Scaling GitHub Advanced Security in Azure DevOps with a single reusable YAML template

Scaling GitHub Advanced Security in Azure DevOps with a single reusable YAML template

Managing security scanning across dozens of repositories can quickly become complex—especially when each repository uses different languages, frameworks, and infrastructure patterns.

In our environment, we needed a scalable way to apply GitHub Advanced Security (GHAS) consistently across:

• Application code (Python, C#, Java, JavaScript)
• Infrastructure as Code (Terraform, ARM, Bicep)
• Mixed (polyglot) repositories

Instead of maintaining multiple pipelines, we built a single reusable Azure DevOps YAML template that dynamically adapts to any repository.

The problem

Most teams struggle with:

• Multiple pipelines for different tech stacks
• Inconsistent security coverage
• Maintenance overhead across repositories
• Unnecessary scans increasing build time

We needed a solution that:

• Detects repository content automatically
• Runs only relevant scans
• Standardizes security across all repos
• Minimizes duplication

Solution overview

The solution is a single-stage pipeline template with three key jobs:

1. Detect repository content
2. Run CodeQL for application code
3. Run IaC security scanning

Scanning behavior is driven entirely by detection outputs.

Architecture

🟦 High-level flow

Key design patterns

1. Detection-driven execution

Instead of hardcoding logic, the pipeline first detects repository content.

✅ Runs only when code is present
✅ Avoids unnecessary execution

2. Single template for all repositories

A single YAML template works for:

• Backend services
• Frontend apps
• IaC repositories
• Mixed projects

No duplication. No branching logic across repos.

3. Dynamic CodeQL configuration

The pipeline generates a runtime CodeQL config file:

✅ Keeps configuration centralized
✅ Avoids scan failures due to irrelevant directories

4. Language-aware setup

The pipeline dynamically prepares environments:

✅ No need for separate pipelines
✅ Works across polyglot repos

5. Correct CodeQL build strategy

For compiled languages like C#, the pipeline performs build tracing:

✅ Ensures proper CodeQL extraction
✅ Avoids empty-database failures

6. Integrated IaC security scanning

Infrastructure scanning is handled in the same pipeline:

✅ Covers Terraform, ARM, Bicep
✅ Unified reporting across code and infrastructure

7. Centralized reporting

Artifacts are published for traceability:

• Code scanning results → CodeScanningReports
• IaC results → IaCSecurityReports

✅ Easy audit and troubleshooting
✅ Retains SARIF outputs

Benefits

This approach delivers:

✔ One pipeline for all repositories
✔ Reduced maintenance overhead
✔ Consistent security enforcement
✔ Faster pipeline execution
✔ Scalable DevSecOps model

Lessons learned

• Detection-first pipelines are critical for scale
• Config-driven CodeQL execution prevents failures
• Build tracing must be handled explicitly for compiled languages
• IaC scanning should not be a separate workflow

Conclusion

Scaling GitHub Advanced Security across Azure DevOps doesn’t require multiple pipelines—it requires the right architecture.

By combining:

• Detection-driven execution
• Dynamic configuration
• Conditional setup
• Unified scanning

You can operationalize security at scale with a single reusable YAML template.