Skip to content

Restore buildless C# CodeQL analysis - #1530

Open
bmehta001 wants to merge 2 commits into
microsoft:mainfrom
bmehta001:bhamehta/codeql-csharp-buildless
Open

Restore buildless C# CodeQL analysis#1530
bmehta001 wants to merge 2 commits into
microsoft:mainfrom
bmehta001:bhamehta/codeql-csharp-buildless

Conversation

@bmehta001

@bmehta001 bmehta001 commented Sep 4, 2026

Copy link
Copy Markdown
Contributor

Summary

  • add a dedicated CodeQL job for C# source
  • use buildless analysis so legacy .NET Framework and Xamarin projects do not need to compile
  • upload the C# snapshot required by the SFI-PS2.1 Continuous SDL KPI

Rationale

PR #1357 removed C# from the language matrix after the Windows 2022 job could not observe a successful C# compilation. CodeQL now supports build-mode: none for C#, which analyzes the checked-in source without invoking those legacy build paths.

Validation

  • parsed .github/workflows/codeql-analysis.yml as YAML
  • checked the branch diff for whitespace errors

bmehta001 and others added 2 commits September 4, 2026 13:36
@bmehta001
Restore buildless C# CodeQL analysis
d5d265b 
Upload a C# snapshot for Continuous SDL compliance without building the legacy .NET projects.

Files changed:
- .github/workflows/codeql-analysis.yml

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 29c161d0-1e96-482a-a1b0-bf6d058d70ea
@bmehta001
Merge upstream main before restoring C# analysis
8e6ad24 
Bring the CodeQL fix onto the latest upstream workflow so the PR contains only the buildless C# job relative to main.

Files changed:
- Upstream main changes
- .github/workflows/codeql-analysis.yml

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 29c161d0-1e96-482a-a1b0-bf6d058d70ea
@bmehta001
bmehta001 requested a review from a team as a code owner September 4, 2026 18:54
@github-advanced-security

github-advanced-security AI commented Sep 4, 2026

Copy link
Copy Markdown

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

  • The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
  • Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
  • You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

@bmehta001 bmehta001 self-assigned this Sep 4, 2026
@bmehta001
bmehta001 requested a lite review from Copilot September 4, 2026 19:12
Copilot AI reviewed Sep 4, 2026
View reviewed changes

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

🟢 Approval recommended

The change is a straightforward, additive workflow update that uses CodeQL’s supported buildless mode for C# without impacting existing analyses.

Pull request overview

This PR restores CodeQL coverage for the repository’s C# sources by adding a dedicated, buildless C# analysis job, avoiding the need to compile legacy .NET Framework/Xamarin projects while still producing CodeQL results for security scanning/KPI needs.

Changes:

  • Added a new analyze-csharp job to run CodeQL for csharp on windows-2022.
  • Configured C# CodeQL initialization to use build-mode: none (buildless analysis).
File summaries
File Description
.github/workflows/codeql-analysis.yml Adds a standalone buildless CodeQL job for C# analysis alongside existing language jobs.
Review details
  • Files reviewed: 1/1 changed files
  • Comments generated: 0
  • Review effort level: Lite

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

@bmehta001
bmehta001 enabled auto-merge (squash) September 4, 2026 19:36
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

Copilot code review Copilot
Copilot review effort, defaults to Lite
Applies to this pull request for everyone.Learn more about Copilot code review.
Copilot left review comments

At least 1 approving review is required to merge this pull request.

Assignees

@bmehta001 bmehta001

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

3 participants

@bmehta001 @github-advanced-security