From 198b082aa0ebb8ff4b77609012857bd78bff1e0b Mon Sep 17 00:00:00 2001
From: Widthdom <widthdom@gmail.com>
Date: Sun, 31 May 2026 20:33:14 +0900
Subject: [PATCH 1/3] Enable trim and AOT analyzers (#1598)

---
 changelog.d/unreleased/1598.fixed.md | 15 +++++++++++++++
 src/CodeIndex/CodeIndex.csproj       |  4 ++++
 src/CodeIndex/packages.lock.json     |  6 ++++++
 3 files changed, 25 insertions(+)
 create mode 100644 changelog.d/unreleased/1598.fixed.md

diff --git a/changelog.d/unreleased/1598.fixed.md b/changelog.d/unreleased/1598.fixed.md
new file mode 100644
index 0000000000..100a31ff45
--- /dev/null
+++ b/changelog.d/unreleased/1598.fixed.md
@@ -0,0 +1,15 @@
+---
+category: fixed
+issues:
+  - 1598
+affected:
+  - src/CodeIndex/CodeIndex.csproj
+---
+
+## English
+
+- **Trim and AOT analyzer warnings now surface during CodeIndex builds (#1598)** - the CLI project declares trim compatibility and enables trim/AOT analyzers with per-site trimmer warnings, so reflection-sensitive release issues are caught before publishing trimmed binaries.
+
+## 日本語
+
+- **CodeIndex ビルドで trim / AOT analyzer 警告が表面化するようになりました (#1598)** - CLI プロジェクトが trim 互換性を宣言し、trim / AOT analyzer と箇所別の trimmer 警告を有効化したため、reflection に依存するリリース問題を trimmed バイナリ公開前に検出できます。
diff --git a/src/CodeIndex/CodeIndex.csproj b/src/CodeIndex/CodeIndex.csproj
index dd1c07b45c..634e1aa4ca 100644
--- a/src/CodeIndex/CodeIndex.csproj
+++ b/src/CodeIndex/CodeIndex.csproj
@@ -7,6 +7,10 @@
     <RootNamespace>CodeIndex</RootNamespace>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
+    <IsTrimmable>true</IsTrimmable>
+    <EnableTrimAnalyzer>true</EnableTrimAnalyzer>
+    <EnableAotAnalyzer>true</EnableAotAnalyzer>
+    <TrimmerSingleWarn>false</TrimmerSingleWarn>
 
     <!--
       Embed a Windows app manifest declaring `longPathAware=true` so the OS
diff --git a/src/CodeIndex/packages.lock.json b/src/CodeIndex/packages.lock.json
index f108903458..a6e065b39a 100644
--- a/src/CodeIndex/packages.lock.json
+++ b/src/CodeIndex/packages.lock.json
@@ -13,6 +13,12 @@
           "SQLitePCLRaw.core": "2.1.11"
         }
       },
+      "Microsoft.NET.ILLink.Tasks": {
+        "type": "Direct",
+        "requested": "[8.0.22, )",
+        "resolved": "8.0.22",
+        "contentHash": "MhcMithKEiyyNkD2ZfbDZPmcOdi0GheGfg8saEIIEfD/fol3iHmcV8TsZkD4ZYz5gdUuoX4YtlVySUU7Sxl9SQ=="
+      },
       "Microsoft.Data.Sqlite.Core": {
         "type": "Transitive",
         "resolved": "10.0.5",

From 36e83e63e8c8747ba5077fea849fabc24b9060b5 Mon Sep 17 00:00:00 2001
From: Widthdom <widthdom@gmail.com>
Date: Sun, 31 May 2026 20:56:54 +0900
Subject: [PATCH 2/3] Enable deterministic Source Link builds (#1602)

