azure-pipelines-codeql.yml

parameters:
  # Optionally do not publish to TSA. Useful for e.g. verifying fixes before PR.
- name: TSAEnabled
  displayName: Publish results to TSA
  type: boolean
  default: true

variables:
  # CG is handled in the primary CI pipeline
- name: skipComponentGovernanceDetection
  value: true
  # Force CodeQL enabled so it may be run on any branch
- name: Codeql.Enabled
  value: true
  # Do not let CodeQL 3000 Extension gate scan frequency
- name: Codeql.Cadence
  value: 0
  # CodeQL needs this plumbed along as a variable to enable TSA
- name: Codeql.TSAEnabled
  value: ${{ parameters.TSAEnabled }}

trigger: none

schedules:
  - cron: 0 12 * * 1
    displayName: Weekly Monday CodeQL run
    branches:
      include:
      - main
    always: true

stages:
- stage: CodeQL
  displayName: CodeQL

  jobs:
  - job: codeql_windows
    displayName: CodeQL
    pool:
      name: NetCore1ESPool-Internal
      demands: ImageOverride -equals windows.vs2019.amd64

    steps:
    - task: UseDotNet@2
      displayName: Install .NET Sdk
      inputs:
        useGlobalJson: true

    - task: CodeQL3000Init@0
      displayName: CodeQL Initialize

    - task: DotNetCoreCLI@2
      displayName: dotnet restore
      inputs:
        command: custom
        custom: restore
        projects: |
          **\*.sln

    - task: DotNetCoreCLI@2
      displayName: dotnet build
      inputs:
        command: 'build'
        projects: |
          src\source-indexer.sln
          src\SourceBrowser\SourceBrowser.sln
        arguments: '/p:PackageOutputPath=$(Build.ArtifactStagingDirectory)/packages'

    - task: CodeQL3000Finalize@0
      displayName: CodeQL Finalize