a4b..9049fe71 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -11,7 +11,7 @@
             "dependencies": {
                 "@actions/core": "1.10.0",
                 "@actions/exec": "1.1.1",
-                "@microsoft/security-devops-actions-toolkit": "1.7.2"
+                "@microsoft/security-devops-actions-toolkit": "1.8.1-beta1"
             },
             "devDependencies": {
                 "@types/mocha": "^2.2.44",
@@ -59,9 +59,9 @@
             "license": "MIT"
         },
         "node_modules/@microsoft/security-devops-actions-toolkit": {
-            "version": "1.7.2",
-            "resolved": "https://npm.pkg.github.com/download/@microsoft/security-devops-actions-toolkit/1.7.2/02c4a981c8e32a8493f70b30e5b4e94f7b887c43",
-            "integrity": "sha512-RQfwjcLogpA0IhBM+tWp1PxfqCcr/OzRg/FdBLX3PjWyzCvRXjNPQd5VsXUn67HSCtqOXKbaUE490p4ECUiMbQ==",
+            "version": "1.8.1-beta1",
+            "resolved": "https://npm.pkg.github.com/download/@microsoft/security-devops-actions-toolkit/1.8.1-beta1/587c31668ca0eca658c1bc333070c22cbb50742b",
+            "integrity": "sha512-YHfJpTolHxFULAXr+dBrS9Hcr8vI2AfQto8Mbgs9DhCd9tZQDacF/2/OO6T0xlAVakQc3o9vilZSBILiyPN7GA==",
             "license": "MIT",
             "dependencies": {
                 "@actions/core": "1.10.0",
@@ -5395,9 +5395,9 @@
             "integrity": "sha1-L2FLbmnOFNGRGARR6zjmV2puayc="
         },
         "@microsoft/security-devops-actions-toolkit": {
-            "version": "1.7.2",
-            "resolved": "https://npm.pkg.github.com/download/@microsoft/security-devops-actions-toolkit/1.7.2/02c4a981c8e32a8493f70b30e5b4e94f7b887c43",
-            "integrity": "sha512-RQfwjcLogpA0IhBM+tWp1PxfqCcr/OzRg/FdBLX3PjWyzCvRXjNPQd5VsXUn67HSCtqOXKbaUE490p4ECUiMbQ==",
+            "version": "1.8.1-beta1",
+            "resolved": "https://npm.pkg.github.com/download/@microsoft/security-devops-actions-toolkit/1.8.1-beta1/587c31668ca0eca658c1bc333070c22cbb50742b",
+            "integrity": "sha512-YHfJpTolHxFULAXr+dBrS9Hcr8vI2AfQto8Mbgs9DhCd9tZQDacF/2/OO6T0xlAVakQc3o9vilZSBILiyPN7GA==",
             "requires": {
                 "@actions/core": "1.10.0",
                 "@actions/exec": "1.1.1",
diff --git a/package.json b/package.json
index 4191d309..328f0d4b 100644
--- a/package.json
+++ b/package.json
@@ -10,7 +10,7 @@
     "dependencies": {
         "@actions/core": "1.10.0",
         "@actions/exec": "1.1.1",
-        "@microsoft/security-devops-actions-toolkit": "1.7.2"
+        "@microsoft/security-devops-actions-toolkit": "1.8.1-beta1"
     },
     "devDependencies": {
         "@types/mocha": "^2.2.44",

From b42096ba00edaeaffaa31883db922e6a8905fdaa Mon Sep 17 00:00:00 2001
From: Chris Nielsen <chrisnielsen@microsoft.com>
Date: Mon, 25 Sep 2023 09:23:00 -0700
Subject: [PATCH 16/32] Make test yml use my own action instead of the main
 fork

---
 .github/workflows/test-workflow.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/test-workflow.yml b/.github/workflows/test-workflow.yml
index 95d4f813..2714db69 100644
--- a/.github/workflows/test-workflow.yml
+++ b/.github/workflows/test-workflow.yml
@@ -38,7 +38,7 @@ jobs:
 
     # Run open source static analysis tools
     - name: Run Microsoft Security DevOps Analysis
-      uses: microsoft/security-devops-action@preview
+      uses: chrisnielsen-MS/security-devops-action@preview
       id: msdo
       with:
         tools: 'credscan'

From c0e626f2a519f6e03dfc271cea702383d7806241 Mon Sep 17 00:00:00 2001
From: Chris Nielsen <chrisnielsen@microsoft.com>
Date: Mon, 25 Sep 2023 09:25:28 -0700
Subject: [PATCH 17/32] Make test yml use my own action instead of the main
 fork

---
 .github/workflows/test-workflow.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/test-workflow.yml b/.github/workflows/test-workflow.yml
index 2714db69..d38ba040 100644
--- a/.github/workflows/test-workflow.yml
+++ b/.github/workflows/test-workflow.yml
@@ -38,7 +38,7 @@ jobs:
 
     # Run open source static analysis tools
     - name: Run Microsoft Security DevOps Analysis
-      uses: chrisnielsen-MS/security-devops-action@preview
+      uses: chrisnielsen-MS/security-devops-action@v1
       id: msdo
       with:
         tools: 'credscan'

