Enable trim analyzers and deterministic package metadata

DEVELOPER_GUIDE.md

@@ -107,6 +107,8 @@ The repository root `nuget.config` is part of this supply-chain boundary. It cle
 
 CI (`.github/workflows/dotnet.yml`, `release.yml`, `codeql.yml`) restores the solution with `--locked-mode`, so any drift between the committed lock files and the resolution graph fails the build instead of slipping into artifacts. Local development restores normally; the lock file is only enforced in CI.
 
+The `CodeIndex` package project opts into deterministic builds and publishes repository metadata for Source Link. On GitHub Actions it also sets `ContinuousIntegrationBuild=true` and embeds untracked source inputs so PDBs and `.snupkg` artifacts can map back to the repository without local machine paths. Build metadata uses the Git commit date when available instead of the wall-clock build date so repeated builds of the same commit do not drift by timestamp. `Microsoft.SourceLink.GitHub` is a build-only dependency (`PrivateAssets=All`), not a runtime dependency.
+
 The normal build/test workflow also runs `dotnet list src/CodeIndex/CodeIndex.csproj package --vulnerable --include-transitive --no-restore` after locked restore and fails on any High or Critical NuGet advisory in direct or transitive runtime packages. Dependabot is configured for weekly NuGet and GitHub Actions update PRs in `.github/dependabot.yml`, so security fixes and routine dependency/action bumps are proposed before they become release surprises.
 
 The release `dotnet publish` (per-RID) and `dotnet pack` (NuGet packaging) steps intentionally do **not** set `RestoreLockedMode=true`. Those steps run runtime-specific restores that legitimately add lock entries that did not exist at solution-restore time (e.g. `net8.0/<rid>` runtime sections, `Microsoft.NET.ILLink.Tasks` for trimming). They still consume locked versions because `RestorePackagesWithLockFile=true` from `Directory.Build.props` forces every restore on the machine to resolve through the lock file. The supply-chain guarantee for `Microsoft.Data.Sqlite` and its `SQLitePCLRaw.*` graph is enforced by the solution-level locked restore that runs first.

changelog.d/unreleased/1598.fixed.md

@@ -0,0 +1,15 @@
+---
+category: fixed
+issues:
+  - 1598
+affected:
+  - src/CodeIndex/CodeIndex.csproj
+---
+
+## English
+
+- **Trim and AOT analyzer warnings now surface during CodeIndex builds (#1598)** - the CLI project declares trim compatibility and enables trim/AOT analyzers with per-site trimmer warnings, so reflection-sensitive release issues are caught before publishing trimmed binaries.
+
+## 日本語
+
+- **CodeIndex ビルドで trim / AOT analyzer 警告が表面化するようになりました (#1598)** - CLI プロジェクトが trim 互換性を宣言し、trim / AOT analyzer と箇所別の trimmer 警告を有効化したため、reflection に依存するリリース問題を trimmed バイナリ公開前に検出できます。

changelog.d/unreleased/1602.fixed.md

@@ -0,0 +1,17 @@
+---
+category: fixed
+issues:
+  - 1602
+affected:
+  - src/CodeIndex/CodeIndex.csproj
+  - src/CodeIndex/packages.lock.json
+  - DEVELOPER_GUIDE.md
+---
+
+## English
+
+- **CodeIndex package builds now opt into deterministic Source Link metadata (#1602)** - the CLI project enables deterministic builds, CI reproducibility flags, repository URL publishing, build-only GitHub Source Link, and commit-date build metadata so release symbols can map back to stable repository sources.
+
+## 日本語
+
+- **CodeIndex パッケージビルドが deterministic な Source Link メタデータを有効化しました (#1602)** - CLI プロジェクトで deterministic build、CI 向け再現性フラグ、repository URL 公開、build-only の GitHub Source Link、commit date ベースのビルドメタデータを有効にし、リリースシンボルが安定したリポジトリ上のソースへ対応できるようにしました。

src/CodeIndex/CodeIndex.csproj

@@ -7,6 +7,14 @@
     <RootNamespace>CodeIndex</RootNamespace>
     <ImplicitUsings>enable</ImplicitUsings>
     <Nullable>enable</Nullable>
+    <IsTrimmable>true</IsTrimmable>
+    <EnableTrimAnalyzer>true</EnableTrimAnalyzer>
+    <EnableAotAnalyzer>true</EnableAotAnalyzer>
+    <TrimmerSingleWarn>false</TrimmerSingleWarn>
+    <Deterministic>true</Deterministic>
+    <PublishRepositoryUrl>true</PublishRepositoryUrl>
+    <ContinuousIntegrationBuild Condition="'$(GITHUB_ACTIONS)' == 'true'">true</ContinuousIntegrationBuild>
+    <EmbedUntrackedSources Condition="'$(GITHUB_ACTIONS)' == 'true'">true</EmbedUntrackedSources>
 
     <!--
       Embed a Windows app manifest declaring `longPathAware=true` so the OS
@@ -52,6 +60,8 @@
 
