Skip to content

Commit 6d2fae1

Browse files
Update analyzers and add Meziantou.Analyzer + SBOM generation (#64)
Update analyzers and add Meziantou.Analyzer https://www.nuget.org/packages/Meziantou.Analyzer/
1 parent 055c5d9 commit 6d2fae1

31 files changed

Lines changed: 505 additions & 233 deletions

.editorconfig

Lines changed: 154 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,154 @@
1+
root = true
2+
3+
[*]
4+
charset = utf-8
5+
end_of_line = crlf
6+
insert_final_newline = true
7+
trim_trailing_whitespace = true
8+
9+
[*.{cs,vb}]
10+
# Code style rules
11+
dotnet_diagnostic.IDE1006.severity = error
12+
13+
# Visual Studio Spell Checker settings
14+
spelling_languages = en-us
15+
spelling_checkable_types = strings,identifiers,comments
16+
spelling_error_severity = warning
17+
spelling_use_default_exclusion_dictionary = true
18+
spelling_exclusion_path = .\exclusion.dic
19+
20+
[*.cs]
21+
# CS1591: Missing XML comment for publicly visible type or member
22+
dotnet_diagnostic.CS1591.severity = warning
23+
24+
# Organize usings
25+
dotnet_sort_system_directives_first = true
26+
dotnet_separate_import_directive_groups = true
27+
28+
# Missing usings should be reported as error (IDE0005)
29+
dotnet_diagnostic.IDE0005.severity = error
30+
31+
# Additional best practice rules as errors
32+
# IDE0003: Remove qualification
33+
dotnet_diagnostic.IDE0003.severity = error
34+
# IDE0009: Member access should be qualified
35+
dotnet_diagnostic.IDE0009.severity = error
36+
# IDE0017: Simplify object initialization
37+
dotnet_diagnostic.IDE0017.severity = error
38+
# IDE0028: Simplify collection initialization
39+
dotnet_diagnostic.IDE0028.severity = error
40+
# IDE0032: Use auto property
41+
dotnet_diagnostic.IDE0032.severity = error
42+
# IDE0034: Simplify 'default' expression
43+
dotnet_diagnostic.IDE0034.severity = error
44+
# IDE0036: Order modifiers
45+
dotnet_diagnostic.IDE0036.severity = error
46+
# IDE0040: Add accessibility modifiers
47+
dotnet_diagnostic.IDE0040.severity = error
48+
# IDE0044: Add readonly modifier
49+
dotnet_diagnostic.IDE0044.severity = error
50+
# IDE0049: Simplify names
51+
dotnet_diagnostic.IDE0049.severity = error
52+
# IDE0051: Remove unused private members
53+
dotnet_diagnostic.IDE0051.severity = error
54+
# IDE0052: Remove unread private members
55+
dotnet_diagnostic.IDE0052.severity = error
56+
# IDE0055: Fix formatting
57+
dotnet_diagnostic.IDE0055.severity = error
58+
# IDE0058: Expression value is never used
59+
dotnet_diagnostic.IDE0058.severity = suggestion
60+
# IDE0059: Unnecessary assignment of a value
61+
dotnet_diagnostic.IDE0059.severity = error
62+
# IDE0060: Remove unused parameter
63+
dotnet_diagnostic.IDE0060.severity = error
64+
# IDE0062: Make local function 'static'
65+
dotnet_diagnostic.IDE0062.severity = error
66+
# IDE0063: Use simple 'using' statement
67+
dotnet_diagnostic.IDE0063.severity = error
68+
# IDE0065: Misplaced using directive
69+
dotnet_diagnostic.IDE0065.severity = error
70+
# IDE0066: Convert switch statement to expression
71+
dotnet_diagnostic.IDE0066.severity = suggestion
72+
# IDE0090: Use 'new(...)'
73+
dotnet_diagnostic.IDE0090.severity = error
74+
# IDE0100: Remove redundant equality
75+
dotnet_diagnostic.IDE0100.severity = error
76+
# IDE0110: Remove unnecessary discard
77+
dotnet_diagnostic.IDE0110.severity = error
78+
79+
# Security rules as errors
80+
# CA2100: Review SQL queries for security vulnerabilities
81+
dotnet_diagnostic.CA2100.severity = error
82+
# CA2109: Review visible event handlers
83+
dotnet_diagnostic.CA2109.severity = error
84+
# CA2119: Seal methods that satisfy private interfaces
85+
dotnet_diagnostic.CA2119.severity = error
86+
# CA3001: Review code for SQL injection vulnerabilities
87+
