Merge branch 'main' into dependabot/nuget/Microsoft.SourceLink.GitHub-10.0.201

Author: bcollamore

.github/workflows/changelog.yml

@@ -31,7 +31,7 @@ jobs:
           
       - name: "Commit"
         if: ${{ inputs.changelog }}
-        uses: EndBug/add-and-commit@a94899bca583c204427a224a7af87c02f9b325d5 # v9.1.4
+        uses: EndBug/add-and-commit@290ea2c423ad77ca9c62ae0f5b224379612c0321 # v10.0.0
         with:
           message: "chore: updating changelog"
           push: true

.github/workflows/codeql-analysis.yml

@@ -19,7 +19,7 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5
       - name: Initialize CodeQL
-        uses: github/codeql-action/init@b1bff81932f5cdfc8695c7752dcee935dcd061c8
+        uses: github/codeql-action/init@c10b8064de6f491fea524254123dbe5e09572f13
         with:
           languages: ${{ matrix.language }}
           # If you wish to specify custom queries, you can do so here or in a config file.
@@ -28,7 +28,7 @@ jobs:
         # Prefix the list here with "+" to use these queries and those in the config file.
         # Details on CodeQL's query packs refer to : https://docs.github.com/en/code-security/code-scanning/automatically-scanning-your-code-for-vulnerabilities-and-errors/configuring-code-scanning#using-queries-in-ql-packs
         # queries: security-extended,security-and-quality
-        uses: github/codeql-action/autobuild@b1bff81932f5cdfc8695c7752dcee935dcd061c8
+        uses: github/codeql-action/autobuild@c10b8064de6f491fea524254123dbe5e09572f13
 
       - name: Perform CodeQL Analysis
-        uses: github/codeql-action/analyze@b1bff81932f5cdfc8695c7752dcee935dcd061c8
+        uses: github/codeql-action/analyze@c10b8064de6f491fea524254123dbe5e09572f13

.github/workflows/pinned-actions.yml

@@ -10,6 +10,6 @@ jobs:
         uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v5
 
       - name: Ensure SHA pinned actions
-        uses: zgosalvez/github-actions-ensure-sha-pinned-actions@cc9ffdc62fadb9f83b46dd0979d9ad50408cc6a6 # ratchet:zgosalvez/github-actions-ensure-sha-pinned-actions@v5.0.2
+        uses: zgosalvez/github-actions-ensure-sha-pinned-actions@ca46236c6ce584ae24bc6283ba8dcf4b3ec8a066 # ratchet:zgosalvez/github-actions-ensure-sha-pinned-actions@v5.0.4
         with:
           allowlist: philips-software/roslyn-analyzers

Documentation/Diagnostics/PH2160.md

@@ -4,7 +4,7 @@
 |--|--|
 | Package | [Philips.CodeAnalysis.MoqAnalyzers](https://www.nuget.org/packages/Philips.CodeAnalysis.MoqAnalyzers) |
 | Diagnostic ID | PH2160 |
-| Category  | [RuntimeFailure](../RuntimeFailure.md) |
+| Category  | [Runtime Failure](../RuntimeFailure.md) |
 | Analyzer | [MockDisposableClassesShouldSetupDisposeAnalyzer](https://github.com/philips-software/roslyn-analyzers/blob/main/Philips.CodeAnalysis.MoqAnalyzers/MockDisposableClassesShouldSetupDisposeAnalyzer.cs) |
 | CodeFix  | No |
 | Severity | Error |
@@ -27,7 +27,7 @@ Configure the mock’s protected `Dispose` method explicitly, or use a project-s
 Example:
 
 ```csharp
-mock.Protected().Setup("Dispose", ItExpr.IsAny<bool>()).CallBase();
+mock.Protected().Setup("Dispose", ItExpr.IsAny<bool>()).();
 ```
 
