Enable codeQL for scheduled CI jobs (#23941)

This will enable codeQL to run on all scheduled CI jobs across all services.
Azure · Feb 9, 2023 · d8b29df · d8b29df
1 parent 1c13f6e
commit d8b29df
Show file tree

Hide file tree

Showing 3 changed files with 8 additions and 3 deletions.
diff --git a/eng/pipelines/templates/jobs/ci.yml b/eng/pipelines/templates/jobs/ci.yml
@@ -29,7 +29,9 @@ parameters:
 jobs:
   - job: "Build"
     variables:
-      - template: ../variables/globals.yml
+      Codeql.Enabled: true
+      Codeql.BuildIdentifier: ${{ parameters.ServiceDirectory }}
+      Codeql.SkipTaskAutoInjection: false
 
     pool:
       name: azsdk-pool-mms-ubuntu-2004-general
@@ -51,8 +53,6 @@ jobs:
           IncludeRelease: ${{ parameters.IncludeRelease }}
 
   - job: "Analyze"
-    variables:
-      - template: ../variables/globals.yml
 
     pool:
       name: azsdk-pool-mms-ubuntu-2004-general

diff --git a/eng/pipelines/templates/stages/archetype-sdk-client.yml b/eng/pipelines/templates/stages/archetype-sdk-client.yml
@@ -40,6 +40,9 @@ parameters:
     type: object
     default: []
 
+variables:
+  - template: ../variables/globals.yml
+
 stages:
   - stage: Build
     jobs:

diff --git a/eng/pipelines/templates/variables/globals.yml b/eng/pipelines/templates/variables/globals.yml
@@ -6,5 +6,7 @@ variables:
   coalesceResultFilter: $[ coalesce(variables['packageGlobFilter'], '**') ]
   ServiceVersion: ""
   Package.EnableSBOMSigning: true
+  # Disable CodeQL injections except for where we specifically enable it
+  Codeql.SkipTaskAutoInjection: true
   # Disable warning until issue 21765 and 21766 are closed
   DisableDockerDetector: true