CodeQL: Setting paths in Github Advanced Security for Azure Devops

I'm using Github Advanced Security in Azure devops in a monorepo. With the given folder structure:

```
.
└── apps/
├── frontend/
│ ├── green-app
│ └── red-app
└── backend/
├── green-app
└── red-app
```

By default the codeql task will scan the ENTIRE code base. Which is not what I want.

**How can I configure Github advanced security to only scan one project? For example the front-end and backend folder for the green-app.**

I tried setting the sources folder to the back-end folder. But then I'm not able to "reach" the front-end folder when I set the codeqlpathstoinclude parameter. When I try this:
```
- task: AdvancedSecurity-Codeql-Init@1
condition: and(succeededOrFailed(), ${{parameters.runGithubAdvancedSecurity}})
displayName: 'Github Advanced Security: Initialize 🛡'
inputs:
languages: 'csharp,javascript'
sourcesfolder: '$(System.DefaultWorkingDirectory)/apps/backend/green-app'
codeqlpathstoinclude: '../frontend/green-app'
```
_(Following the [docs](https://learn-microsoft-com.translate.goog/en-us/azure/devops/pipelines/tasks/reference/advanced-security-codeql-init-v1?view=azure-pipelines&_x_tr_sl=en&_x_tr_tl=nl&_x_tr_hl=nl&_x_tr_pto=sc): "The paths must be relative to the sourcesfolder where CodeQL is running, which defaults to the Build.SourcesDirectory pipeline environment variable. For example, to include the $(Build.SourcesDirectory)/app directory, set codeqlpathstoinclude: app rather than codeqlpathstoinclude: $(Build.SourcesDirectory)/app.")_

I get:
> Only found JavaScript or TypeScript files that were empty or contained syntax errors

Wildcards are also giving issues:
`apps/*/green-app/**/*`

What am I doing wrong here? Any other way i can accomplish this?

Start with the AdvancedSecurity-Codeql-Init@1 pipeline task documentation and the shown sourcesfolder and codeqlpathstoinclude settings. Verify how relative paths and wildcards are resolved, then confirm that only the green-app frontend and backend paths are scanned without the reported JavaScript or TypeScript errors.

Scritto dal modello di indicizzazione a partire dal testo della issue.