Skip to content

Conversation

Copy link
Contributor

Copilot AI commented Dec 24, 2025

Orchestrations were only flagged for System.Environment usage, missing configuration- and options-based paths to environment data.

  • Symbol coverage: Added IConfiguration, IOptions<T>, IOptionsSnapshot<T>, and IOptionsMonitor<T> to known symbols used by the analyzer.
  • Analyzer logic: Extended environment analyzer to report diagnostics when configuration/options members (methods, indexers, properties) are accessed, including extension methods.
  • Tests: Added orchestration analyzer cases covering IConfiguration indexer/GetSection and IOptions/IOptionsSnapshot/IOptionsMonitor value access.

Example:

[Function("Run")]
void Method([OrchestrationTrigger] TaskOrchestrationContext context,
            IConfiguration config,
            IOptions<MyOptions> opts)
{
    _ = config["PATH"];          // now flagged
    _ = opts.Value;              // now flagged
}
Original prompt

This section details on the original issue you should resolve

<issue_title>Improve environment variable analyzer to catch dotnet configuration APIs</issue_title>
<issue_description>PR #309 introduced a roslyn analyzer to prevent users from using environment variables.
But besides accessing it directly from System.Environment, users may still reference configuration through other APIs such as
IConfiguration, IOptions, IOptionsSnapshot and IOptionsMonitor. We could enhance the implementation to catch those cases too.</issue_description>

Comments on the Issue (you are @copilot in this section)


✨ Let Copilot coding agent set things up for you — coding agent works faster and does higher quality work when set up for your repo.

Co-authored-by: YunchuWang <12449837+YunchuWang@users.noreply.github.com>
Copilot AI changed the title [WIP] Enhance environment variable analyzer for dotnet configuration APIs Improve environment analyzer to catch configuration-based access Dec 24, 2025
Copilot AI requested a review from YunchuWang December 24, 2025 19:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Improve environment variable analyzer to catch dotnet configuration APIs

2 participants