From a59447d78aa7beaef27097045187172d10f15aa5 Mon Sep 17 00:00:00 2001
From: Chris Nielsen <chrisnielsen@microsoft.com>
Date: Mon, 25 Sep 2023 09:33:59 -0700
Subject: [PATCH 18/32] Make test yml use my own action instead of the main
 fork

---
 .github/workflows/test-workflow.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/test-workflow.yml b/.github/workflows/test-workflow.yml
index d38ba040..15b03409 100644
--- a/.github/workflows/test-workflow.yml
+++ b/.github/workflows/test-workflow.yml
@@ -38,7 +38,7 @@ jobs:
 
     # Run open source static analysis tools
     - name: Run Microsoft Security DevOps Analysis
-      uses: chrisnielsen-MS/security-devops-action@v1
+      uses: chrisnielsen-MS/security-devops-action@main
       id: msdo
       with:
         tools: 'credscan'

From 65f24fad016b8ceeabfa218b111eb4991b2ddfb8 Mon Sep 17 00:00:00 2001
From: Chris Nielsen <chrisnielsen@microsoft.com>
Date: Mon, 25 Sep 2023 11:53:10 -0700
Subject: [PATCH 19/32] Use updated actions toolkit

---
 package.json | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/package.json b/package.json
index 328f0d4b..44b99094 100644
--- a/package.json
+++ b/package.json
@@ -10,7 +10,7 @@
     "dependencies": {
         "@actions/core": "1.10.0",
         "@actions/exec": "1.1.1",
-        "@microsoft/security-devops-actions-toolkit": "1.8.1-beta1"
+        "@microsoft/security-devops-actions-toolkit": "1.8.1-beta2"
     },
     "devDependencies": {
         "@types/mocha": "^2.2.44",

From b539d0bad39b8f9140d29c966ba1e50309319847 Mon Sep 17 00:00:00 2001
From: Chris Nielsen <chrisnielsen@microsoft.com>
Date: Mon, 25 Sep 2023 12:07:39 -0700
Subject: [PATCH 20/32] Use updated actions toolkit package

---
 node_modules/.package-lock.json                    |  6 +++---
 .../security-devops-actions-toolkit/msdo-client.js |  8 ++------
 .../security-devops-actions-toolkit/package.json   |  2 +-
 package-lock.json                                  | 14 +++++++-------
 4 files changed, 13 insertions(+), 17 deletions(-)

