Add environment variables for governance detection

[ViktorHofer]

Skip CG and CodeQL on public quarantine pipeline

[Copilot]

Pull request overview

Updates the quarantined-test re-validation Azure Pipelines definition to explicitly control whether security/governance scanning runs, aligning the quarantine pipeline behavior with public-vs-internal execution constraints.

Changes:

• Add pipeline variables intended to disable Component Governance detection.
• Add pipeline variables intended to disable CodeQL analysis.

Show a summary per file

File	Description
azure-pipelines/quarantine.yml	Adds variables to control/disable CG and CodeQL execution for the quarantine pipeline.

Copilot's findings

• Files reviewed: 1/1 changed files
• Comments generated: 1

[github-actions]

Review: Clean — no issues found.

Verified against existing repo conventions:

• Convention match: vmr-sb-validation.yml uses the identical pattern (skipComponentGovernanceDetection: true + Codeql.Enabled: false) with the same values. .vsts-dotnet-exp-perf.yml also disables CodeQL. This is an established practice for non-shipping pipelines in this repo.
• Variable correctness: Both variable names and values are correct for Azure Pipelines (skipComponentGovernanceDetection is case-sensitive and true is the right value; Codeql.Enabled: false is standard).
• Security: The quarantine pipeline is a scheduled test-revalidation pipeline that produces no shipping artifacts. CG (supply-chain scanning) and CodeQL (security scanning) provide no value here — the main CI pipeline still covers those concerns for production code paths.
• Scope: Minimal, well-targeted change with helpful inline comments explaining the rationale.

LGTM.

Generated by Expert Code Review (on open) for issue #13920 · ● 1.4M