Make CodeQL opt-in per job instead of auto-injected everywhere - #141
Merged
Ewerton Scaboro da Silva (ewertons) merged 1 commit intoAug 11, 2026
Merged
Conversation
The 1ES policy decorator injects CodeQL into every job of this pipeline. S360 records arg_max(SnapshotDate) per (repo, language), so a database produced incidentally by a job that does not build the product silently replaces the one from the job that does. That is exactly what this repo hit: the "Database failed to finalize or no source code was built!" entry in the Microsoft.Security.CodeQL.10000 report comes from the auto-injected CodeQL in the 'Linux Ubuntu 24.04' job of the integrate-into-repo-uhttp pipeline (def 114, build 161370) -- a job that does not produce a CodeQL-traceable build. Turn CodeQL off at pipeline level and opt back in on the 'windowsx64' job, which already runs CodeQL3000Init/Finalize around a real x64 build and is the intended owner of this repo's cpp snapshot -- the only language this repo is graded on. The job-level variable overrides the pipeline-level default and stays gated on refs/heads/master, so PR builds are unaffected. The now-redundant per-job CodeQL.Enabled: false entries on checksubmodule, OSX and xcodenative were removed; the pipeline-level default covers them.
Copilot started reviewing on behalf of
Ewerton Scaboro da Silva (ewertons)
August 11, 2026 05:51
View session
There was a problem hiding this comment.
Pull request overview
This PR updates the Azure DevOps pipeline configuration to prevent 1ES policy auto-injection of CodeQL from running (and uploading snapshots) on every job, and instead enables CodeQL only for the single job intended to produce the authoritative C++ database for S360.
Changes:
- Adds a pipeline-level
Codeql.Enabled: falseto globally disable injected CodeQL behavior. - Opts the
windowsx64job back into CodeQL onrefs/heads/masterand setsCodeql.Language: cpp. - Removes now-redundant per-job
CodeQL.Enabled: falseoverrides from jobs that don’t own the CodeQL snapshot.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Raul Leclair (RLeclair)
approved these changes
Aug 11, 2026
Ewerton Scaboro da Silva (ewertons)
deleted the
ewertons/codeql-opt-in-per-job
branch
August 11, 2026 20:49
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The 1ES policy decorator injects CodeQL into every job of
build/.vsts-ci.yml. S360 recordsarg_max(SnapshotDate)per(repo, language), so a database produced incidentally by a job that does not build the product silently replaces the one from the job that does.This repo is a direct victim. Its "Database failed to finalize or no source code was built!" entry in the
Microsoft.Security.CodeQL.10000report comes from the auto-injected CodeQL in theLinux Ubuntu 24.04job of theintegrate-into-repo-uhttppipeline (def 114, build 161370) — a job that produces no CodeQL-traceable build.Change
Turn CodeQL off at pipeline level and opt back in on the one job that deliberately builds for it:
Codeql.Languagewindowsx64cpp— the only language this repo is graded onThat job already runs
CodeQL3000Init/CodeQL3000Finalizearound a real x64 build, so this only removes the competing and failing uploads. The job-level variable overrides the pipeline-level default and stays gated onrefs/heads/master, so PR builds are unaffected.The now-redundant per-job
CodeQL.Enabled: falseentries onchecksubmodule,OSXandxcodenativewere removed — the pipeline-level default covers them.Verification
Enabled = falsethe injected task still appears in the timeline but no-ops in ~20 s (measured on the sibling C SDK, which already used this opt-out on its macOS jobs).Cadence = 72hours, comfortably inside the 30-day recurrent SLA.Same change as Azure/azure-iot-sdk-c#2743.