diff --git a/node_modules/.package-lock.json b/node_modules/.package-lock.json
index f4e76d45..8d0041e6 100644
--- a/node_modules/.package-lock.json
+++ b/node_modules/.package-lock.json
@@ -37,9 +37,9 @@
             "license": "MIT"
         },
         "node_modules/@microsoft/security-devops-actions-toolkit": {
-            "version": "1.8.1-beta1",
-            "resolved": "https://npm.pkg.github.com/download/@microsoft/security-devops-actions-toolkit/1.8.1-beta1/587c31668ca0eca658c1bc333070c22cbb50742b",
-            "integrity": "sha512-YHfJpTolHxFULAXr+dBrS9Hcr8vI2AfQto8Mbgs9DhCd9tZQDacF/2/OO6T0xlAVakQc3o9vilZSBILiyPN7GA==",
+            "version": "1.8.1-beta2",
+            "resolved": "https://npm.pkg.github.com/download/@microsoft/security-devops-actions-toolkit/1.8.1-beta2/1bc480beef01c35478f8896ea3fece713bb361b6",
+            "integrity": "sha512-DdGjJ9/F2qVW6uF1wO/Z08KAv8GX6WVxAihjtT9CpJ8Bz/ke91rFa4LCgexAzHCep+g3N5xFTuihEJAz122BCA==",
             "license": "MIT",
             "dependencies": {
                 "@actions/core": "1.10.0",
diff --git a/node_modules/@microsoft/security-devops-actions-toolkit/msdo-client.js b/node_modules/@microsoft/security-devops-actions-toolkit/msdo-client.js
index c0e7ef0f..7a19c3ec 100644
--- a/node_modules/@microsoft/security-devops-actions-toolkit/msdo-client.js
+++ b/node_modules/@microsoft/security-devops-actions-toolkit/msdo-client.js
@@ -140,21 +140,17 @@ function run(inputArgs, telemetryEnvironment = 'github') {
                 if (fs.existsSync(debugFolder)) {
                     core.debug("Creating debug drop archive...");
                     let zippedOutput = getZippedFolder(debugFolder);
-                    const taskFilePath = path.join(taskFolder, `task.json`);
-                    core.debug(`taskFilePath = ${taskFilePath}`);
-                    const taskFile = require(taskFilePath);
-                    const taskName = taskFile.name.toUpperCase();
                     const instanceDirectory = process.env.GITHUB_WORKSPACE;
                     debugStagingDir = path.join(instanceDirectory, '.gdn', 'debugdrop');
                     if (!fs.existsSync(debugStagingDir)) {
                         core.debug(`Creating missing folder: ${debugStagingDir}`);
                         fs.mkdirSync(debugStagingDir);
                     }
-                    let debugDropArtifact = path.join(debugStagingDir, `${taskName}_debug.zip`);
+                    let debugDropArtifact = path.join(debugStagingDir, `debug.zip`);
                     let dupeCount = 0;
                     while (fs.existsSync(debugDropArtifact)) {
                         dupeCount += 1;
-                        debugDropArtifact = path.join(debugStagingDir, `${taskName}_${dupeCount}_debug.zip`);
+                        debugDropArtifact = path.join(debugStagingDir, `debug_${dupeCount}.zip`);
                     }
                     fs.copyFileSync(zippedOutput, debugDropArtifact);
                     core.debug(`Finished creating: ${debugDropArtifact}`);
diff --git a/node_modules/@microsoft/security-devops-actions-toolkit/package.json b/node_modules/@microsoft/security-devops-actions-toolkit/package.json
index e6c74f7a..b66dcdb8 100644
--- a/node_modules/@microsoft/security-devops-actions-toolkit/package.json
+++ b/node_modules/@microsoft/security-devops-actions-toolkit/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@microsoft/security-devops-actions-toolkit",
-    "version": "1.8.1-beta1",
+    "version": "1.8.1-beta2",
     "description": "Microsoft Security DevOps for GitHub Actions toolkit.",
     "author": "Microsoft Corporation",
     "license": "MIT",
diff --git a/package-lock.json b/package-lock.json
index 9049fe71..2792665f 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -11,7 +11,7 @@
             "dependencies": {
                 "@actions/core": "1.10.0",
                 "@actions/exec": "1.1.1",
-                "@microsoft/security-devops-actions-toolkit": "1.8.1-beta1"
+                "@microsoft/security-devops-actions-toolkit": "1.8.1-beta2"
             },
             "devDependencies": {
                 "@types/mocha": "^2.2.44",
@@ -59,9 +59,9 @@
             "license": "MIT"
         },
         "node_modules/@microsoft/security-devops-actions-toolkit": {
-            "version": "1.8.1-beta1",
-            "resolved": "https://npm.pkg.github.com/download/@microsoft/security-devops-actions-toolkit/1.8.1-beta1/587c31668ca0eca658c1bc333070c22cbb50742b",
-            "integrity": "sha512-YHfJpTolHxFULAXr+dBrS9Hcr8vI2AfQto8Mbgs9DhCd9tZQDacF/2/OO6T0xlAVakQc3o9vilZSBILiyPN7GA==",
+            "version": "1.8.1-beta2",
+            "resolved": "https://npm.pkg.github.com/download/@microsoft/security-devops-actions-toolkit/1.8.1-beta2/1bc480beef01c35478f8896ea3fece713bb361b6",
+            "integrity": "sha512-DdGjJ9/F2qVW6uF1wO/Z08KAv8GX6WVxAihjtT9CpJ8Bz/ke91rFa4LCgexAzHCep+g3N5xFTuihEJAz122BCA==",
             "license": "MIT",
             "dependencies": {
                 "@actions/core": "1.10.0",
@@ -5395,9 +5395,9 @@
             "integrity": "sha1-L2FLbmnOFNGRGARR6zjmV2puayc="
         },
         "@microsoft/security-devops-actions-toolkit": {
-            "version": "1.8.1-beta1",
-            "resolved": "https://npm.pkg.github.com/download/@microsoft/security-devops-actions-toolkit/1.8.1-beta1/587c31668ca0eca658c1bc333070c22cbb50742b",
-            "integrity": "sha512-YHfJpTolHxFULAXr+dBrS9Hcr8vI2AfQto8Mbgs9DhCd9tZQDacF/2/OO6T0xlAVakQc3o9vilZSBILiyPN7GA==",
+            "version": "1.8.1-beta2",
+            "resolved": "https://npm.pkg.github.com/download/@microsoft/security-devops-actions-toolkit/1.8.1-beta2/1bc480beef01c35478f8896ea3fece713bb361b6",
+            "integrity": "sha512-DdGjJ9/F2qVW6uF1wO/Z08KAv8GX6WVxAihjtT9CpJ8Bz/ke91rFa4LCgexAzHCep+g3N5xFTuihEJAz122BCA==",
             "requires": {
                 "@actions/core": "1.10.0",
                 "@actions/exec": "1.1.1",

From caae780c6977806cf37f9a03cfd7769ee42ec772 Mon Sep 17 00:00:00 2001
From: Chris Nielsen <chrisnielsen@microsoft.com>
Date: Tue, 26 Sep 2023 11:02:14 -0700
Subject: [PATCH 21/32] Use action outputs to upload debug drop

---
 .github/workflows/test-workflow.yml                | 11 ++++++-----
 node_modules/.package-lock.json                    |  6 +++---
 .../security-devops-actions-toolkit/msdo-client.js |  3 +++
 .../security-devops-actions-toolkit/package.json   |  2 +-
 package-lock.json                                  | 14 +++++++-------
 package.json                                       |  2 +-
 6 files changed, 21 insertions(+), 17 deletions(-)

diff --git a/.github/workflows/test-workflow.yml b/.github/workflows/test-workflow.yml
index 15b03409..6cc18068 100644
--- a/.github/workflows/test-workflow.yml
+++ b/.github/workflows/test-workflow.yml
@@ -55,8 +55,9 @@ jobs:
       with:
         sarif_file: ${{ steps.msdo.outputs.sarifFile }}
 
