fix: restore the EventLog entries dropped from the GUI lock file #534

	name: CodeQL

	on:
	push:
	branches: [main]
	pull_request:
	branches: [main]
	schedule:
	- cron: '0 6 * * 1' # Weekly Monday 06:00 UTC
	# Dispatched by the Dependabot relock job so this required check runs on the
	# lock-file commit it pushes; a GITHUB_TOKEN push starts no run of its own.
	workflow_dispatch:

	jobs:
	analyse:
	name: Analyse C#
	# See the matching comment in ci.yml: pinned to windows-2025
	# ahead of the 2026-06-15 windows-latest flip so incompatibility
	# shows up early.
	runs-on: windows-2025
	permissions:
	security-events: write

	steps:
	- name: Checkout
	uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0

	- name: Setup .NET
	uses: actions/setup-dotnet@a98b56852c35b8e3190ac28c8c2271da59106c68 # v6.0.0
	with:
	global-json-file: global.json

	- name: Initialise CodeQL
	uses: github/codeql-action/init@7188fc363630916deb702c7fdcf4e481b751f97a # v4
	with:
	languages: csharp
	# security-extended adds the higher-recall, lower-precision query pack on
	# top of the default suite: more alerts to triage in exchange for catching
	# classes the default set leaves out, which is the right trade for an app
	# that runs elevated and reaches COM, P/Invoke and the registry.
	queries: security-extended

	- name: Build
	# The whole solution, so the CLI host is analysed too; Core flows
	# in transitively but the console entry point does not.
	run: dotnet build src/InstallerClean.sln

	- name: Perform CodeQL Analysis
	uses: github/codeql-action/analyze@7188fc363630916deb702c7fdcf4e481b751f97a # v4

Provide feedback