FIX: S360 CodeQL finding in PR validation to resolve stale snapshot issue #407
+31
−13
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
- Disable CodeQL auto-injection globally in PR validation pipeline - Add one-time 'pytestonwindows' job to update the old stale CodeQL snapshot - This fixes the S360 CodeQL finding SM02986 that was stuck on outdated code - After the old snapshot is cleared, the pytestonwindows job should be removed Resolves: User Story 39809 [S360] [CodeQL.SM02986]
gargsaumya
changed the title
Contributor
There was a problem hiding this comment.
Pull request overview
This PR modifies the PR validation pipeline to fix a CodeQL snapshot issue. The main changes include globally disabling CodeQL auto-injection and adding a temporary job to update a stale CodeQL snapshot associated with the old 'pytestonwindows' build identifier.
Changes:
- Disabled global CodeQL auto-injection in the PR validation pipeline to prevent duplicate analysis
- Added a one-time 'pytestonwindows' job to update the old CodeQL snapshot on Windows with CodeQL explicitly enabled
- Updated build commands from Linux (build.sh) to Windows (build.bat) to match the platform change
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
| # CodeQL Configuration Note: | ||
| # ========================================================================================= | ||
| # CodeQL analysis is disabled in this PR validation pipeline to avoid snapshot duplication. | ||
| # CodeQL runs ONLY in the OneBranch Official Build pipeline (build-release-package-pipeline.yml) |
There was a problem hiding this comment.
The referenced pipeline file 'build-release-package-pipeline.yml' does not exist in the eng/pipelines directory. The actual file appears to be 'build-whl-pipeline.yml' or 'official-release-pipeline.yml'. Please update this reference to point to the correct pipeline file name.
Suggested change
| # CodeQL runs ONLY in the OneBranch Official Build pipeline (build-release-package-pipeline.yml) | |
| # CodeQL runs ONLY in the OneBranch Official Build pipeline (official-release-pipeline.yml) |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Disable CodeQL auto-injection globally in PR validation pipeline
Add one-time 'pytestonwindows' job to update the old stale CodeQL snapshot
This fixes the S360 CodeQL finding SM02986 that was stuck on outdated code
After the old snapshot is cleared, the pytestonwindows job should be removed
Resolves: User Story 39809 [S360] [CodeQL.SM02986]
Work Item / Issue Reference
Summary
This pull request updates the PR validation pipeline configuration to address CodeQL analysis and snapshot management. The main changes are disabling automatic CodeQL analysis to prevent duplicate findings, and introducing a one-time job to update a legacy CodeQL snapshot for the
pytestonwindowsbuild. These adjustments ensure that CodeQL runs only where needed and help resolve an old issue with snapshot duplication.CodeQL Analysis Configuration:
Codeql.Enabledvariable tofalse, ensuring CodeQL analysis is not performed in this pipeline except where explicitly enabled.One-time Snapshot Update Job:
pytestonwindowsto update the old CodeQL snapshot. This job is configured to run onwindows-latestand temporarily enables CodeQL analysis for this specific purpose. The job is intended for one-time use and should be removed after the snapshot issue is resolved.Build and Dependency Changes (Windows Compatibility):
call build.bat x64andcd mssql_python\pybind) and install additional dependencies required for building the C++ extension. [1] [2]