-    #   # Upload results to the Security tab
-    # - name: Upload results to Security tab
-    #   uses: github/codeql-action/upload-sarif@v1
-    #   with:
-    #     sarif_file: ${{ steps.msdolocal.outputs.sarifFile }}
+      # Upload debug drop file as a workflow artifact
+    - name: Upload alerts file as a workflow artifact
+      uses: actions/upload-artifact@v3
+      with:  
+        name: alerts
+        path: ${{ steps.msdo.outputs.debugDrop }}
diff --git a/node_modules/.package-lock.json b/node_modules/.package-lock.json
index 8d0041e6..21b11e97 100644
--- a/node_modules/.package-lock.json
+++ b/node_modules/.package-lock.json
@@ -37,9 +37,9 @@
             "license": "MIT"
         },
         "node_modules/@microsoft/security-devops-actions-toolkit": {
-            "version": "1.8.1-beta2",
-            "resolved": "https://npm.pkg.github.com/download/@microsoft/security-devops-actions-toolkit/1.8.1-beta2/1bc480beef01c35478f8896ea3fece713bb361b6",
-            "integrity": "sha512-DdGjJ9/F2qVW6uF1wO/Z08KAv8GX6WVxAihjtT9CpJ8Bz/ke91rFa4LCgexAzHCep+g3N5xFTuihEJAz122BCA==",
+            "version": "1.8.1-beta3",
+            "resolved": "https://npm.pkg.github.com/download/@microsoft/security-devops-actions-toolkit/1.8.1-beta3/f2fbef9191c0f612c0394c8acf771d9ab9ac1cc4",
+            "integrity": "sha512-KvfM0oZj7rRO8Jl/J8JaxyTc1H0YiKUZfRhd2plmE7ftPwFdKQHSXkWNqgEK6LZWr7bkYGzjqYrt1CdstT07LQ==",
             "license": "MIT",
             "dependencies": {
                 "@actions/core": "1.10.0",
diff --git a/node_modules/@microsoft/security-devops-actions-toolkit/msdo-client.js b/node_modules/@microsoft/security-devops-actions-toolkit/msdo-client.js
index 7a19c3ec..18de1a87 100644
--- a/node_modules/@microsoft/security-devops-actions-toolkit/msdo-client.js
+++ b/node_modules/@microsoft/security-devops-actions-toolkit/msdo-client.js
@@ -154,6 +154,9 @@ function run(inputArgs, telemetryEnvironment = 'github') {
                     }
                     fs.copyFileSync(zippedOutput, debugDropArtifact);
                     core.debug(`Finished creating: ${debugDropArtifact}`);
+                    core.debug(`DebugDrop = ${debugStagingDir}`);
+                    core.exportVariable('MSDO_DEBUG_DROP_FOLDER', debugStagingDir);
+                    core.setOutput('debugDrop', debugStagingDir);
                     core.debug(`Cleaning up: ${debugFolder}`);
                     cleanupDirectory(debugFolder);
                     core.debug(`Successfully cleaned up debug dump.`);
diff --git a/node_modules/@microsoft/security-devops-actions-toolkit/package.json b/node_modules/@microsoft/security-devops-actions-toolkit/package.json
index b66dcdb8..5999a5a6 100644
--- a/node_modules/@microsoft/security-devops-actions-toolkit/package.json
+++ b/node_modules/@microsoft/security-devops-actions-toolkit/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@microsoft/security-devops-actions-toolkit",
-    "version": "1.8.1-beta2",
+    "version": "1.8.1-beta3",
     "description": "Microsoft Security DevOps for GitHub Actions toolkit.",
     "author": "Microsoft Corporation",
     "license": "MIT",
diff --git a/package-lock.json b/package-lock.json
index 2792665f..f140e177 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -11,7 +11,7 @@
             "dependencies": {
                 "@actions/core": "1.10.0",
                 "@actions/exec": "1.1.1",
-                "@microsoft/security-devops-actions-toolkit": "1.8.1-beta2"
+                "@microsoft/security-devops-actions-toolkit": "1.8.1-beta3"
             },
             "devDependencies": {
                 "@types/mocha": "^2.2.44",
@@ -59,9 +59,9 @@
             "license": "MIT"
         },
         "node_modules/@microsoft/security-devops-actions-toolkit": {
-            "version": "1.8.1-beta2",
-            "resolved": "https://npm.pkg.github.com/download/@microsoft/security-devops-actions-toolkit/1.8.1-beta2/1bc480beef01c35478f8896ea3fece713bb361b6",
-            "integrity": "sha512-DdGjJ9/F2qVW6uF1wO/Z08KAv8GX6WVxAihjtT9CpJ8Bz/ke91rFa4LCgexAzHCep+g3N5xFTuihEJAz122BCA==",
+            "version": "1.8.1-beta3",
+            "resolved": "https://npm.pkg.github.com/download/@microsoft/security-devops-actions-toolkit/1.8.1-beta3/f2fbef9191c0f612c0394c8acf771d9ab9ac1cc4",
+            "integrity": "sha512-KvfM0oZj7rRO8Jl/J8JaxyTc1H0YiKUZfRhd2plmE7ftPwFdKQHSXkWNqgEK6LZWr7bkYGzjqYrt1CdstT07LQ==",
             "license": "MIT",
             "dependencies": {
                 "@actions/core": "1.10.0",
@@ -5395,9 +5395,9 @@
             "integrity": "sha1-L2FLbmnOFNGRGARR6zjmV2puayc="
         },
         "@microsoft/security-devops-actions-toolkit": {
-            "version": "1.8.1-beta2",
-            "resolved": "https://npm.pkg.github.com/download/@microsoft/security-devops-actions-toolkit/1.8.1-beta2/1bc480beef01c35478f8896ea3fece713bb361b6",
-            "integrity": "sha512-DdGjJ9/F2qVW6uF1wO/Z08KAv8GX6WVxAihjtT9CpJ8Bz/ke91rFa4LCgexAzHCep+g3N5xFTuihEJAz122BCA==",
+            "version": "1.8.1-beta3",
+            "resolved": "https://npm.pkg.github.com/download/@microsoft/security-devops-actions-toolkit/1.8.1-beta3/f2fbef9191c0f612c0394c8acf771d9ab9ac1cc4",
+            "integrity": "sha512-KvfM0oZj7rRO8Jl/J8JaxyTc1H0YiKUZfRhd2plmE7ftPwFdKQHSXkWNqgEK6LZWr7bkYGzjqYrt1CdstT07LQ==",
             "requires": {
                 "@actions/core": "1.10.0",
                 "@actions/exec": "1.1.1",
diff --git a/package.json b/package.json
index 44b99094..5deff738 100644
--- a/package.json
+++ b/package.json
@@ -10,7 +10,7 @@
     "dependencies": {
         "@actions/core": "1.10.0",
         "@actions/exec": "1.1.1",
-        "@microsoft/security-devops-actions-toolkit": "1.8.1-beta2"
+        "@microsoft/security-devops-actions-toolkit": "1.8.1-beta3"
     },
     "devDependencies": {
         "@types/mocha": "^2.2.44",

