Fix stale reference cleanup (#2700) #2780

	name: CodeQL

	on:
	push:
	branches:
	- main
	paths-ignore:
	- '**.md'
	- 'CLAUDE.md'
	- 'LICENSE'
	pull_request:
	branches:
	- main
	paths-ignore:
	- '**.md'
	- 'CLAUDE.md'
	- 'LICENSE'
	schedule:
	- cron: "0 18 * * 0"
	workflow_dispatch:

	permissions:
	actions: read
	contents: read
	security-events: write

	jobs:
	analyze:
	name: Analyze
	runs-on: ubuntu-latest
	strategy:
	fail-fast: false
	matrix:
	language:
	- csharp
	- actions
	steps:
	- name: Checkout
	uses: actions/checkout@34e114876b0b11c390a56381ad16ebd13914f8d5 # v4.3.1

	- name: Set up .NET
	if: matrix.language == 'csharp'
	uses: actions/setup-dotnet@67a3573c9a986a3f9c594539f4ab511d57bb3ce9 # v4.3.1
	with:
	dotnet-version: '8.0.x'

	- name: Initialize CodeQL
	uses: github/codeql-action/init@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3.36.0
	with:
	languages: ${{ matrix.language }}

	# --locked-mode keeps CodeQL's restore inside the committed
	# packages.lock.json bounds so dependency-graph analysis runs against
	# the same transitive set we ship. See issue #1556.
	# --locked-mode により CodeQL の restore も packages.lock.json と同じ
	# 推移依存セットに揃え、出荷物と同じ依存グラフを解析対象にする。
	# 詳細は issue #1556 参照。
	- name: Restore dependencies
	if: matrix.language == 'csharp'
	run: dotnet restore CodeIndex.sln --locked-mode

	- name: Build for CodeQL
	if: matrix.language == 'csharp'
	run: dotnet build CodeIndex.sln --configuration Release --no-restore

	- name: Analyze
	uses: github/codeql-action/analyze@03e4368ac7daa2bd82b3e85262f3bf87ee112f57 # v3.36.0
	continue-on-error: true

Navigation Menu