dotnet_diagnostic.CA3001.severity = error
88+
# CA3002: Review code for XSS vulnerabilities
89+
dotnet_diagnostic.CA3002.severity = error
90+
# CA3003: Review code for file path injection vulnerabilities
91+
dotnet_diagnostic.CA3003.severity = error
92+
# CA3004: Review code for information disclosure vulnerabilities
93+
dotnet_diagnostic.CA3004.severity = error
94+
# CA3005: Review code for LDAP injection vulnerabilities
95+
dotnet_diagnostic.CA3005.severity = error
96+
# CA3006: Review code for process command injection vulnerabilities
97+
dotnet_diagnostic.CA3006.severity = error
98+
# CA3007: Review code for open redirect vulnerabilities
99+
dotnet_diagnostic.CA3007.severity = error
100+
# CA3008: Review code for XPath injection vulnerabilities
101+
dotnet_diagnostic.CA3008.severity = error
102+
# CA3009: Review code for XML injection vulnerabilities
103+
dotnet_diagnostic.CA3009.severity = error
104+
# CA3010: Review code for XAML injection vulnerabilities
105+
dotnet_diagnostic.CA3010.severity = error
106+
# CA3011: Review code for DLL injection vulnerabilities
107+
dotnet_diagnostic.CA3011.severity = error
108+
# CA3012: Review code for regex injection vulnerabilities
109+
dotnet_diagnostic.CA3012.severity = error
110+
111+
# Performance rules as errors
112+
# CA1802: Use literals where appropriate
113+
dotnet_diagnostic.CA1802.severity = error
114+
# CA1805: Do not initialize unnecessarily
115+
dotnet_diagnostic.CA1805.severity = error
116+
# CA1810: Initialize reference type static fields inline
117+
dotnet_diagnostic.CA1810.severity = error
118+
# CA1812: Avoid uninstantiated internal classes
119+
dotnet_diagnostic.CA1812.severity = error
120+
# CA1813: Avoid unsealed attributes
121+
dotnet_diagnostic.CA1813.severity = error
122+
# CA1814: Prefer jagged arrays over multidimensional
123+
dotnet_diagnostic.CA1814.severity = suggestion
124+
# CA1815: Override equals and operator equals on value types
125+
dotnet_diagnostic.CA1815.severity = error
126+
# CA1819: Properties should not return arrays
127+
dotnet_diagnostic.CA1819.severity = error
128+
# CA1820: Test for empty strings using string length
129+
dotnet_diagnostic.CA1820.severity = error
130+
# CA1821: Remove empty finalizers
131+
dotnet_diagnostic.CA1821.severity = error
132+
# CA1822: Mark members as static
133+
dotnet_diagnostic.CA1822.severity = suggestion
134+
# CA1823: Avoid unused private fields
135+
dotnet_diagnostic.CA1823.severity = error
136+
# CA1824: Mark assemblies with NeutralResourcesLanguageAttribute
137+
dotnet_diagnostic.CA1824.severity = suggestion
138+
# CA1825: Avoid zero-length array allocations
139+
dotnet_diagnostic.CA1825.severity = error
140+
141+
# AsyncFixer findings as errors
142+
# AsyncFixer01: Unnecessary async/await usage - Remove async/await when not needed to avoid performance penalty
143+
dotnet_diagnostic.AsyncFixer01.severity = error
144+
# AsyncFixer02: Long-running or blocking operations inside an async method - Replace blocking calls with async equivalents
145+
dotnet_diagnostic.AsyncFixer02.severity = error
146+
# AsyncFixer03: Fire-and-forget async-void methods and delegates - Convert async void to async Task (except event handlers)
147+
dotnet_diagnostic.AsyncFixer03.severity = error
148+
# AsyncFixer04: Fire-and-forget async call inside a using block - Await async operations that use disposable objects
149+
dotnet_diagnostic.AsyncFixer04.severity = error
150+
# AsyncFixer05: Downcasting from a nested task to an outer task - Avoid awaiting Task<Task>, use Unwrap() or Task.Run instead
151+
dotnet_diagnostic.AsyncFixer05.severity = error
152+
153+
# Roslynator findings as errors
154+
dotnet_analyzer_diagnostic.category-roslynator.severity = error