---
 DEVELOPER_GUIDE.md                   |  2 ++
 changelog.d/unreleased/1602.fixed.md | 17 +++++++++++++++++
 src/CodeIndex/CodeIndex.csproj       | 18 +++++++++++++++++-
 src/CodeIndex/packages.lock.json     | 22 +++++++++++++++++++++-
 4 files changed, 57 insertions(+), 2 deletions(-)
 create mode 100644 changelog.d/unreleased/1602.fixed.md

diff --git a/DEVELOPER_GUIDE.md b/DEVELOPER_GUIDE.md
index 124036272a..ceb759f232 100644
--- a/DEVELOPER_GUIDE.md
+++ b/DEVELOPER_GUIDE.md
@@ -107,6 +107,8 @@ The repository root `nuget.config` is part of this supply-chain boundary. It cle
 
 CI (`.github/workflows/dotnet.yml`, `release.yml`, `codeql.yml`) restores the solution with `--locked-mode`, so any drift between the committed lock files and the resolution graph fails the build instead of slipping into artifacts. Local development restores normally; the lock file is only enforced in CI.
 
+The `CodeIndex` package project opts into deterministic builds and publishes repository metadata for Source Link. On GitHub Actions it also sets `ContinuousIntegrationBuild=true` and embeds untracked source inputs so PDBs and `.snupkg` artifacts can map back to the repository without local machine paths. Build metadata uses the Git commit date when available instead of the wall-clock build date so repeated builds of the same commit do not drift by timestamp. `Microsoft.SourceLink.GitHub` is a build-only dependency (`PrivateAssets=All`), not a runtime dependency.
+
 The normal build/test workflow also runs `dotnet list src/CodeIndex/CodeIndex.csproj package --vulnerable --include-transitive --no-restore` after locked restore and fails on any High or Critical NuGet advisory in direct or transitive runtime packages. Dependabot is configured for weekly NuGet and GitHub Actions update PRs in `.github/dependabot.yml`, so security fixes and routine dependency/action bumps are proposed before they become release surprises.
 
 The release `dotnet publish` (per-RID) and `dotnet pack` (NuGet packaging) steps intentionally do **not** set `RestoreLockedMode=true`. Those steps run runtime-specific restores that legitimately add lock entries that did not exist at solution-restore time (e.g. `net8.0/<rid>` runtime sections, `Microsoft.NET.ILLink.Tasks` for trimming). They still consume locked versions because `RestorePackagesWithLockFile=true` from `Directory.Build.props` forces every restore on the machine to resolve through the lock file. The supply-chain guarantee for `Microsoft.Data.Sqlite` and its `SQLitePCLRaw.*` graph is enforced by the solution-level locked restore that runs first.
diff --git a/changelog.d/unreleased/1602.fixed.md b/changelog.d/unreleased/1602.fixed.md
new file mode 100644
index 0000000000..6258654ac1
--- /dev/null
+++ b/changelog.d/unreleased/1602.fixed.md
@@ -0,0 +1,17 @@
+---
+category: fixed
+issues:
+  - 1602
+affected:
+  - src/CodeIndex/CodeIndex.csproj
+  - src/CodeIndex/packages.lock.json
+  - DEVELOPER_GUIDE.md
+---
+
+## English
+
+- **CodeIndex package builds now opt into deterministic Source Link metadata (#1602)** - the CLI project enables deterministic builds, CI reproducibility flags, repository URL publishing, build-only GitHub Source Link, and commit-date build metadata so release symbols can map back to stable repository sources.
+
+## 日本語
+
+- **CodeIndex パッケージビルドが deterministic な Source Link メタデータを有効化しました (#1602)** - CLI プロジェクトで deterministic build、CI 向け再現性フラグ、repository URL 公開、build-only の GitHub Source Link、commit date ベースのビルドメタデータを有効にし、リリースシンボルが安定したリポジトリ上のソースへ対応できるようにしました。
diff --git a/src/CodeIndex/CodeIndex.csproj b/src/CodeIndex/CodeIndex.csproj
index 634e1aa4ca..3905455263 100644
--- a/src/CodeIndex/CodeIndex.csproj
+++ b/src/CodeIndex/CodeIndex.csproj
@@ -11,6 +11,10 @@
     <EnableTrimAnalyzer>true</EnableTrimAnalyzer>
     <EnableAotAnalyzer>true</EnableAotAnalyzer>
     <TrimmerSingleWarn>false</TrimmerSingleWarn>
+    <Deterministic>true</Deterministic>
+    <PublishRepositoryUrl>true</PublishRepositoryUrl>
+    <ContinuousIntegrationBuild Condition="'$(GITHUB_ACTIONS)' == 'true'">true</ContinuousIntegrationBuild>
+    <EmbedUntrackedSources Condition="'$(GITHUB_ACTIONS)' == 'true'">true</EmbedUntrackedSources>
 
