Bug

[joehadlock983]

Description

Bug

Steps to Reproduce

trigger:

• main

pool:

Additional hosted image options are available: https://learn.microsoft.com/en-us/azure/devops/pipelines/agents/hosted#software

vmImage: ubuntu-latest

steps:

• task: AdvancedSecurity-Codeql-Init@1
  inputs:
  languages: "java"

  Supported languages: csharp, cpp, go, java, javascript, python, ruby, swift

  You can customize the initialize task: https://learn.microsoft.com/en-us/azure/devops/pipelines/tasks/reference/advanced-security-codeql-init-v1?view=azure-pipelines

  If you're using a self-hosted agent to run CodeQL, use enableAutomaticCodeQLInstall to automatically use the latest CodeQL bits on your agent:

  enableAutomaticCodeQLInstall: true

Add your custom build steps here

- Ensure that all code to be scanned is compiled (often using a clean command to ensure you're building from a clean state).

- Disable the use of any build caching mechanisms as this can interfere with CodeQL's ability to capture all the necessary data during the build.

- Disable the use of any distributed/multithreaded/incremental builds as CodeQL needs to monitor executions of the compiler to construct an accurate representation of the application.

- For dependency scanning, ensure you have a package restore step for more accurate results.

If you had a Maven app:

- task: Maven@4

inputs:

mavenPomFile: 'pom.xml'

goals: 'clean package'

publishJUnitResults: true

testResultsFiles: '**/TEST-*.xml'

javaHomeOption: 'JDKVersion'

jdkVersionOption: '1.17'

mavenVersionOption: 'Default'

Or a general script:

- script: |

echo "Run, Build Application using script"

./location_of_script_within_repo/buildscript.sh

• task: AdvancedSecurity-Dependency-Scanning@1 # More details on this task: https://learn.microsoft.com/en-us/azure/devops/pipelines/tasks/reference/advanced-security-dependency-scanning-v1?view=azure-pipelines

• task: AdvancedSecurity-Codeql-Analyze@1 # More details on this task: https://learn.microsoft.com/en-us/azure/devops/pipelines/tasks/reference/advanced-security-codeql-analyze-v1?view=azure-pipelines

.NET Version

.NET 8.0

Version with bug

1.0.7

Is this a regression from previous behavior?

Not sure, haven't tested other versions

Last Known Working Version

1.0.6

Affected platforms

I was not able test on other platforms

Affected Platform Versions

No response

Have you found a workaround?

No response

Relevant log output

trigger:
  - main

pool:
  # Additional hosted image options are available: https://learn.microsoft.com/en-us/azure/devops/pipelines/agents/hosted#software
  vmImage: ubuntu-latest

steps:

  - task: AdvancedSecurity-Codeql-Init@1
    inputs:
      languages: "java"
      # Supported languages: csharp, cpp, go, java, javascript, python, ruby, swift
      # You can customize the initialize task: https://learn.microsoft.com/en-us/azure/devops/pipelines/tasks/reference/advanced-security-codeql-init-v1?view=azure-pipelines
      # If you're using a self-hosted agent to run CodeQL, use `enableAutomaticCodeQLInstall` to automatically use the latest CodeQL bits on your agent:
      enableAutomaticCodeQLInstall: true

#   Add your custom build steps here
# - Ensure that all code to be scanned is compiled (often using a `clean` command to ensure you're building from a clean state).
# - Disable the use of any build caching mechanisms as this can interfere with CodeQL's ability to capture all the necessary data during the build.
# - Disable the use of any distributed/multithreaded/incremental builds as CodeQL needs to monitor executions of the compiler to construct an accurate representation of the application.
# - For dependency scanning, ensure you have a package restore step for more accurate results.

# If you had a Maven app:
#   - task: Maven@4
#     inputs:
#       mavenPomFile: 'pom.xml'
#       goals: 'clean package'
#       publishJUnitResults: true
#       testResultsFiles: '**/TEST-*.xml'
#       javaHomeOption: 'JDKVersion'
#       jdkVersionOption: '1.17'
#       mavenVersionOption: 'Default'

# Or a general script:
#   - script: |
#       echo "Run, Build Application using script"
#       ./location_of_script_within_repo/buildscript.sh

  - task: AdvancedSecurity-Dependency-Scanning@1 # More details on this task: https://learn.microsoft.com/en-us/azure/devops/pipelines/tasks/reference/advanced-security-dependency-scanning-v1?view=azure-pipelines

  - task: AdvancedSecurity-Codeql-Analyze@1 # More details on this task: https://learn.microsoft.com/en-us/azure/devops/pipelines/tasks/reference/advanced-security-codeql-analyze-v1?view=azure-pipelines