From 5e842176d87132bf34a19b5dbf26b9c20f89a17b Mon Sep 17 00:00:00 2001 From: Vineeth Thomas Alex Date: Mon, 10 Aug 2026 13:04:49 -0500 Subject: [PATCH] Fix missing CodeQL javascript snapshot by disabling CodeQL on arm64 test legs S360 [SFI-PS2.1] Continuous SDL raised a CodeQL.Uploading action item (AB#63506192): "A CodeQL snapshot for repository 'ado:microsoft/projectreunion/windowsappsdk' and language 'javascript' must be produced by the Due Date." JavaScript entered the repo in #6158 (tools/mcp/github-artifacts, 6 .js files) and CodeQL correctly detects it: javascript: Supported. Artifacts: code: 6, ignored: 0 Detected languages: cpp,csharp,powershell,javascript,actions The snapshot is produced only intermittently. The CodeQL service accepts one upload job per (repository, commit, language), so every job with the CodeQL 3000 tasks auto-injected races to claim each language (64 CodeQL task records in one nightly). On the arm64 test images the CodeQL Windows tracer cannot inject into the parent process and database init fails outright: A fatal error occurred: Injecting Windows tracer failed: Could not inject into parent. ##[warning]Database failed to initialize! |javascript | failed | Database failed to initialize! | Because init runs once for all detected languages as a single --db-cluster with --begin-tracing (required by cpp/csharp), that tracer failure fails every language in the cluster, including javascript which needs no build tracing at all. Whenever an arm64 leg wins the race the claim is released without a database and the real producers are told the upload is redundant, so no snapshot lands for that commit. Observed on the Nightly (main): 152534661 7/19 javascript uploaded 152731647 7/22 javascript uploaded 153077460 7/26 none - all 8 javascript claimants were arm64 legs 153493099 7/30 javascript uploaded 153706287 8/2 none 154333949 8/10 actions only - all 8 javascript claimants were arm64 legs Compounding this, a scan is not re-accepted for the same commit for 24 days, and main has been pinned at ee3c5078 since 7/30, so the misses cannot self-heal. Fix: skip CodeQL only on the arm64 legs of the shared test job template, keyed off the matrix buildPlatform variable. The x64/x86 legs of this same template are the primary producers of the javascript, csharp and powershell snapshots and are deliberately left enabled. This mirrors the ob_sdl_binskim_enabled: false precedent already in this file. Refs: AB#63506192 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 6e524c66-57a7-4c8c-b8c1-c797a4e5b447 --- .../WindowsAppSDK-RunTestsInPipeline-Job.yml | 19 +++++++++++++++++++ 1 file changed, 19 insertions(+) diff --git a/build/AzurePipelinesTemplates/WindowsAppSDK-RunTestsInPipeline-Job.yml b/build/AzurePipelinesTemplates/WindowsAppSDK-RunTestsInPipeline-Job.yml index 5585cdec44..27a578d391 100644 --- a/build/AzurePipelinesTemplates/WindowsAppSDK-RunTestsInPipeline-Job.yml +++ b/build/AzurePipelinesTemplates/WindowsAppSDK-RunTestsInPipeline-Job.yml @@ -50,6 +50,25 @@ jobs: # at Microsoft.Guardian.ResponseFileManager.CreateResponseFile(IList`1 arguments, String formatterName, ResponseFileOptions options, String outputPathOverride) # at Microsoft.Guardian.CliAnalyzerResponseFileManager.SetupResponseFile(CliAnalyzerConfig analyzeConfig, ToolConfig toolConfig) ob_sdl_binskim_enabled: false + # Disable CodeQL on the arm64 test images only (AB#63506192). + # + # The CodeQL service accepts a single upload job per (repository, commit, language), so every job that + # has the CodeQL 3000 tasks auto-injected races to claim each detected language. On the arm64 test + # images the CodeQL Windows tracer cannot inject into the parent process, and 'codeql database init' + # fails outright: + # + # A fatal error occurred: Injecting Windows tracer failed [exit code: 0] with message: Could not inject into parent. + # ##[warning]Database failed to initialize! + # + # Because init is invoked once for all detected languages as a single --db-cluster with --begin-tracing + # (required by cpp/csharp), that failure fails *every* language in the cluster - including javascript, + # which needs no build tracing at all. When an arm64 leg wins the race for 'javascript' the claim is + # released without a database, the real producers are then told the upload is "redundant", and no + # javascript snapshot is produced for that commit at all. + # + # The x64/x86 legs of this same template are the primary producers of the javascript, csharp and + # powershell snapshots, so CodeQL is deliberately left enabled for them. See https://aka.ms/codeql3000-faq + Codeql.Enabled: $[ iif(eq(variables['buildPlatform'], 'arm64'), 'false', 'true') ] steps: - checkout: self path: s