 Any explicit protected setup of `Dispose` is considered acceptable for this rule.
@@ -87,15 +87,102 @@ public class TestClass
     public void TestMethod()
     {
         var mock = new Mock<Worker>();
-        mock.Protected().Setup("Dispose", ItExpr.IsAny<bool>()).CallBase();
+        mock.Protected().Setup("Dispose", ItExpr.IsAny<bool>()).();
     }
 }
 ```
+## Configuration
+
+This rule supports an optional `.editorconfig` setting to specify a preferred mock type for disposable concrete classes.
+
+```ini
+dotnet_code_quality.PH2160.preferred_disposable_mock_type = DisposableObjectMock
+```
+
+When this option is configured, the CodeFix replaces `Mock<T>` with the configured generic type.
+
+### Example
+
+```csharp
+private readonly Mock<MyDisposable> _mock = new Mock<MyDisposable>();
+```
+
+becomes:
+
+```csharp
+private readonly DisposableObjectMock<MyDisposable> _mock = new DisposableObjectMock<MyDisposable>();
+```
+
+This is especially useful for codebases that already use a custom Moq wrapper to ensure disposable concrete classes execute their real `Dispose(bool)` logic.
+
+The wrapper class could look like this:
+```csharp
+	public class DisposableObjectMock<T> : Mock<T>
+		where T : class, IDisposable
+	{
+		public DisposableObjectMock(params object[] args)
+			: this(MockBehavior.Default, args)
+		{ }
+
+		public DisposableObjectMock(MockBehavior behavior, params object[] args)
+			: base(behavior, args)
+		{
+			this.Protected().Setup(nameof(IDisposable.Dispose), ItExpr.IsAny<bool>()).CallBase();
+		}
+
+	}
+```
+
+## Considerations When Applying Fixes
+
+Enabling proper disposal behavior for `Mock<T>` instances can expose issues in existing unit tests or in the classes being mocked. The following are common scenarios observed when applying this rule.
+
+### Interaction with VerifyAll
+
+Some tests use `mock.VerifyAll()` to ensure that all configured expectations are met. When disposal behavior is enabled (e.g., via `Protected().Setup("Dispose", ...)` or a custom disposable mock wrapper), the `Dispose()` method becomes part of the mock's observable behavior.
+
+As a result, `Dispose()` may be expected to be called before `VerifyAll()` executes. If it is not, tests may fail with unmet expectations.
+
+**Possible resolutions:**
+- Explicitly call `Dispose()` on the mocked object before invoking `VerifyAll()`
+- Relax verification (e.g., avoid `VerifyAll()` when not strictly necessary)
+- Adjust mock setup to exclude `Dispose()` from strict verification scenarios
+
+---
+
+### Non-Idempotent or Fragile Dispose Implementations
+
+In some cases, enabling real disposal logic can cause tests to fail due to issues in the underlying class implementation. For example:
+
+- `Dispose()` may assume certain fields are initialized
+- Cleanup logic may not be safe to call in partially constructed states
+- Multiple calls to `Dispose()` may not be handled correctly
+
+This can lead to runtime exceptions such as `NullReferenceException`.
+
+**Possible resolutions:**
+- Ensure `Dispose()` implementations are **idempotent** (safe to call multiple times)
+- Add appropriate null checks or guards in disposal logic
+- Review object initialization to ensure required state is established before disposal
+
+---
+
+### Summary
+
+This analyzer helps ensure that mocked disposable objects behave more like their real counterparts. However, enabling disposal may reveal latent issues in tests or implementations that were previously hidden due to Moq's default behavior of not calling base methods.
+
+These issues are typically indicative of real correctness or robustness problems and should be addressed rather than suppressed.
 
 ## Limitations
 
 This analyzer currently focuses on direct `new Mock<T>(...)` constructions and same-member setup patterns. It may not detect disposal configuration performed indirectly through helper methods, factory abstractions, or other layers of indirection.
 
+The current CodeFix requires `dotnet_code_quality.PH2160.preferred_disposable_mock_type` to be configured.
+
+The current implementation uses the fully qualified configured type name directly instead of adding a `using` statement and simplifying the type name.
+
+This analyzer does not ensure that the mocked object is actually disposed. It merely ensures that, if disposed, that the protected virtual Dispose method is accounted for. Typically, this approach is appropriate, as mocked objects are often injected into another class, and that class' Dispose will Dispose our mocked object.
+
 ## Suppression
 
 ```csharp

Philips.CodeAnalysis.MoqAnalyzers/MockDisposableClassesShouldSetupDisposeAnalyzer.cs

@@ -1,5 +1,6 @@
 // © 2026 Koninklijke Philips N.V. See License.md in the project root for license information.
 