From 7bf473d89f67e0c889bd58dbefc7c66729e30c5c Mon Sep 17 00:00:00 2001
From: Chris Nielsen <chrisnielsen@microsoft.com>
Date: Tue, 26 Sep 2023 11:13:55 -0700
Subject: [PATCH 22/32] Use action outputs to upload debug drop

---
 .github/workflows/test-workflow.yml | 14 +++++++++++++-
 1 file changed, 13 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/test-workflow.yml b/.github/workflows/test-workflow.yml
index 6cc18068..01248788 100644
--- a/.github/workflows/test-workflow.yml
+++ b/.github/workflows/test-workflow.yml
@@ -42,6 +42,12 @@ jobs:
       id: msdo
       with:
         tools: 'credscan'
+
+    - name: Run Microsoft Security DevOps Analysis
+      uses: chrisnielsen-MS/security-devops-action@main
+      id: msdo2
+      with:
+        tools: 'credscan'
       #env:
       #  trivy_target: "contosofakeimage"
 
@@ -59,5 +65,11 @@ jobs:
     - name: Upload alerts file as a workflow artifact
       uses: actions/upload-artifact@v3
       with:  
-        name: alerts
+        name: debugDrop
         path: ${{ steps.msdo.outputs.debugDrop }}
+
+    - name: Upload alerts file as a workflow artifact
+      uses: actions/upload-artifact@v3
+      with:  
+        name: debugDrop2
+        path: ${{ steps.msdo2.outputs.debugDrop }}

From a7deef1c77038d590a8819fdadab0987d0205609 Mon Sep 17 00:00:00 2001
From: Chris Nielsen <chrisnielsen@microsoft.com>
Date: Tue, 26 Sep 2023 11:25:37 -0700
Subject: [PATCH 23/32] Use action outputs to upload debug drop

---
 .github/workflows/test-workflow.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/test-workflow.yml b/.github/workflows/test-workflow.yml
index 01248788..14d7a0cf 100644
--- a/.github/workflows/test-workflow.yml
+++ b/.github/workflows/test-workflow.yml
@@ -47,7 +47,7 @@ jobs:
       uses: chrisnielsen-MS/security-devops-action@main
       id: msdo2
       with:
-        tools: 'credscan'
+        tools: 'eslint'
       #env:
       #  trivy_target: "contosofakeimage"
 

From 1382eb9f706b92e322dff0e0d6bf2f9ad60c1b82 Mon Sep 17 00:00:00 2001
From: Chris Nielsen <chrisnielsen@microsoft.com>
Date: Tue, 26 Sep 2023 11:45:25 -0700
Subject: [PATCH 24/32] Can we get logs for two instances of MSDO in the same
 workflow

---
 node_modules/.package-lock.json                    |  6 +++---
 .../security-devops-actions-toolkit/msdo-client.js |  7 ++++---
 .../security-devops-actions-toolkit/package.json   |  2 +-
 package-lock.json                                  | 14 +++++++-------
 package.json                                       |  2 +-
 5 files changed, 16 insertions(+), 15 deletions(-)

