Harden Docker image and narrow build context (#3615) #3537

	name: CodeQL

	on:
	push:
	branches:
	- main
	paths-ignore:
	- '**.md'
	- 'CLAUDE.md'
	- 'LICENSE'
	pull_request:
	branches:
	- main
	paths-ignore:
	- '**.md'
	- 'CLAUDE.md'
	- 'LICENSE'
	schedule:
	- cron: "0 18 * * 0"
	workflow_dispatch:

	permissions:
	actions: read
	contents: read
	security-events: write

	jobs:
	analyze:
	name: Analyze
	runs-on: ubuntu-latest
	strategy:
	fail-fast: false
	matrix:
	language:
	- csharp
	- actions
	steps:
	- name: Checkout
	uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2

	- name: Set up .NET
	if: matrix.language == 'csharp'
	uses: actions/setup-dotnet@9a946fdbd5fb07b82b2f5a4466058b876ab72bb2 # v5.3.0
	with:
	dotnet-version: '8.0.x'

	- name: Initialize CodeQL
	uses: github/codeql-action/init@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
	with:
	languages: ${{ matrix.language }}

	# --locked-mode keeps CodeQL's restore inside the committed
	# packages.lock.json bounds so dependency-graph analysis runs against
	# the same transitive set we ship. See issue #1556.
	# --locked-mode により CodeQL の restore も packages.lock.json と同じ
	# 推移依存セットに揃え、出荷物と同じ依存グラフを解析対象にする。
	# 詳細は issue #1556 参照。
	- name: Restore dependencies
	if: matrix.language == 'csharp'
	run: dotnet restore CodeIndex.sln --locked-mode

	- name: Build for CodeQL
	if: matrix.language == 'csharp'
	run: dotnet build CodeIndex.sln --configuration Release --no-restore

	- name: Analyze
	uses: github/codeql-action/analyze@8aad20d150bbac5944a9f9d289da16a4b0d87c1e # v4.36.2
	continue-on-error: true

Navigation Menu