BuildServiceProviderAnalyzer: Detect BuildServiceProvider Calls in Extension Methods for IServiceCollection

[zeisi]

Background and Motivation

<!--
We welcome new analyzers and codefixers in the ASP.NET repo!

We use the same process to review both new analyzer/codefixer submissions and API proposals. There is an overview of our process [here](https://github.com/dotnet/aspnetcore/blob/main/docs/APIReviewProcess.md). This template will help us gather the information we need to start the review process.

Under this heading, describe the problem that your analyzer is trying to solve. Examples of great motivating scenarios include helping users avoid
performance issues, potentially insecure code, or recommending better APIs for a scenario.
-->

The current ASP0000 warning in the .NET SDK is designed to catch calls to `BuildServiceProvider` within the `Startup.cs` or similar initialization files where the `IServiceCollection` is configured. However, this warning does not trigger when `BuildServiceProvider` is called within extension methods for `IServiceCollection`. This can lead to issues such as multiple service provider instances, increased thread count, memory leaks, and performance degradation, which are the very problems the ASP0000 warning aims to prevent.

In our project, we encountered performance issues and an unusually high thread count due to calls to `BuildServiceProvider` within an extension method. These calls went undetected by the current analyzer, causing significant debugging challenges.

Proposed Analyzer

Analyzer Behavior and Message

<!--
Provide a description of when the analyzer will trigger and the associated analyzer message.
-->

The proposed analyzer will trigger when `BuildServiceProvider` is called within any extension method for `IServiceCollection`. The analyzer message should inform the user that calling `BuildServiceProvider` within an extension method can lead to multiple service provider instances and should be avoided.

**Analyzer Message Example:**
"Calling 'BuildServiceProvider' within an extension method for 'IServiceCollection' can lead to multiple service provider instances and performance issues. Consider refactoring your code to avoid this."

Category

• Design
• Documentation
• Globalization
• Interoperability
• Maintainability
• Naming
• Performance
• Reliability
• Security
• Style
• Usage

Severity Level

• Error
• Warning
• Info
• Hidden

Usage Scenarios

<!--
Provide code examples that would trigger your analyzer to warn. Identify the spans of code that the analyzer
will be triggered on. When applicable, describe the result of the code fix associated with the change.
-->

Scenario 1: Undetected `BuildServiceProvider` Call in Extension Method

Below is an example of code that currently does not trigger the ASP0000 warning but should:

namespace hollu.Profitool.PimSoapClient.ServiceCollection
{
    public static class ServiceCollectionExtensions
    {
        public static void AddholluProductSearchServices(this IServiceCollection services, IConfiguration configuration)
        {
            services.AddScoped(
                serviceProvider => LoggingDecorator<IPIMProductSearchService>.Create(
                    CachingDecorator<IPIMProductSearchService>.Create(
                        new PIMProductSearchService(serviceProvider.GetService<IPIMQueryBuilderService>(), serviceProvider.GetService<IOptions<PIMConfiguration>>()),
                        services.BuildServiceProvider().GetRequiredService<ICachingService>())));
        }
    }
}

Risks

<!--
Please mention any risks that to your knowledge the API proposal might entail, such as breaking changes, performance regressions, etc.
-->

There are minimal risks associated with this proposal. The primary concern would be ensuring that the analyzer does not produce false positives or interfere with valid use cases. However, the benefit of catching a potentially significant anti-pattern far outweighs the minimal risk. The analyzer will help prevent performance issues, reduce debugging time, and improve the reliability of ASP.NET Core applications.