BuildCheck NET 10.0 investments

[JanKrivanek]

Context

In net 9.0 we delivered initial preview of BuildCheck feature.

• Spec: https://github.com/dotnet/msbuild/blob/main/documentation/specs/BuildCheck/BuildCheck.md
• Work track: https://github.com/orgs/dotnet/projects/373

This item captures high level thinking of continuation of that work in net 10.0 - which will aim for increased adoption and improved usability based on the collected feedback and data.

Priority bugs

• build checks exception #11209

Suggested areas of investments

Based on team discussion and voting we came up with following areas (in aproxiate priority order):

• Dogfooding (P'0')
  • idea: use VS feature flagging to test run BuildChecks on subset of users (even just internals) + this can be used to get perf data
  • BuildChecks Dogfooding: Collect info from sample repos #10726
• Telemetry / data collection (usage, performance and failures data collection)
  • Add BuildCheck basic telemetry #10634
• UX investments (p1)
  • UX for users [ ] Usability: Investigate and prototype VS piloting #10727
    • VS and VS Code usability and opt-in
    • CLI and VS diagnostics usability (unifying the experience with native diagnostics)
  • UX for extensibility authors
    • templates, debuggability story
• Performance (tracing, measurments, tunning; DTB and full (CI) build PoV) (P1)
  • Watch and evaluate performance impact of changes #9829
• OM and API concepts (P1/P2)
  • scoping, locations
  • versioning (ability to run analyzers compiled against older V of API to be runnable in newer MSBuild)
• Built-in Rules - should be reactive on community reactions
  • + continuation of Analyzers prototyping - Representative analyzers set #9630:
    • [Built-in analyzer] TargetFramework and TargetFrameworks are both set #9880
    • [Built-in analyzer] EmbeddedResource item is missing the Culture metadata #9882
    • [Built-in analyzer] Item is updated inside a target #9884
    • [Built-in analyzer] Reference item points to the output of a project #9888
    • [Built-in analyzer] MSBuild task with BuildInParallel is batched #9889
    • [Built-in analyzer] Property that starts with an underscore is set #9891
    • [Built-in analyzer] String comparison is not properly quoted #9892
  • + Adopt some security check ideas:
    • Untrusted loacation check
    • Common targets (or any) task overwriten
    • Imports from unexpected locations
• OM and API enriching - should be reactive mode
  • exposing of additional engine data
• Configuration V2 (P3)
  • guidelinces + guardrails
  • support for native msbuild diagnostics
  • unification with Roslyn parser?
• Localization (priority: ?)
  • here we should ask Roslyn team what was their timeline on localization
  • MSFT policy is that products should be localized
  • inbox checks localization is a P1
  • for extensibility we can take some inspiration from Tasks localization

[JanKrivanek]

Another area:

• Replay improvements.
  • ability to mount new custom checks to the replay
  • ability to specify custom editorconfig to tune the level of checking

This can possibly be considered a subitem of the UX for extensibility authors

[Nirmal4G]

Allow BuildChecks to be published to and consumed from an SDK (on disk/NuGet) package.