From db18fc81cef38b69fbb6ddc4507f319e02251a18 Mon Sep 17 00:00:00 2001
From: David Pine <7679720+IEvangelist@users.noreply.github.com>
Date: Wed, 7 Oct 2026 13:13:25 -0500
Subject: [PATCH 1/2] Add Azure Pipelines CodeQL scanning

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: d767f83b-1315-440e-8bf7-124ba82fd1ec
---
 eng/pipelines/azure-pipelines-codeql.yml | 55 ++++++++++++++++++++++++
 1 file changed, 55 insertions(+)
 create mode 100644 eng/pipelines/azure-pipelines-codeql.yml

diff --git a/eng/pipelines/azure-pipelines-codeql.yml b/eng/pipelines/azure-pipelines-codeql.yml
new file mode 100644
index 000000000..1255661aa
--- /dev/null
+++ b/eng/pipelines/azure-pipelines-codeql.yml
@@ -0,0 +1,55 @@
+variables:
+- name: DncEngInternalBuildPool
+  value: NetCore1ESPool-Internal
+- name: Codeql.Enabled
+  value: true
+# Run every scheduled or manually queued scan, without cadence gating.
+- name: Codeql.Cadence
+  value: 0
+# The explicit tasks below replace the extension's automatic injection.
+- name: Codeql.SkipTaskAutoInjection
+  value: true
+
+trigger: none
+pr: none
+
+schedules:
+- cron: '0 12 * * 1'
+  displayName: Weekly Monday CodeQL run
+  branches:
+    include:
+    - main
+  always: true
+
+jobs:
+- job: codeql
+  displayName: CodeQL
+  pool:
+    name: $(DncEngInternalBuildPool)
+    demands: ImageOverride -equals 1es-windows-2022
+  timeoutInMinutes: 90
+
+  steps:
+  - checkout: self
+    persistCredentials: false
+
+  - task: UseDotNet@2
+    displayName: Install .NET SDK
+    inputs:
+      useGlobalJson: true
+
+  - task: UseNode@1
+    displayName: Install Node.js
+    inputs:
+      version: '24.x'
+
+  - task: CodeQL3000Init@0
+    displayName: CodeQL Initialize
+
+  # CodeQL needs compiler extraction, not the Aspire orchestration bundle.
+  - script: dotnet build Aspire.Dev.slnx --configuration Release -p:AspireUseCliBundle=false
+    displayName: Build C# for CodeQL extraction
+
+  - task: CodeQL3000Finalize@0
+    displayName: CodeQL Finalize
+    condition: always()

From d8d82049cc64e32b8bedcb5bc539c724141860a0 Mon Sep 17 00:00:00 2001
From: David Pine <7679720+IEvangelist@users.noreply.github.com>
Date: Wed, 7 Oct 2026 13:58:14 -0500
Subject: [PATCH 2/2] Configure CodeQL for aspire.dev frontend and source
 languages

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: d767f83b-1315-440e-8bf7-124ba82fd1ec
---
 eng/pipelines/azure-pipelines-codeql.yml | 24 +++++++++++++++++++++++-
 1 file changed, 23 insertions(+), 1 deletion(-)

diff --git a/eng/pipelines/azure-pipelines-codeql.yml b/eng/pipelines/azure-pipelines-codeql.yml
index 1255661aa..f0e794fa3 100644
--- a/eng/pipelines/azure-pipelines-codeql.yml
+++ b/eng/pipelines/azure-pipelines-codeql.yml
@@ -31,6 +31,7 @@ jobs:
 
   steps:
   - checkout: self
+    clean: true
     persistCredentials: false
 
   - task: UseDotNet@2
@@ -43,10 +44,31 @@ jobs:
     inputs:
       version: '24.x'
 
+  - task: PowerShell@2
+    displayName: Install frontend's pinned pnpm version
+    inputs:
+      targetType: inline
+      pwsh: true
+      workingDirectory: $(Build.SourcesDirectory)/src/frontend
+      script: |
+        $packageManager = (Get-Content package.json -Raw | ConvertFrom-Json).packageManager
+        npm install --global (($packageManager -split '\+')[0])
+        if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+        $npmPrefix = npm config get prefix
+        Write-Host "##vso[task.prependpath]$npmPrefix"
+
+  - script: pnpm install --frozen-lockfile --prefer-offline
+    displayName: Install frontend dependencies
+    workingDirectory: $(Build.SourcesDirectory)/src/frontend
+
   - task: CodeQL3000Init@0
     displayName: CodeQL Initialize
+    inputs:
+      # javascript includes TypeScript; scan frontend, tooling, and scripts.
+      Language: javascript,powershell,csharp
+      SourceRoot: $(Build.SourcesDirectory)
 
-  # CodeQL needs compiler extraction, not the Aspire orchestration bundle.
+  # Compile the site's StaticHost, AppHost, and generators for C# extraction.
   - script: dotnet build Aspire.Dev.slnx --configuration Release -p:AspireUseCliBundle=false
     displayName: Build C# for CodeQL extraction