.github/workflows/build.yml

Lines changed: 14 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -55,11 +55,21 @@ jobs:
5555
5656
echo "VERSION=$VERSION" >> $env:GITHUB_OUTPUT
5757
58+
- name: Generate SBOM for the project
59+
uses: advanced-security/generate-sbom-action@v1
60+
id: gensbom
61+
5862
- name: Build AggregateConfigBuildTask solution in Release mode
59-
run: dotnet build src/AggregateConfigBuildTask.sln --configuration Release -warnaserror -p:Version=${{ steps.get_version.outputs.VERSION }}
63+
run: dotnet build src/dirs.proj --configuration Release -warnaserror -p:Version=${{ steps.get_version.outputs.VERSION }}
6064

6165
- name: Run tests for AggregateConfigBuildTask solution
62-
run: dotnet test src/AggregateConfigBuildTask.sln --configuration Release -warnaserror -p:Version=${{ steps.get_version.outputs.VERSION }} -p:CollectCoverage=true
66+
run: dotnet test src/dirs.proj --configuration Release -warnaserror -p:Version=${{ steps.get_version.outputs.VERSION }} -p:CollectCoverage=true --no-build
67+
68+
- name: Upload SBOM artifact
69+
uses: actions/upload-artifact@v4
70+
with:
71+
name: sbom
72+
path: ${{ steps.gensbom.outputs.fileName }}
6373

6474
- name: Upload NuGetPackage artifact
6575
uses: actions/upload-artifact@v4
@@ -98,10 +108,10 @@ jobs:
98108
run: dotnet nuget add source ${{ github.workspace }}/nuget/local --name AggregateConfigBuildTask
99109

100110
- name: Build IntegrationTests in Release mode
101-
run: dotnet build test/IntegrationTests.sln --configuration Release -warnaserror -p:Version=${{ needs.build.outputs.VERSION }}
111+
run: dotnet build test/dirs.proj --configuration Release -warnaserror -p:Version=${{ needs.build.outputs.VERSION }} -p:UseLocalPackageVersion=true
102112

103113
- name: Run IntegrationTests
104-
run: dotnet test test/IntegrationTests.sln --configuration Release -warnaserror -p:Version=${{ needs.build.outputs.VERSION }} -p:CollectCoverage=true
114+
run: dotnet test test/dirs.proj --configuration Release -warnaserror -p:Version=${{ needs.build.outputs.VERSION }} -p:CollectCoverage=true -p:UseLocalPackageVersion=true
105115

