Adding code changes to integrate codeQL tool into pipeline

[laxmikanth-msft]

I've added code changes to add codeQL static tool into pipeline for WPF samples. This will run the codeQL static tool on the codebase and if there are any abnormal changes in your PR, it will show up in the codeQL analysis section.

Microsoft Reviewers: Open in CodeFlow

[Copilot]

Pull request overview

Adds a GitHub Actions workflow to run GitHub CodeQL analysis for the WPF samples repository, enabling automated security scanning on pushes, PRs, manual runs, and a weekly schedule.

Changes:

• Introduces a new codeql.yml workflow that initializes and runs CodeQL for C# on windows-latest.
• Restores and builds WPFSamples.sln prior to CodeQL analysis.
• Configures workflow triggers for main / release/* and a weekly cron schedule.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

This workflow runs both nuget restore and dotnet restore on the same solution. Since the repo doesn’t appear to use packages.config-based restores, this is likely redundant and increases CI time/complexity. Consider keeping only dotnet restore WPFSamples.sln (or document why both are required).

Suggested change

	nuget restore WPFSamples.sln
	dotnet restore WPFSamples.sln
	dotnet restore WPFSamples.sln

[Copilot]

The build command forces /p:LangVersion=latest, which can change compilation semantics relative to the repo’s intended configuration and potentially introduce build failures that don’t exist in normal builds. Consider removing this override so CodeQL analyzes the code as it is normally compiled.

Suggested change

	run: dotnet build WPFSamples.sln --configuration Release --no-restore /p:Platform="Any CPU" /p:LangVersion=latest /p:TreatWarningsAsErrors=false
	run: dotnet build WPFSamples.sln --configuration Release --no-restore /p:Platform="Any CPU" /p:TreatWarningsAsErrors=false

[Copilot]

For supply-chain hardening, consider pinning third-party GitHub Actions to full commit SHAs instead of floating major tags (e.g., @v4). This reduces the risk of a compromised action release affecting the workflow.

[Copilot]

The build step is marked continue-on-error: true, which can allow the workflow to succeed even when the solution fails to compile. For compiled-language CodeQL analysis this can result in an incomplete/empty database and misleading “successful” security scanning. Consider removing continue-on-error, or explicitly handling build failures (e.g., fail the job or gate analysis on a successful build).

Suggested change

continue-on-error: true

[pranav-gupta-msft]

LGTM

[dipeshmsft]

@laxmikanth-msft , how are we going to run this pipeline ? I am still new to this, just wanted to understand the process.

[dipeshmsft]

Apart from the comments I left, the current state does not cover all the samples in this repo.
We should also look at WPFSamples.Msbuild.sln, these are archaic and may not build but I guess in the main pipeline these get built, so I recommend adding this.

[laxmikanth-msft]

@microsoft-github-policy-service agree