diff --git a/node_modules/.package-lock.json b/node_modules/.package-lock.json
index 21b11e97..2fc79312 100644
--- a/node_modules/.package-lock.json
+++ b/node_modules/.package-lock.json
@@ -37,9 +37,9 @@
             "license": "MIT"
         },
         "node_modules/@microsoft/security-devops-actions-toolkit": {
-            "version": "1.8.1-beta3",
-            "resolved": "https://npm.pkg.github.com/download/@microsoft/security-devops-actions-toolkit/1.8.1-beta3/f2fbef9191c0f612c0394c8acf771d9ab9ac1cc4",
-            "integrity": "sha512-KvfM0oZj7rRO8Jl/J8JaxyTc1H0YiKUZfRhd2plmE7ftPwFdKQHSXkWNqgEK6LZWr7bkYGzjqYrt1CdstT07LQ==",
+            "version": "1.8.1-beta4",
+            "resolved": "https://npm.pkg.github.com/download/@microsoft/security-devops-actions-toolkit/1.8.1-beta4/f7e4b0d239f350ecf5006f0bc59b4de43d5ffc52",
+            "integrity": "sha512-XC9pnYPUmqWTIoIKYvO+vd48HM8xRq53+hO4DgAPTA8hnVOBOdx9NZTVGQj3b8/fUlrKo7qZoCkkyx5BePiYVQ==",
             "license": "MIT",
             "dependencies": {
                 "@actions/core": "1.10.0",
diff --git a/node_modules/@microsoft/security-devops-actions-toolkit/msdo-client.js b/node_modules/@microsoft/security-devops-actions-toolkit/msdo-client.js
index 18de1a87..3cdcd2ed 100644
--- a/node_modules/@microsoft/security-devops-actions-toolkit/msdo-client.js
+++ b/node_modules/@microsoft/security-devops-actions-toolkit/msdo-client.js
@@ -146,11 +146,12 @@ function run(inputArgs, telemetryEnvironment = 'github') {
                         core.debug(`Creating missing folder: ${debugStagingDir}`);
                         fs.mkdirSync(debugStagingDir);
                     }
-                    let debugDropArtifact = path.join(debugStagingDir, `debug.zip`);
-                    let dupeCount = 0;
+                    let debugDropArtifact = path.join(debugStagingDir, `MSDO_debug.zip`);
+                    let dupeCount = 1;
                     while (fs.existsSync(debugDropArtifact)) {
+                        core.debug(`Debug Drop with the name ${debugDropArtifact} already exists, updating name to avoid collision...`);
                         dupeCount += 1;
-                        debugDropArtifact = path.join(debugStagingDir, `debug_${dupeCount}.zip`);
+                        debugDropArtifact = path.join(debugStagingDir, `MSDO_debug_${dupeCount}.zip`);
                     }
                     fs.copyFileSync(zippedOutput, debugDropArtifact);
                     core.debug(`Finished creating: ${debugDropArtifact}`);
diff --git a/node_modules/@microsoft/security-devops-actions-toolkit/package.json b/node_modules/@microsoft/security-devops-actions-toolkit/package.json
index 5999a5a6..b1b6810c 100644
--- a/node_modules/@microsoft/security-devops-actions-toolkit/package.json
+++ b/node_modules/@microsoft/security-devops-actions-toolkit/package.json
@@ -1,6 +1,6 @@
 {
     "name": "@microsoft/security-devops-actions-toolkit",
-    "version": "1.8.1-beta3",
+    "version": "1.8.1-beta4",
     "description": "Microsoft Security DevOps for GitHub Actions toolkit.",
     "author": "Microsoft Corporation",
     "license": "MIT",
diff --git a/package-lock.json b/package-lock.json
index f140e177..5382178f 100644
--- a/package-lock.json
+++ b/package-lock.json
@@ -11,7 +11,7 @@
             "dependencies": {
                 "@actions/core": "1.10.0",
                 "@actions/exec": "1.1.1",
-                "@microsoft/security-devops-actions-toolkit": "1.8.1-beta3"
+                "@microsoft/security-devops-actions-toolkit": "1.8.1-beta4"
             },
             "devDependencies": {
                 "@types/mocha": "^2.2.44",
@@ -59,9 +59,9 @@
             "license": "MIT"
         },
         "node_modules/@microsoft/security-devops-actions-toolkit": {
-            "version": "1.8.1-beta3",
-            "resolved": "https://npm.pkg.github.com/download/@microsoft/security-devops-actions-toolkit/1.8.1-beta3/f2fbef9191c0f612c0394c8acf771d9ab9ac1cc4",
-            "integrity": "sha512-KvfM0oZj7rRO8Jl/J8JaxyTc1H0YiKUZfRhd2plmE7ftPwFdKQHSXkWNqgEK6LZWr7bkYGzjqYrt1CdstT07LQ==",
+            "version": "1.8.1-beta4",
+            "resolved": "https://npm.pkg.github.com/download/@microsoft/security-devops-actions-toolkit/1.8.1-beta4/f7e4b0d239f350ecf5006f0bc59b4de43d5ffc52",
+            "integrity": "sha512-XC9pnYPUmqWTIoIKYvO+vd48HM8xRq53+hO4DgAPTA8hnVOBOdx9NZTVGQj3b8/fUlrKo7qZoCkkyx5BePiYVQ==",
             "license": "MIT",
             "dependencies": {
                 "@actions/core": "1.10.0",
@@ -5395,9 +5395,9 @@
             "integrity": "sha1-L2FLbmnOFNGRGARR6zjmV2puayc="
         },
         "@microsoft/security-devops-actions-toolkit": {
-            "version": "1.8.1-beta3",
-            "resolved": "https://npm.pkg.github.com/download/@microsoft/security-devops-actions-toolkit/1.8.1-beta3/f2fbef9191c0f612c0394c8acf771d9ab9ac1cc4",
-            "integrity": "sha512-KvfM0oZj7rRO8Jl/J8JaxyTc1H0YiKUZfRhd2plmE7ftPwFdKQHSXkWNqgEK6LZWr7bkYGzjqYrt1CdstT07LQ==",
+            "version": "1.8.1-beta4",
+            "resolved": "https://npm.pkg.github.com/download/@microsoft/security-devops-actions-toolkit/1.8.1-beta4/f7e4b0d239f350ecf5006f0bc59b4de43d5ffc52",
+            "integrity": "sha512-XC9pnYPUmqWTIoIKYvO+vd48HM8xRq53+hO4DgAPTA8hnVOBOdx9NZTVGQj3b8/fUlrKo7qZoCkkyx5BePiYVQ==",
             "requires": {
                 "@actions/core": "1.10.0",
                 "@actions/exec": "1.1.1",
diff --git a/package.json b/package.json
index 5deff738..79dd1ae2 100644
--- a/package.json
+++ b/package.json
@@ -10,7 +10,7 @@
     "dependencies": {
         "@actions/core": "1.10.0",
         "@actions/exec": "1.1.1",
-        "@microsoft/security-devops-actions-toolkit": "1.8.1-beta3"
+        "@microsoft/security-devops-actions-toolkit": "1.8.1-beta4"
     },
     "devDependencies": {
         "@types/mocha": "^2.2.44",