+using System.Collections.Immutable;
 using System.Linq;
 using Microsoft.CodeAnalysis;
 using Microsoft.CodeAnalysis.CSharp;
@@ -12,8 +13,8 @@ namespace Philips.CodeAnalysis.MoqAnalyzers
 	[DiagnosticAnalyzer(LanguageNames.CSharp)]
 	public class MockDisposableClassesShouldSetupDisposeAnalyzer : SingleDiagnosticAnalyzer
 	{
+		public const string PreferredDisposableMockTypeProperty = "PreferredDisposableMockType";
 		private const string MockName = "Mock";
-
 		private const string Title = @"Mock<T> of disposable concrete class should setup virtual Dispose(bool)";
 		private const string MessageFormat = @"Mock<{0}> may suppress real disposal because Moq does not call base implementations by default";
 		private const string Description = @"Mocking a disposable concrete class without configuring protected Dispose may prevent cleanup from executing";
@@ -80,7 +81,21 @@ private void AnalyzeObjectCreation(SyntaxNodeAnalysisContext context)
 				return;
 			}
 
-			context.ReportDiagnostic(Diagnostic.Create(Rule, objectCreationExpressionSyntax.GetLocation(), mockedType.Name));
+			ReportDiagnostic(context, objectCreationExpressionSyntax, mockedType);
+		}
+
+		private void ReportDiagnostic(SyntaxNodeAnalysisContext context, ObjectCreationExpressionSyntax objectCreationExpressionSyntax, ITypeSymbol mockedType)
+		{
+			// Pass the preferred disposable mock type from editorconfig as additional property, so that code fix can use it to determine which type to suggest in the code fix message and when applying the code fix.
+			var preferredDisposableMockType = Helper.ForAdditionalFiles.GetValueFromEditorConfig(Rule.Id, "preferred_disposable_mock_type");
+
+			ImmutableDictionary<string, string> properties = ImmutableDictionary<string, string>.Empty;
+			if (!string.IsNullOrWhiteSpace(preferredDisposableMockType))
+			{
+				properties = properties.Add(PreferredDisposableMockTypeProperty, preferredDisposableMockType.Trim());
+			}
+
+			context.ReportDiagnostic(Diagnostic.Create(Rule, objectCreationExpressionSyntax.GetLocation(), properties, mockedType.Name));
 		}
 
 		private bool TryGetMockedType(SyntaxNodeAnalysisContext context, ObjectCreationExpressionSyntax objectCreationExpressionSyntax, out ITypeSymbol mockedType)

Philips.CodeAnalysis.MoqAnalyzers/MockDisposableClassesShouldSetupDisposeCodeFixProvider.cs

