Skip to content

Update CodeQL pipeline template and demands #8633

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
Evangelink merged 1 commit into from
May 27, 2026
Merged

Update CodeQL pipeline template and demands #8633

Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
4 changes: 2 additions & 2 deletions azure-pipelines-codeql.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -6,7 +6,7 @@ parameters:
default: true

variables:
- template: /eng/common/templates-official/variables/pool-providers.yml@self
- template: /eng/common/templates-official/variables/pool-providers.yml
# CG is handled in the primary CI pipeline
- name: skipComponentGovernanceDetection
value: true
Expand Down Expand Up @@ -43,7 +43,7 @@ jobs:
displayName: CodeQL
pool:
name: $(DncEngInternalBuildPool)
demands: ImageOverride -equals windows.vs2026preview.scout.amd64
demands: ImageOverride -equals windows.vs2026.amd64

@Evangelink Evangelink May 27, 2026

Copy link
Copy Markdown
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[MODERATE] Build Infrastructure & Dependencies

This image change moves from windows.vs2026preview.scout.amd64 to the stable windows.vs2026.amd64 variant, removing Scout preview capabilities.

Inconsistency with official pipeline:

  • azure-pipelines-official.yml lines 89 and 118 still use windows.vs2026preview.scout.amd64
  • This creates divergence: CodeQL analysis runs on different tooling than actual product builds

Risk scenario:
If the stable image lacks CodeQL-specific tools or has incompatible versions, the daily CodeQL scheduled runs may fail at CodeQL3000Init@0 or CodeQL3000Finalize@0 steps.

Questions:

  1. Has this been validated with a test CodeQL run on the stable image?
  2. Is the official pipeline planned to be updated similarly, or is the divergence intentional?
  3. Does the Scout image provide any CodeQL-specific capabilities that the stable image lacks?

Recommendation: Before merging, either:

  • Verify via test run that CodeQL functions correctly on windows.vs2026.amd64, or
  • Document why CodeQL can use stable image while official builds still need Scout preview

timeoutInMinutes: 90

steps:
Expand Down
Loading