don't rely on onebranch

.pipelines/onebranch.official.yml

@@ -27,6 +27,8 @@ resources:
 
 variables:
   LinuxContainerImage: "onebranch.azurecr.io/linux/ubuntu-2004:latest"
+  Codeql.enabled: true
+  Codeql.TSAEnabled: true
 
 extends:
   template: v2/OneBranch.Official.CrossPlat.yml@templates
@@ -41,11 +43,6 @@ extends:
         suppressionsFile: $(Build.SourcesDirectory)\.config\CredScanSuppressions.json
       policheck:
         break: true
-      codeql:
-        compiled:
-          enabled: true
-        tsaEnabled: true
-        skipTaskAutoInjection: true
 
     stages:
     - template: templates\stages\build-official.yml

.pipelines/templates/jobs/build.yml

@@ -3,9 +3,6 @@ parameters:
     type: string
   - name: artifactName
     type: string
-  - name: includeCodeQLTasks
-    type: boolean
-    default: false
 
 jobs:
 - job:
@@ -32,7 +29,7 @@ jobs:
 
   - task: CodeQL3000Init@0
     displayName: CodeQL Initialize
-    condition: eq(${{ parameters.includeCodeQLTasks }}, 'True')
+    condition: eq($(Codeql.enabled), 'True')
 
   - task: NodeTool@0
     displayName: Use Node 14.19.3
@@ -59,4 +56,4 @@ jobs:
 
   - task: CodeQL3000Finalize@0
     displayName: CodeQL Finalize
-    condition: eq(${{ parameters.includeCodeQLTasks }}, 'True')
+    condition: eq($(Codeql.enabled), 'True')

.pipelines/templates/stages/build-official.yml

@@ -4,5 +4,4 @@ stages:
   - template: ..\jobs\build.yml
     parameters:
       jobDisplayName: vscode
-      artifactName: vscode-website-prod
-      includeCodeQLTasks: true
+      artifactName: vscode-website-prod