Add Azure Pipelines CodeQL scanning

eng/pipelines/azure-pipelines-codeql.yml

@@ -0,0 +1,77 @@
+variables:
+- name: DncEngInternalBuildPool
+  value: NetCore1ESPool-Internal
+- name: Codeql.Enabled
+  value: true
+# Run every scheduled or manually queued scan, without cadence gating.
+- name: Codeql.Cadence
+  value: 0
+# The explicit tasks below replace the extension's automatic injection.
+- name: Codeql.SkipTaskAutoInjection
+  value: true
+
+trigger: none
+pr: none
+
+schedules:
+- cron: '0 12 * * 1'
+  displayName: Weekly Monday CodeQL run
+  branches:
+    include:
+    - main
+  always: true
+
+jobs:
+- job: codeql
+  displayName: CodeQL
+  pool:
+    name: $(DncEngInternalBuildPool)
+    demands: ImageOverride -equals 1es-windows-2022
+  timeoutInMinutes: 90
+
+  steps:
+  - checkout: self
+    clean: true
+    persistCredentials: false
+
+  - task: UseDotNet@2
+    displayName: Install .NET SDK
+    inputs:
+      useGlobalJson: true
+
+  - task: UseNode@1
+    displayName: Install Node.js
+    inputs:
+      version: '24.x'
+
+  - task: PowerShell@2
+    displayName: Install frontend's pinned pnpm version
+    inputs:
+      targetType: inline
+      pwsh: true
+      workingDirectory: $(Build.SourcesDirectory)/src/frontend
+      script: |
+        $packageManager = (Get-Content package.json -Raw | ConvertFrom-Json).packageManager
+        npm install --global (($packageManager -split '\+')[0])
+        if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+        $npmPrefix = npm config get prefix
+        Write-Host "##vso[task.prependpath]$npmPrefix"
+
+  - script: pnpm install --frozen-lockfile --prefer-offline
+    displayName: Install frontend dependencies
+    workingDirectory: $(Build.SourcesDirectory)/src/frontend
+
+  - task: CodeQL3000Init@0
+    displayName: CodeQL Initialize
+    inputs:
+      # javascript includes TypeScript; scan frontend, tooling, and scripts.
+      Language: javascript,powershell,csharp
+      SourceRoot: $(Build.SourcesDirectory)
+
+  # Compile the site's StaticHost, AppHost, and generators for C# extraction.
+  - script: dotnet build Aspire.Dev.slnx --configuration Release -p:AspireUseCliBundle=false
+    displayName: Build C# for CodeQL extraction
+
+  - task: CodeQL3000Finalize@0
+    displayName: CodeQL Finalize
+    condition: always()