[BUG]:Pipelines failing on AdvancedSecurity-Codeql-Init@1 (v1.1.365) due to corrupted task download

[shutchison-bai]

New issue checklist

• I searched for existing GitHub issues
• I read pipeline troubleshooting guide
• I checked how to collect logs

Task name

AdvancedSecurity-Codeql-Init@1

Task version

1.1.365

Issue Description

Starting yesterday afternoon, our pipelines began failing during the Initialize job while downloading:

AdvancedSecurity-Codeql-Init@1 (v1.1.365)

The failure occurs with ZIP extraction errors indicating a corrupted archive (e.g., “End of Central Directory record could not be found” / “Offset to Central Directory cannot be held in an Int64”).

This issue is consistent across:

• Self-hosted agents
• Azure-hosted agents
• Self-hosted VM Scale Set (VMSS) agents

As part of troubleshooting, we rolled back to the previously working version:

AdvancedSecurity-Codeql-Init@1.1.356

After rolling back, the pipelines run successfully.

This suggests a potential issue with the v1.1.365 task package.

Environment type (Please select at least one enviroment where you face this issue)

• Self-Hosted
• Microsoft Hosted
• VMSS Pool
• Container

Azure DevOps Server type

dev.azure.com (formerly visualstudio.com)

Azure DevOps Server Version (if applicable)

No response

Operation system

Windows Server 2019 Datacenter, uduntu-latest, windows-latest

Relevant log output

2026-04-02T15:26:50.9911454Z ##[section]Starting: Initialize job
2026-04-02T15:26:50.9915263Z Agent name: 'Azure Pipelines 1'
2026-04-02T15:26:50.9916123Z Agent machine name: 'runnervmc7rvc'
2026-04-02T15:26:50.9916523Z Current agent version: '4.271.0'
2026-04-02T15:26:50.9944238Z ##[group]Runner Image Provisioner
2026-04-02T15:26:50.9944837Z Hosted Compute Agent
2026-04-02T15:26:50.9945327Z Version: 20260213.493
2026-04-02T15:26:50.9945740Z Commit: 5c115507f6dd24b8de37d8bbe0bb4509d0cc0fa3
2026-04-02T15:26:50.9946163Z Build Date: 2026-02-13T00:28:41Z
2026-04-02T15:26:50.9946585Z Worker ID: {be7ad769-f457-4bb5-9b33-420e5621e1ea}
2026-04-02T15:26:50.9946945Z Azure Region: centralus
2026-04-02T15:26:50.9947260Z ##[endgroup]
2026-04-02T15:26:50.9947567Z ##[group]_internal_runner_telemetry
2026-04-02T15:26:50.9947987Z ProcessLifetimeId: e35ceddb-b209-4804-9798-a7880a0915b8
2026-04-02T15:26:50.9948384Z Azure Region: centralus
2026-04-02T15:26:50.9948675Z ##[endgroup]
2026-04-02T15:26:50.9949013Z ##[group]Operating System
2026-04-02T15:26:50.9949394Z Microsoft Windows Server 2025
2026-04-02T15:26:50.9949710Z 10.0.26100
2026-04-02T15:26:50.9950129Z Datacenter
2026-04-02T15:26:50.9950469Z ##[endgroup]
2026-04-02T15:26:50.9950783Z ##[group]Runner Image
2026-04-02T15:26:50.9951069Z Image: windows-2025
2026-04-02T15:26:50.9951585Z Version: 20260317.61.1
2026-04-02T15:26:50.9952084Z Included Software: https://github.com/actions/runner-images/blob/win25/20260317.61/images/windows/Windows2025-Readme.md
2026-04-02T15:26:50.9952708Z Image Release: https://github.com/actions/runner-images/releases/tag/win25%2F20260317.61
2026-04-02T15:26:50.9953168Z ##[endgroup]
2026-04-02T15:26:50.9956179Z Current image version: '20260317.61.1'
2026-04-02T15:26:51.0586093Z Agent running as: 'VssAdministrator'
2026-04-02T15:26:51.0629046Z Prepare build directory.
2026-04-02T15:26:51.0864197Z Set build variables.
2026-04-02T15:26:51.0886406Z Download all required tasks.
2026-04-02T15:26:51.1024171Z Downloading task: AdvancedSecurity-Codeql-Init (1.1.365)
2026-04-02T15:26:51.3554711Z Downloading task: AdvancedSecurity-Dependency-Scanning (1.1.365)
2026-04-02T15:26:51.9355661Z ##[error]Offset to Central Directory cannot be held in an Int64.
2026-04-02T15:26:51.9365730Z ##[section]Finishing: Initialize job

Full task logs with system.debug enabled

Details

 [REPLACE THIS WITH YOUR INFORMATION] 

Repro steps

[sanjuyadav24]

Thank you for reporting this issue.

As a workaround, please try the following:

• Uninstall the Advanced Security extension from your Azure DevOps organization (Organization Settings → Extensions).
• Reinstall the extension. This should pull the latest corrected version of the task.
• Clear the agent's task cache by deleting the _work/_tasks/AdvancedSecurity-Codeql-Analyze* folder on your self-hosted agents (Microsoft-hosted agents will pick up the fresh version automatically).