Repository navigation
Conversation
Explicitly configure the nightly CodeQL job to scan C#, C/C++, Swift, PowerShell, Actions, Python, and JavaScript instead of relying on language autodetection on macOS ARM64. Keep the language selection local to this job, preserving shared defaults, the main-only schedule, ARM64 pool requirements, and the existing CodeQL enablement setting. Add an optional, default-empty postAnalysisSteps stepList to the shared build template. Run it after CodeQL finalization and before teardown so callers can perform non-compilation work outside the tracing window while certificates and other build resources are still available. Preserve the existing buildSteps hook between compilation and finalization. Move the nightly package assembly and artifact publication steps into postAnalysisSteps. Keep their commands, conditions, timeouts, and artifact settings unchanged; the main build still runs make all and make install inside the tracing window. Use always() for CodeQL finalization so cancellation can still attempt to finish analysis and clean up tracing. Retain the CodeQL-enabled and main-branch guards. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7ce9eddd-f371-46aa-8ddd-b7b1d3028375
There was a problem hiding this comment.
🔵 Needs a closer look
The selected languages’ support on macOS ARM64 and cancellation cleanup need validation with the internal CodeQL tasks in Azure Pipelines.
0 open findings
What changed in this PR
Configures nightly CodeQL scanning explicitly and separates package publication from the analysis tracing window.
Changes:
- Selects seven languages locally in the nightly job.
- Adds a default-empty
postAnalysisStepshook and moves nightly packaging and publication into it. - Uses
always()for finalization while retaining enablement and main-branch guards.
| File | Description |
|---|---|
| tools/devops/automation/templates/build/build.yml | Adds the post-analysis hook before teardown and updates finalization conditions. |
| tools/devops/automation/run-nightly-codeql.yml | Sets explicit languages and moves packaging and publication after analysis. |
🧠 Review effort: Balanced
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
This comment has been minimized.
| - ${{ each step in parameters.postAnalysisSteps }}: | ||
| - ${{ each pair in step }}: | ||
| ${{ pair.key }}: ${{ pair.value }} |
There was a problem hiding this comment.
Why do anything at all after analysis is done/finalized?
There was a problem hiding this comment.
yep you are right that is not really needed
|
It's in beta, which it was last time I checked, and it's using Rosetta, which is what was causing the problem in the first place:
that said, it was Mono causing problems, and we're not using Mono anymore, so maybe everything will be fine now! |
| displayName: CodeQL | ||
| timeoutInMinutes: 480 | ||
| variables: | ||
| Codeql.Language: csharp,cpp,swift,powershell,actions,python,javascript |
There was a problem hiding this comment.
Updating the PR title + description before merging to make it accurate would be good.
✅ API diff for current PR / commitNET (empty diffs)✅ API diff vs stableNET (empty diffs)ℹ️ Generator diffGenerator Diff: vsdrops (html) vsdrops (raw diff) gist (raw diff) - Please review changes) Pipeline on Agent |
🔥 [CI Build #5819a59] Test results 🔥Test results❌ Tests failed on VSTS: test results 0 tests crashed, 3 tests failed, 218 tests passed. Failures❌ dotnettests tests (macOS)1 tests failed, 0 tests passed.Failed tests
Html Report (VSDrops) Download ❌ monotouch tests (iOS)2 tests failed, 18 tests passed.Failed tests
Html Report (VSDrops) Download Successes✅ assembly-processing: All 1 tests passed. Html Report (VSDrops) Download macOS tests✅ Tests on macOS Sonoma (14): All 5 tests passed. Html Report (VSDrops) Download Linux Build VerificationPipeline on Agent |
| displayName: CodeQL | ||
| timeoutInMinutes: 480 | ||
| variables: | ||
| Codeql.Language: csharp,cpp,swift,powershell,actions,python,javascript |
There was a problem hiding this comment.
Updating the PR title + description before merging to make it accurate would be good.
Looks like codeQL runs on arm64 now
Explicitly configure the nightly CodeQL job to scan C#, C/C++, Swift, PowerShell, Actions, Python, and JavaScript instead of relying on language autodetection on macOS ARM64. Keep the language selection local to this job, preserving shared defaults, the main-only schedule, ARM64 pool requirements, and the existing CodeQL enablement setting.
Add an optional, default-empty postAnalysisSteps stepList to the shared build template. Run it after CodeQL finalization and before teardown so callers can perform non-compilation work outside the tracing window while certificates and other build resources are still available. Preserve the existing buildSteps hook between compilation and finalization.
Move the nightly package assembly and artifact publication steps into postAnalysisSteps. Keep their commands, conditions, timeouts, and artifact settings unchanged; the main build still runs make all and make install inside the tracing window.
Use always() for CodeQL finalization so cancellation can still attempt to finish analysis and clean up tracing. Retain the CodeQL-enabled and main-branch guards.