From 866599fa06709871cf2533a28749ce2ca836f287 Mon Sep 17 00:00:00 2001
From: Chris Nielsen <chrisnielsen@microsoft.com>
Date: Tue, 26 Sep 2023 12:11:37 -0700
Subject: [PATCH 25/32] Can we get logs for two instances of MSDO in the same
 workflow

---
 .github/workflows/test-workflow.yml | 14 ++++++++------
 1 file changed, 8 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/test-workflow.yml b/.github/workflows/test-workflow.yml
index 14d7a0cf..5740f5a9 100644
--- a/.github/workflows/test-workflow.yml
+++ b/.github/workflows/test-workflow.yml
@@ -43,6 +43,13 @@ jobs:
       with:
         tools: 'credscan'
 
+      # Upload debug drop file as a workflow artifact
+    - name: Upload alerts file as a workflow artifact
+      uses: actions/upload-artifact@v3
+      with:  
+        name: debugDrop
+        path: ${{ steps.msdo.outputs.debugDrop }}
+
     - name: Run Microsoft Security DevOps Analysis
       uses: chrisnielsen-MS/security-devops-action@main
       id: msdo2
@@ -61,12 +68,7 @@ jobs:
       with:
         sarif_file: ${{ steps.msdo.outputs.sarifFile }}
 
-      # Upload debug drop file as a workflow artifact
-    - name: Upload alerts file as a workflow artifact
-      uses: actions/upload-artifact@v3
-      with:  
-        name: debugDrop
-        path: ${{ steps.msdo.outputs.debugDrop }}
+
 
     - name: Upload alerts file as a workflow artifact
       uses: actions/upload-artifact@v3

From e2baff51419f5b5a1a56a88abaf048580b21d429 Mon Sep 17 00:00:00 2001
From: Chris Nielsen <chrisnielsen@microsoft.com>
Date: Wed, 27 Mar 2024 09:41:39 -0700
Subject: [PATCH 26/32] Edit workflow for testing'

---
 .github/workflows/on-push-verification.yml | 6 +++++-
 1 file changed, 5 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/on-push-verification.yml b/.github/workflows/on-push-verification.yml
index c45e79fb..ce818e95 100644
--- a/.github/workflows/on-push-verification.yml
+++ b/.github/workflows/on-push-verification.yml
@@ -25,8 +25,12 @@ jobs:
     - uses: actions/checkout@v3
 
       # Run analyzers
-    - uses: ./
+    - uses: microsoft/security-devops-action
       id: msdo
+      env:
+        checkov_skippath: 'SecureApp'
+      with:
+        tools: 'checkov'
 
       # Upload alerts to the Security tab
     - name: Upload alerts to Security tab

From 4adea5c5e51108d52d3cbc03ec6ba64cebdc7170 Mon Sep 17 00:00:00 2001
From: Chris Nielsen <chrisnielsen@microsoft.com>
Date: Wed, 27 Mar 2024 09:43:06 -0700
Subject: [PATCH 27/32] Edit workflow for testing'

---
 .github/workflows/on-push-verification.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/on-push-verification.yml b/.github/workflows/on-push-verification.yml
index ce818e95..52c821d2 100644
--- a/.github/workflows/on-push-verification.yml
+++ b/.github/workflows/on-push-verification.yml
@@ -25,7 +25,7 @@ jobs:
     - uses: actions/checkout@v3
 
       # Run analyzers
-    - uses: microsoft/security-devops-action
+    - uses: microsoft/security-devops-action@main
       id: msdo
       env:
         checkov_skippath: 'SecureApp'

From e63b1523ca6f88cadaa578c4935e87ace4926bb5 Mon Sep 17 00:00:00 2001
From: Chris Nielsen <chrisnielsen@microsoft.com>
Date: Wed, 27 Mar 2024 09:44:27 -0700
Subject: [PATCH 28/32] Edit workflow for testing'

