[damianh]

The C# CodeQL job was the critical path (~11-13 min), and ~7.5 min of that was the build-mode-none NuGet restore across every solution. Queries took only ~1 min.

Changes:

• concurrency group that cancels superseded PR runs
• C# split into parallel jobs by source-root: IdentityServer/v7, IdentityServer/v8, BFF, various. Each uploads under its own category (/language:csharp/<shard>).
• C# shards sparse-checkout only their folder (plus root files). The buildless extractor ignores source-root and would otherwise restore all 132 solutions in every shard.
• JavaScript is unchanged and explicitly keeps its previous category (.github/workflows/codeql-analysis.yml:analyze/language:javascript/).

Measured on this PR: about 9 min wall clock, down from 11-17 min. The longest job is IdentityServer/v8 at about 8 min. Caching dependencies was tried and removed: it made runs slower and used 6.4 GB of cache.

Follow-up after merge:

• Delete the stale .github/workflows/codeql-analysis.yml:analyze/language:csharp/ configuration under Security > Code scanning > Tool status; otherwise its old alerts stay open.
• Job names changed. If branch protection requires Analyze (csharp), update the required checks.
• build/build.csproj (repo build tooling) is no longer covered by C# analysis.

[Copilot]

🟡 Changes recommended

NuGet caching lacks the required lockfiles, and the JavaScript category change leaves its previous scanning configuration without updates.

2 open issues

• NuGet dependency cache is skipped without supported lockfiles · New
• JavaScript category change strands existing code-scanning alerts · New

What changed in this PR

This PR aims to shorten CodeQL analysis time by parallelizing C# scanning across sample folders and enabling dependency caching.

Changes:

• Splits C# analysis into four source-root shards with separate result categories.
• Enables dependency caching and cancels superseded pull-request runs.
• Updates matrix job names and explicitly sets analysis categories.

File	Description
.github/​workflows/​codeql-analysis.yml	Adds C# sharding, caching, concurrency controls, and explicit analysis categories.

_{Review effort: Balanced}

[github-advanced-security]

You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool.

What Enabling Code Scanning Means:

• The 'Security' tab will display more code scanning analysis results (e.g., for the default branch).
• Depending on your configuration and choice of analysis tool, future pull requests will be annotated with code scanning analysis results.
• You will be able to see the analysis results for the pull request's branch on this overview once the scans have completed and the checks have passed.

For more information about GitHub Code Scanning, check out the documentation.

[Copilot]

🟢 Approval recommended

No unresolved blocking issues remain, prior feedback is addressed, and migration steps and coverage changes are documented.

No open issues 🎉

2 resolved since last review

• JavaScript category change strands existing code-scanning alerts
• NuGet dependency cache is skipped without supported lockfiles

_{Review effort: Balanced}

[Copilot]

🔵 Needs a closer look

The scanning coverage changes and category migration need human validation against completed workflow results.

No open issues 🎉

_{Review effort: Balanced}

[Copilot]

🟢 Approval recommended

No blocking issues remain, and the description documents the required post-merge cleanup and coverage tradeoff.

No open issues 🎉

_{Review effort: Balanced}