@@ -0,0 +1,122 @@
+// © 2026 Koninklijke Philips N.V. See License.md in the project root for license information.
+
+using System.Collections.Immutable;
+using System.Composition;
+using System.Threading;
+using System.Threading.Tasks;
+using Microsoft.CodeAnalysis;
+using Microsoft.CodeAnalysis.CodeFixes;
+using Microsoft.CodeAnalysis.CSharp;
+using Microsoft.CodeAnalysis.CSharp.Syntax;
+using Microsoft.CodeAnalysis.Formatting;
+using Philips.CodeAnalysis.Common;
+
+namespace Philips.CodeAnalysis.MoqAnalyzers
+{
+	[ExportCodeFixProvider(LanguageNames.CSharp, Name = nameof(MockDisposableClassesShouldSetupDisposeCodeFixProvider)), Shared]
+	public class MockDisposableClassesShouldSetupDisposeCodeFixProvider : SingleDiagnosticCodeFixProvider<ObjectCreationExpressionSyntax>
+	{
+		protected override string Title => "Use configured disposable mock type";
+
+		protected override DiagnosticId DiagnosticId => DiagnosticId.MockDisposableObjectsShouldSetupDispose;
+
+		protected override async Task<Document> ApplyFix(Document document, ObjectCreationExpressionSyntax node, ImmutableDictionary<string, string> properties, CancellationToken cancellationToken)
+		{
+			var configuredTypeName = GetPreferredDisposableMockType(properties);
+			if (string.IsNullOrWhiteSpace(configuredTypeName))
+			{
+				return document;
+			}
+
+			SyntaxNode rootNode = await document.GetSyntaxRootAsync(cancellationToken).ConfigureAwait(false);
+			if (rootNode == null)
+			{
+				return document;
+			}
+
+			if (node.Type is not GenericNameSyntax objectCreationGenericName)
+			{
+				return document;
+			}
+
+			TypeSyntax replacementTypeSyntax = CreateReplacementTypeSyntax(configuredTypeName, objectCreationGenericName.TypeArgumentList);
+
+			TypeSyntax replacementType = replacementTypeSyntax.WithAdditionalAnnotations(Formatter.Annotation);
+
+			SyntaxNode newRoot;
+			TypeSyntax declaredTypeToReplace = GetDeclaredTypeToReplace(node, objectCreationGenericName);
+
+			if (declaredTypeToReplace != null)
+			{
+				newRoot = rootNode.ReplaceNodes(
+					new SyntaxNode[] { node.Type, declaredTypeToReplace },
+					(original, _) => replacementType.WithTriviaFrom(original));
+			}
+			else
+			{
+				newRoot = rootNode.ReplaceNode(
+					node.Type,
+					replacementType.WithTriviaFrom(node.Type));
+			}
+
+			return document.WithSyntaxRoot(newRoot);
+		}
+
+		private static TypeSyntax GetDeclaredTypeToReplace(ObjectCreationExpressionSyntax objectCreationSyntax, GenericNameSyntax originalObjectCreationType)
+		{
+			VariableDeclarationSyntax variableDeclarationSyntax = objectCreationSyntax.FirstAncestorOrSelf<VariableDeclarationSyntax>();
+			if (variableDeclarationSyntax != null &&
+				variableDeclarationSyntax.Type is GenericNameSyntax declaredGenericName &&
+				declaredGenericName.Identifier.ValueText == originalObjectCreationType.Identifier.ValueText)
+			{
+				return variableDeclarationSyntax.Type;
+			}
+
+			PropertyDeclarationSyntax propertyDeclarationSyntax = objectCreationSyntax.FirstAncestorOrSelf<PropertyDeclarationSyntax>();
+			if (propertyDeclarationSyntax != null &&
+				propertyDeclarationSyntax.Type is GenericNameSyntax propertyGenericName &&
+				propertyGenericName.Identifier.ValueText == originalObjectCreationType.Identifier.ValueText)
+			{
+				return propertyDeclarationSyntax.Type;
+			}
+
+			return null;
+		}
+
+		private static string GetPreferredDisposableMockType(ImmutableDictionary<string, string> properties)
+		{
+			if (properties != null &&
+				properties.TryGetValue(MockDisposableClassesShouldSetupDisposeAnalyzer.PreferredDisposableMockTypeProperty, out var configuredTypeName) &&
+				!string.IsNullOrWhiteSpace(configuredTypeName))
+			{
+				return configuredTypeName.Trim();
+			}
+
+			return null;
+		}
+
+		private static TypeSyntax CreateReplacementTypeSyntax(string configuredTypeName, TypeArgumentListSyntax originalTypeArguments)
+		{
+			NameSyntax configuredNameSyntax = SyntaxFactory.ParseName(configuredTypeName);
+
+			SimpleNameSyntax genericNameSyntax;
+			if (configuredNameSyntax is QualifiedNameSyntax qualifiedNameSyntax)
+			{
+				genericNameSyntax = qualifiedNameSyntax.Right;
+			}
+			else
+			{
+				genericNameSyntax = configuredNameSyntax as SimpleNameSyntax;
+			}
+
+			GenericNameSyntax appendedGenericName = SyntaxFactory.GenericName(genericNameSyntax.Identifier, originalTypeArguments);
+
+			if (configuredNameSyntax is QualifiedNameSyntax qualifiedConfiguredName)
+			{
+				return qualifiedConfiguredName.WithRight(appendedGenericName);
+			}
+
+			return appendedGenericName;
+		}
+	}
+}