     <!--
       Embed a Windows app manifest declaring `longPathAware=true` so the OS
@@ -56,6 +60,7 @@
 
   <ItemGroup>
     <PackageReference Include="Microsoft.Data.Sqlite" Version="10.0.5" />
+    <PackageReference Include="Microsoft.SourceLink.GitHub" Version="8.0.0" PrivateAssets="All" />
   </ItemGroup>
 
   <ItemGroup>
@@ -92,6 +97,16 @@
       <Output TaskParameter="ConsoleOutput" PropertyName="CdidxGitShaRaw" />
       <Output TaskParameter="ExitCode" PropertyName="CdidxGitShaExitCode" />
     </Exec>
+    <Exec Command="git show -s --format=%cd --date=format:%Y-%m-%d HEAD"
+          ConsoleToMSBuild="true"
+          ContinueOnError="true"
+          IgnoreExitCode="true"
+          EchoOff="true"
+          StandardOutputImportance="low"
+          StandardErrorImportance="low">
+      <Output TaskParameter="ConsoleOutput" PropertyName="CdidxGitDateRaw" />
+      <Output TaskParameter="ExitCode" PropertyName="CdidxGitDateExitCode" />
+    </Exec>
     <Exec Command="git diff-index --quiet HEAD -- &quot;:/&quot; &quot;:(top,exclude,glob)**/packages.lock.json&quot;"
           ContinueOnError="true"
           IgnoreExitCode="true"
@@ -101,7 +116,8 @@
       <Output TaskParameter="ExitCode" PropertyName="CdidxGitDirtyExitCode" />
     </Exec>
     <PropertyGroup>
-      <CdidxBuildDate>$([System.DateTime]::UtcNow.ToString('yyyy-MM-dd'))</CdidxBuildDate>
+      <CdidxBuildDate Condition="'$(CdidxGitDateExitCode)' == '0' and '$(CdidxGitDateRaw)' != ''">$(CdidxGitDateRaw)</CdidxBuildDate>
+      <CdidxBuildDate Condition="'$(CdidxBuildDate)' == ''">$([System.DateTime]::UtcNow.ToString('yyyy-MM-dd'))</CdidxBuildDate>
       <CdidxBuildCommit Condition="'$(CdidxGitShaExitCode)' == '0' and '$(CdidxGitShaRaw)' != ''">$(CdidxGitShaRaw)</CdidxBuildCommit>
       <CdidxBuildCommit Condition="'$(CdidxBuildCommit)' == ''">unknown</CdidxBuildCommit>
       <CdidxBuildDirty Condition="'$(CdidxGitShaExitCode)' == '0' and '$(CdidxGitDirtyExitCode)' == '0'">clean</CdidxBuildDirty>
diff --git a/src/CodeIndex/packages.lock.json b/src/CodeIndex/packages.lock.json
index a6e065b39a..d26dab6d56 100644
--- a/src/CodeIndex/packages.lock.json
+++ b/src/CodeIndex/packages.lock.json
@@ -19,6 +19,21 @@
         "resolved": "8.0.22",
         "contentHash": "MhcMithKEiyyNkD2ZfbDZPmcOdi0GheGfg8saEIIEfD/fol3iHmcV8TsZkD4ZYz5gdUuoX4YtlVySUU7Sxl9SQ=="
       },
+      "Microsoft.SourceLink.GitHub": {
+        "type": "Direct",
+        "requested": "[8.0.0, )",
+        "resolved": "8.0.0",
+        "contentHash": "G5q7OqtwIyGTkeIOAc3u2ZuV/kicQaec5EaRnc0pIeSnh9LUjj+PYQrJYBURvDt7twGl2PKA7nSN0kz1Zw5bnQ==",
+        "dependencies": {
+          "Microsoft.Build.Tasks.Git": "8.0.0",
+          "Microsoft.SourceLink.Common": "8.0.0"
+        }
+      },
+      "Microsoft.Build.Tasks.Git": {
+        "type": "Transitive",
+        "resolved": "8.0.0",
+        "contentHash": "bZKfSIKJRXLTuSzLudMFte/8CempWjVamNUR5eHJizsy+iuOuO/k2gnh7W0dHJmYY0tBf+gUErfluCv5mySAOQ=="
+      },
       "Microsoft.Data.Sqlite.Core": {
         "type": "Transitive",
         "resolved": "10.0.5",
@@ -27,6 +42,11 @@
           "SQLitePCLRaw.core": "2.1.11"
         }
       },
+      "Microsoft.SourceLink.Common": {
+        "type": "Transitive",
+        "resolved": "8.0.0",
+        "contentHash": "dk9JPxTCIevS75HyEQ0E4OVAFhB2N+V9ShCXf8Q6FkUQZDkgLI12y679Nym1YqsiSysuQskT7Z+6nUf3yab6Vw=="
+      },
       "SQLitePCLRaw.bundle_e_sqlite3": {
         "type": "Transitive",
         "resolved": "2.1.11",
@@ -64,4 +84,4 @@
       }
     }
   }
-}
\ No newline at end of file
+}

