[Copilot]

CodeQL only analyzed eng/_util, leaving production code such as cryptobackend unscanned. Expand analysis to all repository Go modules while excluding the upstream go submodule.

• CodeQL build coverage
  • Replace the eng/_util-only autobuild with module discovery via go.mod.
  • Build each discovered module with go build ./....
  • Exclude paths under ./go/*.

find . -name go.mod -not -path './go/*' -print0

[azure-pipelines]

Azure Pipelines:
Successfully started running 1 pipeline(s).
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🟡 Changes recommended

The default build excludes the production Linux crypto backend implementations from analysis.

1 open finding

• Enable crypto backend build tags for production Linux code scanning · New

What changed in this PR

Expands CodeQL analysis beyond eng/_util to Go modules throughout the repository.

Changes:

• Replaces autobuild with module discovery and explicit go build ./... calls.
• Excludes the upstream go submodule.

File	Description
.github/​workflows/​codeql.yml	Builds discovered repository Go modules for CodeQL analysis.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟢 Approval recommended

The workflow addresses the module and backend coverage gaps with no unresolved findings.

0 open findings

1 resolved since last review

• Enable crypto backend build tags for production Linux code scanning

🧠 Review effort: Balanced

[Davis Goodin (dagood)]

This PR touches the GitHub side CodeQL. What about AzDO side?

[George Adams (gdams)]

This PR touches the GitHub side CodeQL. What about AzDO side?

is there a requirement which says we need to run CodeQL on both sides?

[Davis Goodin (dagood)]

Requirements don't typically take into account the mirroring process, so I doubt it's cut and dry what they say. Practically it's about s360 alerts I suppose. If we don't need to run both sides, we should remove the other side, which we currently have not.

[George Adams (gdams)]

I was able to significantly simply this by essentially stripping the go submodule from the working directory and running the default CodeQL autobuild.