---
 .github/workflows/on-push-verification.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/on-push-verification.yml b/.github/workflows/on-push-verification.yml
index 52c821d2..ac99f8d6 100644
--- a/.github/workflows/on-push-verification.yml
+++ b/.github/workflows/on-push-verification.yml
@@ -17,7 +17,7 @@ jobs:
 
     strategy:
       matrix:
-        os: [windows-latest, ubuntu-latest]
+        os: [windows-latest] #, ubuntu-latest]
 
     steps:
 

From e01cb7cc9eab786dd3bccbc8b6a4e0af8ebb8711 Mon Sep 17 00:00:00 2001
From: Chris Nielsen <chrisnielsen@microsoft.com>
Date: Wed, 27 Mar 2024 09:52:26 -0700
Subject: [PATCH 29/32] Edit workflow for testing'

---
 .github/workflows/on-push-verification.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/on-push-verification.yml b/.github/workflows/on-push-verification.yml
index ac99f8d6..f240d165 100644
--- a/.github/workflows/on-push-verification.yml
+++ b/.github/workflows/on-push-verification.yml
@@ -28,7 +28,7 @@ jobs:
     - uses: microsoft/security-devops-action@main
       id: msdo
       env:
-        checkov_skippath: 'SecureApp'
+        gdn_checkov_skippath: 'SecureApp'
       with:
         tools: 'checkov'
 

From 1dd090d57546fbc338ce112cd1aa9dbc73518823 Mon Sep 17 00:00:00 2001
From: Chris Nielsen <chrisnielsen@microsoft.com>
Date: Tue, 23 Apr 2024 10:41:00 -0700
Subject: [PATCH 30/32] Remove checkov specification and let msdo run on policy

---
 .github/workflows/on-push-verification.yml | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/on-push-verification.yml b/.github/workflows/on-push-verification.yml
index f240d165..0fe56c61 100644
--- a/.github/workflows/on-push-verification.yml
+++ b/.github/workflows/on-push-verification.yml
@@ -27,10 +27,10 @@ jobs:
       # Run analyzers
     - uses: microsoft/security-devops-action@main
       id: msdo
-      env:
-        gdn_checkov_skippath: 'SecureApp'
-      with:
-        tools: 'checkov'
+      #env:
+      #  gdn_checkov_skippath: 'SecureApp'
+      #with:
+      #  tools: 'checkov'
 
       # Upload alerts to the Security tab
     - name: Upload alerts to Security tab

From 04e053aaabfb17b475ad789980b1d229d7169246 Mon Sep 17 00:00:00 2001
From: Chris Nielsen <chrisnielsen@microsoft.com>
Date: Fri, 18 Oct 2024 12:54:01 -0700
Subject: [PATCH 31/32] Test node20 action

---
 .github/workflows/sample-workflow.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/sample-workflow.yml b/.github/workflows/sample-workflow.yml
index 052df605..f96efc46 100644
--- a/.github/workflows/sample-workflow.yml
+++ b/.github/workflows/sample-workflow.yml
@@ -24,7 +24,7 @@ jobs:
 
       # Run analyzers
     - name: Run Microsoft Security DevOps Analysis
-      uses: microsoft/security-devops-action@v1
+      uses: microsoft/security-devops-action@feature/node20
       id: msdo
 
       # Upload alerts to the Security tab

From 3e8a7a4d3c5609ff9ed1e513286219f3a69cded1 Mon Sep 17 00:00:00 2001
From: Chris Nielsen <chrisnielsen@microsoft.com>
Date: Tue, 24 Jun 2025 15:17:28 -0700
Subject: [PATCH 32/32] Try out upload artifact v4 because v3 is now
 deprecated.

---
 .github/workflows/on-push-verification.yml | 2 +-
 .github/workflows/sample-workflow.yml      | 2 +-
 .github/workflows/test-workflow.yml        | 2 +-
 3 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/on-push-verification.yml b/.github/workflows/on-push-verification.yml
index 0fe56c61..6ed04930 100644
--- a/.github/workflows/on-push-verification.yml
+++ b/.github/workflows/on-push-verification.yml
@@ -40,7 +40,7 @@ jobs:
 
       # Upload alerts file as a workflow artifact
     - name: Upload alerts file as a workflow artifact
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:  
         name: alerts
         path: ${{ steps.msdo.outputs.sarifFile }}
diff --git a/.github/workflows/sample-workflow.yml b/.github/workflows/sample-workflow.yml
index f96efc46..e56ecdf8 100644
--- a/.github/workflows/sample-workflow.yml
+++ b/.github/workflows/sample-workflow.yml
@@ -35,7 +35,7 @@ jobs:
 
       # Upload alerts file as a workflow artifact
     - name: Upload alerts file as a workflow artifact
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:  
         name: alerts
         path: ${{ steps.msdo.outputs.sarifFile }}
diff --git a/.github/workflows/test-workflow.yml b/.github/workflows/test-workflow.yml
index 5740f5a9..a32f3d45 100644
--- a/.github/workflows/test-workflow.yml
+++ b/.github/workflows/test-workflow.yml
@@ -71,7 +71,7 @@ jobs:
 
 
     - name: Upload alerts file as a workflow artifact
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:  
         name: debugDrop2
         path: ${{ steps.msdo2.outputs.debugDrop }}