Only run CG and CodeQL as part of the internal build job (Azure#3250)

Author: weshaggard

eng/pipelines/templates/jobs/pack.yml

@@ -18,6 +18,18 @@ jobs:
     image: $(LINUXVMIMAGE)
     os: linux
 
+  # Only run CG and codeql on internal build job
+  ${{ if eq(variables['System.TeamProject'], 'internal') }}:
+    templateContext:
+      sdl:
+        componentgovernance:
+          enabled: true
+        codeql:
+          # Need to specify the language because we clone after the codeql initialize step
+          language: rust
+          compiled:
+            enabled: true
+
   steps:
   - template: /eng/common/pipelines/templates/steps/sparse-checkout.yml
     parameters:

eng/pipelines/templates/stages/1es-redirect.yml

@@ -52,13 +52,16 @@ extends:
         name: azsdk-pool
         image: windows-2022
         os: windows
-      eslint:
-        enabled: false
-        justificationForDisabling: "ESLint injected task has failures because it uses an old version of mkdirp. We should not fail for tools not controlled by the repo. See: https://dev.azure.com/azure-sdk/internal/_build/results?buildId=3556850"
       codeql:
         compiled:
           enabled: false
-          justificationForDisabling: "CodeQL times our pipelines out by running for 2+ hours before being force canceled."
+          justificationForDisabling: "To reduce redundant CG runs across all our pipeline jobs we are disabling and only running in our main build job."
+      componentgovernance:
+        enabled: false
+        justificationForDisabling: "To reduce redundant CG runs across all our pipeline jobs we are disabling and only running in our main build job."
+      eslint:
+        enabled: false
+        justificationForDisabling: "ESLint is not interesting for this repo as it is mostly Rust code and any JS/TS in the repo is updated outside of this repo."
       credscan:
         suppressionsFile: $(Build.SourcesDirectory)/eng/CredScanSuppression.json
         baselineFiles: $(Build.SourcesDirectory)/eng/rust.gdnbaselines