106116
- name: Upload integration results artifact
107117
uses: actions/upload-artifact@v4
Lines changed: 14 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,13 +1,14 @@
1-
<Project>
2-
3-
<PropertyGroup>
4-
<GenerateDocumentationFile>true</GenerateDocumentationFile>
5-
<Deterministic>true</Deterministic>
6-
<EnableNETAnalyzers>true</EnableNETAnalyzers>
7-
<AnalysisLevel>latest</AnalysisLevel>
8-
<TreatWarningsAsErrors>false</TreatWarningsAsErrors>
9-
<CodeAnalysisTreatWarningsAsErrors>false</CodeAnalysisTreatWarningsAsErrors>
10-
<AnalysisMode>AllEnabledByDefault</AnalysisMode>
11-
</PropertyGroup>
12-
13-
</Project>
1+
<Project>
2+
3+
<PropertyGroup>
4+
<GenerateDocumentationFile>true</GenerateDocumentationFile>
5+
<Deterministic>true</Deterministic>
6+
<EnableNETAnalyzers>true</EnableNETAnalyzers>
7+
<AnalysisLevel>latest</AnalysisLevel>
8+
<TreatWarningsAsErrors>true</TreatWarningsAsErrors>
9+
<CodeAnalysisTreatWarningsAsErrors>true</CodeAnalysisTreatWarningsAsErrors>
10+
<AnalysisMode>AllEnabledByDefault</AnalysisMode>
11+
<EnforceCodeStyleInBuild>true</EnforceCodeStyleInBuild>
12+
</PropertyGroup>
13+
14+
</Project>
Lines changed: 39 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,35 +1,39 @@
1-
<Project>
2-
<PropertyGroup>
3-
<ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
4-
</PropertyGroup>
5-
<!-- Build packages-->
6-
<ItemGroup>
7-
<PackageVersion Include="Microsoft.Build.Framework" Version="17.14.8" PrivateAssets="all" />
8-
<PackageVersion Include="Microsoft.Build.Utilities.Core" Version="17.14.8" PrivateAssets="all" />
9-
<PackageVersion Include="Microsoft.SourceLink.GitHub" Version="8.0.0" PrivateAssets="all" />
10-
</ItemGroup>
11-
<!-- Runtime packages -->
12-
<ItemGroup>
13-
<PackageVersion Include="Microsoft.Bcl.AsyncInterfaces" Version="9.0.6" PrivateAssets="all" />
14-
<PackageVersion Include="System.IO.Pipelines" Version="9.0.6" PrivateAssets="all" />
15-
<PackageVersion Include="System.Text.Encodings.Web" Version="9.0.6" PrivateAssets="all" />
16-
<PackageVersion Include="System.Text.Json" Version="9.0.6" PrivateAssets="all" />
17-
<PackageVersion Include="YamlDotNet" Version="16.3.0" PrivateAssets="all" GeneratePathProperty="true" />
18-
<PackageVersion Include="YamlDotNet.System.Text.Json" Version="1.6.6" PrivateAssets="all" />
19-
</ItemGroup>
20-
<!-- Test packages -->
21-
<ItemGroup>
22-
<PackageVersion Include="coverlet.collector" Version="6.0.4" />
23-
<PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
24-
<PackageVersion Include="Moq" Version="4.20.72" />
25-
<PackageVersion Include="MSTest.TestAdapter" Version="3.9.3" />
26-
<PackageVersion Include="MSTest.TestFramework" Version="3.9.3" />
27-
</ItemGroup>
28-
<!-- Global packages -->
29-
<ItemGroup>
30-
<GlobalPackageReference Include="AsyncFixer" Version="1.6.0" />
31-
<GlobalPackageReference Include="Microsoft.CodeAnalysis.NetAnalyzers" Version="9.0.0" />
32-
<GlobalPackageReference Include="ReferenceTrimmer" Version="3.3.11" />
33-
<GlobalPackageReference Include="Roslynator.Analyzers" Version="4.13.1" />
34-
</ItemGroup>
35-
</Project>
1+
<Project>
2+
<PropertyGroup>
3+
<ManagePackageVersionsCentrally>true</ManagePackageVersionsCentrally>
4+
<!-- Exclude local packages from central management -->
5+
<CentralPackageTransitivePinningEnabled>false</CentralPackageTransitivePinningEnabled>
6+
</PropertyGroup>
7+
<!-- Build packages-->
8+
<ItemGroup>
9+
<PackageVersion Include="Microsoft.Build.Framework" Version="17.14.8" PrivateAssets="all" />
10+
<PackageVersion Include="Microsoft.Build.Utilities.Core" Version="17.14.8" PrivateAssets="all" />
11+
<PackageVersion Include="Microsoft.SourceLink.GitHub" Version="8.0.0" PrivateAssets="all" />
12+
</ItemGroup>
13+
<!-- Runtime packages -->
14+
<ItemGroup>
15+
<PackageVersion Include="Microsoft.Bcl.AsyncInterfaces" Version="9.0.6" PrivateAssets="all" />
16+
<PackageVersion Include="System.IO.Pipelines" Version="9.0.6" PrivateAssets="all" />
17+
<PackageVersion Include="System.Text.Encodings.Web" Version="9.0.6" PrivateAssets="all" />
18+
<PackageVersion Include="System.Text.Json" Version="9.0.6" PrivateAssets="all" />
19+
<PackageVersion Include="YamlDotNet" Version="16.3.0" PrivateAssets="all" GeneratePathProperty="true" />
20+
<PackageVersion Include="YamlDotNet.System.Text.Json" Version="1.6.6" PrivateAssets="all" />
21+
</ItemGroup>
22+
<!-- Test packages -->
23+
<ItemGroup>
24+
<PackageVersion Include="AggregateConfigBuildTask" Version="1.0.8" />
25+
<PackageVersion Include="coverlet.collector" Version="6.0.4" />
26+
<PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.14.1" />
27+
<PackageVersion Include="Moq" Version="4.20.72" />
28+
<PackageVersion Include="MSTest.TestAdapter" Version="3.9.3" />
29+
<PackageVersion Include="MSTest.TestFramework" Version="3.9.3" />
30+
</ItemGroup>
31+
<!-- Global packages -->
32+
<ItemGroup>
33+
<GlobalPackageReference Include="AsyncFixer" Version="1.6.0" />
34+
<GlobalPackageReference Include="Meziantou.Analyzer" Version="2.0.205" />
35+
<GlobalPackageReference Include="Microsoft.CodeAnalysis.NetAnalyzers" Version="9.0.0" />
36+
<GlobalPackageReference Include="ReferenceTrimmer" Version="3.3.12" />
37+
<GlobalPackageReference Include="Roslynator.Analyzers" Version="4.13.1" />
38+
</ItemGroup>
39+
</Project>

