azure-pipeline-codeql.yml

parameters:
  # Optionally do not publish to TSA. Useful for e.g. verifying fixes before PR.
- name: TSAEnabled
  displayName: Publish results to TSA
  type: boolean
  default: true

variables:
  # CG is handled in the primary CI pipeline
- name: skipComponentGovernanceDetection
  value: true
  # Force CodeQL enabled so it may be run on any branch
- name: Codeql.Enabled
  value: true
  # Do not let CodeQL 3000 Extension gate scan frequency
- name: Codeql.Cadence
  value: 0
  # CodeQL needs this plumbed along as a variable to enable TSA
- name: Codeql.TSAEnabled
  value: ${{ parameters.TSAEnabled }}
  # Variables for building
- name: _BuildConfig
  value: Release
- name: _InternalBuildArgs
  value: ''
- name: _ProductionArgs
  value: ''

trigger: none

schedules:
- cron: 0 12 * * 1
  displayName: Weekly Monday CodeQL run
  branches:
    include:
    - main
  always: true

jobs:
- job: CSharp
  timeoutInMinutes: 90
  pool: 
    name: NetCore1ESPool-Internal
    demands: ImageOverride -equals 1es-windows-2019
  displayName: "CodeQL Scan"
  
  steps:
  - task: UseDotNet@2
    displayName: Install Correct .NET Version
    inputs:
      useGlobalJson: true

  - task: NuGetToolInstaller@0
    inputs:
      versionSpec: 6.1.x

  - task: NodeTool@0
    inputs:
      versionSpec: 12.x

  - task: NuGetCommand@2
    displayName: Restore Packages
    inputs:
      command: restore
      solution: "**/*.sln"
      feedstoUse: config

  - powershell: eng\set-version-parameters.ps1
    displayName: Calculate release version variables

  - powershell: |
      [xml]$manifest = Get-Content src\Maestro\MaestroApplication\ApplicationPackageRoot\ApplicationManifest.xml
      $manifest.SelectSingleNode("/*[local-name()='ApplicationManifest']/*[local-name()='Policies']").RemoveAll()
      $manifest.SelectSingleNode("/*[local-name()='ApplicationManifest']/*[local-name()='Principals']").RemoveAll()
      $manifest.Save("src\Maestro\MaestroApplication\ApplicationPackageRoot\ApplicationManifest.xml")
      git diff
    displayName: Remove Service Fabric RunAsPolicy from MaestroApplication

  - powershell: |
      [xml]$manifest = Get-Content src\Telemetry\TelemetryApplication\ApplicationPackageRoot\ApplicationManifest.xml
      $manifest.SelectSingleNode("/*[local-name()='ApplicationManifest']/*[local-name()='Policies']").RemoveAll()
      $manifest.SelectSingleNode("/*[local-name()='ApplicationManifest']/*[local-name()='Principals']").RemoveAll()
      $manifest.Save("src\Telemetry\TelemetryApplication\ApplicationPackageRoot\ApplicationManifest.xml")
      git diff
    displayName: Remove Service Fabric RunAsPolicy from TelemetryApplication

  - task: CodeQL3000Init@0
    displayName: CodeQL Initialize

  - script: eng\common\cibuild.cmd
      -configuration $(_BuildConfig)
      -prepareMachine
      $(_InternalBuildArgs)
      $(_ProductionArgs)
      /p:Test=false
      /P:Sign=false
    name: Build
    displayName: Build
    condition: succeeded()

  - task: CodeQL3000Finalize@0
    displayName: CodeQL Finalize