Add Azure Pipelines CodeQL scanning

[David Pine (IEvangelist)]

Summary

Add eng/pipelines/azure-pipelines-codeql.yml for aspire.dev's actual source tree: its Astro site's JavaScript/TypeScript, PowerShell scripts, and C# StaticHost, AppHost, and API generators.

The native CodeQL 3000 scheduling/task pattern follows microsoft/aspire's example; the setup and build commands are specific to this repository.

• Install Node.js 24, derive the exact pnpm version from src/frontend/package.json, and install frontend dependencies from src/frontend with pnpm install --frozen-lockfile --prefer-offline, matching the site's CI.
• Explicitly scan javascript,powershell,csharp from the repository root. javascript includes TypeScript; the root scope also includes configuration, scripts, tooling, and tests outside the frontend directory.
• Compile Aspire.Dev.slnx for the site's C# host, AppHost, and generators, using the same command as its existing GitHub CodeQL workflow. This is C# extraction, not the site's production build: frontend.esproj explicitly disables the frontend build script. JS/TS source analysis does not require a production Astro build.
• Use a clean checkout without persisted credentials, one explicit CodeQL Initialize/Finalize pair, and always() finalization. Automatic task injection is disabled to avoid duplicates.
• Run weekly on Monday at 12:00 UTC on main, with manual runs supported, cadence 0, and CI/PR triggers disabled.

The existing GitHub CodeQL workflow is unchanged. No internal deployment configuration or commits are included.

After merge, register an Azure DevOps pipeline against the public microsoft/aspire.dev repository, using this YAML path and main as its default branch. This PR adds the definition; it does not create or activate the Azure pipeline.

Third-party links and affiliations

None.

Validation

• git diff --cached --check — passed.
• python - — passed source and Azure-expanded YAML assertions: selected languages match the tracked source inventory; pnpm is derived from the frontend manifest; dependency installation uses the frontend directory and frozen lockfile; checkout is clean; source root is repository-wide; and Initialize/build/Finalize ordering is correct. Azure preview expanded the job without queuing a build.
• [System.Management.Automation.Language.Parser]::ParseInput($script, [ref]$tokens, [ref]$errors) — passed for the pnpm bootstrap script.
• npm view pnpm@11.9.0 version --json — passed, confirming availability of the manifest-pinned version.
• dotnet build Aspire.Dev.slnx --configuration Release -p:AspireUseCliBundle=false --nologo --verbosity quiet — passed with two expected ASPIRE010 warnings about the deliberately disabled CLI bundle.

No local frontend dependency installation or production build was run. An actual CodeQL scan and database upload require registering and running the Azure pipeline after merge.

[Copilot]

🟢 Approval recommended

The pipeline configuration matches the stated schedule, build scope, and explicit CodeQL task lifecycle.

0 open findings

What changed in this PR

Adds a scheduled Azure Pipelines CodeQL scan while retaining the existing GitHub workflow.

Changes:

• Adds weekly and manually triggered CodeQL scanning.
• Configures .NET 10, Node.js 24, and explicit CodeQL initialization/finalization.
• Builds the C# solution for compiler extraction without the Aspire CLI bundle.

File	Description
eng/​pipelines/​azure-pipelines-codeql.yml	Defines the Azure CodeQL pipeline.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.