README.md

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -359,6 +359,28 @@ foreach (var name in resourceNames)
359359

360360
This will list all embedded resources, allowing you to confirm the correct name to use when loading the resource.
361361

362+
## Development
363+
364+
This project uses `dirs.proj` files with the Microsoft.Build.Traversal SDK for project organization instead of traditional solution files. This approach provides better performance and more flexibility for build scenarios.
365+
366+
### Generating Solution Files
367+
368+
If you need Visual Studio solution files for development, you can generate them using the [Microsoft.VisualStudio.SlnGen](https://github.com/microsoft/slngen) global tool:
369+
370+
```bash
371+
# Install the slngen global tool
372+
dotnet tool install --global Microsoft.VisualStudio.SlnGen
373+
374+
# Generate solution files from dirs.proj files
375+
slngen src/dirs.proj --folders true
376+
slngen test/dirs.proj --folders true
377+
378+
# Or generate a solution for the entire repository
379+
slngen dirs.proj --folders true
380+
```
381+
382+
The generated solution files will include all projects referenced by the `dirs.proj` files and maintain the folder structure for easy navigation in Visual Studio.
383+
362384
## License
363385

364386
This project is licensed under the MIT License. See the [LICENSE](https://github.com/richardsondev/AggregateConfigBuildTask/blob/main/LICENSE) file for details.

dirs.proj

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
<Project Sdk="Microsoft.Build.Traversal">
2+
3+
<ItemGroup>
4+
<!-- Folder-level project references -->
5+
<ProjectReference Include="src\dirs.proj" />
6+
<ProjectReference Include="test\dirs.proj" />
7+
</ItemGroup>
8+
9+
</Project>

global.json

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
{
2+
"sdk": {
3+
"version": "9.0.301",
4+
"rollForward": "latestFeature"
5+
},
6+
"msbuild-sdks": {
7+
"Microsoft.Build.Traversal": "4.1.82"
8+
}
9+
}

src/.editorconfig

Lines changed: 0 additions & 21 deletions
This file was deleted.

0 commit comments

Comments
 (0)