   <ItemGroup>
     <PackageReference Include="Microsoft.Data.Sqlite" Version="10.0.5" />
+    <PackageReference Include="Microsoft.NET.ILLink.Tasks" Version="8.0.27" PrivateAssets="All" />
+    <PackageReference Include="Microsoft.SourceLink.GitHub" Version="8.0.0" PrivateAssets="All" />
   </ItemGroup>
 
   <ItemGroup>
@@ -88,6 +98,16 @@
       <Output TaskParameter="ConsoleOutput" PropertyName="CdidxGitShaRaw" />
       <Output TaskParameter="ExitCode" PropertyName="CdidxGitShaExitCode" />
     </Exec>
+    <Exec Command="git show -s --format=%cd --date=format:%Y-%m-%d HEAD"
+          ConsoleToMSBuild="true"
+          ContinueOnError="true"
+          IgnoreExitCode="true"
+          EchoOff="true"
+          StandardOutputImportance="low"
+          StandardErrorImportance="low">
+      <Output TaskParameter="ConsoleOutput" PropertyName="CdidxGitDateRaw" />
+      <Output TaskParameter="ExitCode" PropertyName="CdidxGitDateExitCode" />
+    </Exec>
     <Exec Command="git diff-index --quiet HEAD -- &quot;:/&quot; &quot;:(top,exclude,glob)**/packages.lock.json&quot;"
           ContinueOnError="true"
           IgnoreExitCode="true"
@@ -97,7 +117,8 @@
       <Output TaskParameter="ExitCode" PropertyName="CdidxGitDirtyExitCode" />
     </Exec>
     <PropertyGroup>
-      <CdidxBuildDate>$([System.DateTime]::UtcNow.ToString('yyyy-MM-dd'))</CdidxBuildDate>
+      <CdidxBuildDate Condition="'$(CdidxGitDateExitCode)' == '0' and '$(CdidxGitDateRaw)' != ''">$(CdidxGitDateRaw)</CdidxBuildDate>
+      <CdidxBuildDate Condition="'$(CdidxBuildDate)' == ''">$([System.DateTime]::UtcNow.ToString('yyyy-MM-dd'))</CdidxBuildDate>
       <CdidxBuildCommit Condition="'$(CdidxGitShaExitCode)' == '0' and '$(CdidxGitShaRaw)' != ''">$(CdidxGitShaRaw)</CdidxBuildCommit>
       <CdidxBuildCommit Condition="'$(CdidxBuildCommit)' == ''">unknown</CdidxBuildCommit>
       <CdidxBuildDirty Condition="'$(CdidxGitShaExitCode)' == '0' and '$(CdidxGitDirtyExitCode)' == '0'">clean</CdidxBuildDirty>

src/CodeIndex/packages.lock.json

@@ -13,6 +13,27 @@
           "SQLitePCLRaw.core": "2.1.11"
         }
       },
+      "Microsoft.NET.ILLink.Tasks": {
+        "type": "Direct",
+        "requested": "[8.0.27, )",
+        "resolved": "8.0.27",
+        "contentHash": "rQi9TxifHRnXP7lVRZH05DxD2/XGbJp12q0ozcbrlBlBnyyzssFTH/2vLhtKWUp2CT1qVscTrcYTFiwTyKPKRg=="
+      },
+      "Microsoft.SourceLink.GitHub": {
+        "type": "Direct",
+        "requested": "[8.0.0, )",
+        "resolved": "8.0.0",
+        "contentHash": "G5q7OqtwIyGTkeIOAc3u2ZuV/kicQaec5EaRnc0pIeSnh9LUjj+PYQrJYBURvDt7twGl2PKA7nSN0kz1Zw5bnQ==",
+        "dependencies": {
+          "Microsoft.Build.Tasks.Git": "8.0.0",
+          "Microsoft.SourceLink.Common": "8.0.0"
+        }
+      },
+      "Microsoft.Build.Tasks.Git": {
+        "type": "Transitive",
+        "resolved": "8.0.0",
+        "contentHash": "bZKfSIKJRXLTuSzLudMFte/8CempWjVamNUR5eHJizsy+iuOuO/k2gnh7W0dHJmYY0tBf+gUErfluCv5mySAOQ=="
+      },
       "Microsoft.Data.Sqlite.Core": {
         "type": "Transitive",
         "resolved": "10.0.5",
@@ -21,6 +42,11 @@
           "SQLitePCLRaw.core": "2.1.11"
         }
       },
+      "Microsoft.SourceLink.Common": {
+        "type": "Transitive",
+        "resolved": "8.0.0",
+        "contentHash": "dk9JPxTCIevS75HyEQ0E4OVAFhB2N+V9ShCXf8Q6FkUQZDkgLI12y679Nym1YqsiSysuQskT7Z+6nUf3yab6Vw=="
+      },
       "SQLitePCLRaw.bundle_e_sqlite3": {
         "type": "Transitive",
         "resolved": "2.1.11",