Summary
CodeIndex.csproj does not enable deterministic / reproducible build flags. PDBs and .nupkg artifacts will embed local paths and timestamps that vary build-to-build, defeating Source Link, breaking binary reproducibility audits, and making "is this the same artifact?" verification impossible.
Where
src/CodeIndex/CodeIndex.csproj:1-51
Missing properties:
<ContinuousIntegrationBuild>true</ContinuousIntegrationBuild> (under a Condition="'$(GITHUB_ACTIONS)' == 'true'")<Deterministic>true</Deterministic><EmbedUntrackedSources>true</EmbedUntrackedSources><PublishRepositoryUrl>true</PublishRepositoryUrl>- Microsoft.SourceLink.GitHub package reference
Why it matters
Without these, the pipeline cannot guarantee reproducibility between two CI runs of the same tag, which weakens any future supply-chain attestation effort (SLSA, SBOM, in-toto). Source Link also requires deterministic builds to function correctly with .snupkg consumers.
Suggested approach
Add the listed properties (gated on CI to avoid local-dev side effects). Add Microsoft.SourceLink.GitHub. Verify with dotnet pack twice that hash digests match.
Summary
CodeIndex.csprojdoes not enable deterministic / reproducible build flags. PDBs and.nupkgartifacts will embed local paths and timestamps that vary build-to-build, defeating Source Link, breaking binary reproducibility audits, and making "is this the same artifact?" verification impossible.Where
src/CodeIndex/CodeIndex.csproj:1-51Missing properties:
<ContinuousIntegrationBuild>true</ContinuousIntegrationBuild>(under aCondition="'$(GITHUB_ACTIONS)' == 'true'")<Deterministic>true</Deterministic><EmbedUntrackedSources>true</EmbedUntrackedSources><PublishRepositoryUrl>true</PublishRepositoryUrl>Why it matters
Without these, the pipeline cannot guarantee reproducibility between two CI runs of the same tag, which weakens any future supply-chain attestation effort (SLSA, SBOM, in-toto). Source Link also requires deterministic builds to function correctly with
.snupkgconsumers.Suggested approach
Add the listed properties (gated on CI to avoid local-dev side effects). Add
Microsoft.SourceLink.GitHub. Verify withdotnet packtwice that hash digests match.