From a1f1144651454ea3e60e4a8710456c17552dfc45 Mon Sep 17 00:00:00 2001
From: Widthdom <widthdom@gmail.com>
Date: Sun, 31 May 2026 22:34:02 +0900
Subject: [PATCH 3/3] Pin ILLink task for locked restore (#1598)

---
 src/CodeIndex/CodeIndex.csproj   | 1 +
 src/CodeIndex/packages.lock.json | 8 ++++----
 2 files changed, 5 insertions(+), 4 deletions(-)

diff --git a/src/CodeIndex/CodeIndex.csproj b/src/CodeIndex/CodeIndex.csproj
index 3905455263..a834a8d54f 100644
--- a/src/CodeIndex/CodeIndex.csproj
+++ b/src/CodeIndex/CodeIndex.csproj
@@ -60,6 +60,7 @@
 
   <ItemGroup>
     <PackageReference Include="Microsoft.Data.Sqlite" Version="10.0.5" />
+    <PackageReference Include="Microsoft.NET.ILLink.Tasks" Version="8.0.27" PrivateAssets="All" />
     <PackageReference Include="Microsoft.SourceLink.GitHub" Version="8.0.0" PrivateAssets="All" />
   </ItemGroup>
 
diff --git a/src/CodeIndex/packages.lock.json b/src/CodeIndex/packages.lock.json
index d26dab6d56..ccc7ad11f5 100644
--- a/src/CodeIndex/packages.lock.json
+++ b/src/CodeIndex/packages.lock.json
@@ -15,9 +15,9 @@
       },
       "Microsoft.NET.ILLink.Tasks": {
         "type": "Direct",
-        "requested": "[8.0.22, )",
-        "resolved": "8.0.22",
-        "contentHash": "MhcMithKEiyyNkD2ZfbDZPmcOdi0GheGfg8saEIIEfD/fol3iHmcV8TsZkD4ZYz5gdUuoX4YtlVySUU7Sxl9SQ=="
+        "requested": "[8.0.27, )",
+        "resolved": "8.0.27",
+        "contentHash": "rQi9TxifHRnXP7lVRZH05DxD2/XGbJp12q0ozcbrlBlBnyyzssFTH/2vLhtKWUp2CT1qVscTrcYTFiwTyKPKRg=="
       },
       "Microsoft.SourceLink.GitHub": {
         "type": "Direct",
@@ -84,4 +84,4 @@
       }
     }
   }
-}
+}
\ No newline at end of file