Add SquiggleCop

.config/dotnet-tools.json

@@ -15,6 +15,13 @@
         "dotnet-verify"
       ],
       "rollForward": false
+    },
+    "squigglecop.tool": {
+      "version": "1.0.8",
+      "commands": [
+        "dotnet-squigglecop"
+      ],
+      "rollForward": false
     }
   }
 }

.github/workflows/main.yml

@@ -5,9 +5,15 @@ on:
   pull_request:
     branches:
       - main
+      - 'releases/**'
+      - 'release/**'
+      - 'feature/**'
   push:
     branches:
       - main
+      - 'releases/**'
+      - 'release/**'
+      - 'feature/**'      
   merge_group:
     branches:
       - main
@@ -86,6 +92,13 @@ jobs:
         path: |
           **/*.received.*
 
+    - name: Upload SARIF files
+      uses: actions/upload-artifact@v4
+      if: success() || failure()
+      with:
+        name: SARIF files (${{ matrix.os }})
+        path: ./artifacts/obj/**/*.sarif
+
     - name: Upload Test Report
       uses: actions/upload-artifact@v4
       if: success() || failure()

CONTRIBUTING.md

@@ -4,4 +4,14 @@ We welcome contributions. If you want to contribute to existing issues, check th
 [help wanted](https://github.com/rjmurillo/EffectiveCSharp.Analyzers/labels/help%20wanted) or
 [good first issue](https://github.com/rjmurillo/EffectiveCSharp.Analyzers/labels/good%20first%20issue) items in the backlog.
 
-If you have new ideas or want to complain about bugs, feel free to [create a new issue](https://github.com/rjmurillo/EffectiveCSharp.Analyzers/issues/new).
+If you have new ideas or want to complain about bugs, feel free to [create a new issue](https://github.com/rjmurillo/EffectiveCSharp.Analyzers/issues/new).
+
+## Updating SquiggleCop baselines
+
+To update SquiggleCop baselines, run this command and review and commit the results:
+
+```powershell
+dotnet clean && dotnet build /p:PedanticMode=true /p:SquiggleCop_AutoBaseline=true
+```
+
+`$(PedanticMode)` turns on the CI configuration (e.g. `TreatWarningsAsErrors`) and `$(SquiggleCop_AutoBaseline)`

build/scripts/Set-SquiggleCopBaseline.ps1

@@ -0,0 +1,3 @@
+Get-ChildItem *.csproj -recurse -File | ForEach-Object{ 
+    dotnet clean $_.FullName && dotnet build $_.FullName /p:PedanticMode=true /p:SquiggleCop_AutoBaseline=true 
+}

build/targets/codeanalysis/CodeAnalysis.props

@@ -32,6 +32,10 @@
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
+    <PackageReference Include="SquiggleCop.Tasks">
+      <PrivateAssets>all</PrivateAssets>
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+    </PackageReference>
     <PackageReference Include="Microsoft.VisualStudio.Threading.Analyzers">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>

build/targets/codeanalysis/CodeAnalysis.targets

@@ -1,2 +1,24 @@
 <Project>
+  <PropertyGroup Label="Computed properties">
+    <PedanticMode Condition=" '$(PedanticMode)' == '' ">$([MSBuild]::ValueOrDefault('$(ContinuousIntegrationBuild)', 'false'))</PedanticMode>
+    <TreatWarningsAsErrors>$(PedanticMode)</TreatWarningsAsErrors>
+    <MSBuildTreatWarningsAsErrors>$(PedanticMode)</MSBuildTreatWarningsAsErrors>
+    <SquiggleCop_Enabled>$(PedanticMode)</SquiggleCop_Enabled>
+  </PropertyGroup>
+
+  <Target Name="SetErrorLog" BeforeTargets="CoreCompile">
+    <!--
+      ErrorLog is needed for SquiggleCop.
+
+      The value is set in a Target and not directly as a property because `$(IntermediateOutputPath)` and `$(OutputPath)`
+      are calculated properties and thus shouldn't be relied on during the initial property evaluation phase.
+      See https://github.com/dotnet/sdk/issues/41852.
+
+      We use `$(IntermediateOutputPath)` to ensure the file ends up in the `obj/` folder and not with sources to clearly
+      delineate inputs and outputs.
+    -->
+    <PropertyGroup Condition=" '$(ErrorLog)' == '' ">
+      <ErrorLog>$(IntermediateOutputPath)/$(MSBuildProjectName).sarif,version=2.1</ErrorLog>
+    </PropertyGroup>
+  </Target>
 </Project>

build/targets/codeanalysis/Packages.props

@@ -4,7 +4,8 @@
     <PackageVersion Include="Microsoft.CodeAnalysis.Analyzers" Version="3.3.4" />
     <PackageVersion Include="Roslynator.Analyzers" Version="4.12.4" />
     <PackageVersion Include="StyleCop.Analyzers" Version="1.2.0-beta.556" />
-    <PackageVersion Include="SonarAnalyzer.CSharp" Version="9.30.0.95878" />    
+    <PackageVersion Include="SonarAnalyzer.CSharp" Version="9.30.0.95878" />
+    <PackageVersion Include="SquiggleCop.Tasks" Version="1.0.8" />
     <PackageVersion Include="Microsoft.VisualStudio.Threading.Analyzers" Version="17.10.48" />
     <PackageVersion Include="ExhaustiveMatching.Analyzer" Version="0.5.0" />
   </ItemGroup>

build/targets/tests/Packages.props

@@ -4,7 +4,7 @@
     <PackageVersion Include="Microsoft.CodeAnalysis.CSharp.CodeFix.Testing" Version="1.1.2-beta1.24314.1" />
     <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.10.0" />
     <PackageVersion Include="Verify.Nupkg" Version="1.1.6" />
-    <PackageVersion Include="Verify.Xunit" Version="26.1.5" />
+    <PackageVersion Include="Verify.Xunit" Version="26.1.6" />
     <PackageVersion Include="xunit" Version="2.9.0" />
     <PackageVersion Include="xunit.runner.visualstudio" Version="2.8.2" />
     <PackageVersion Include="Meziantou.Xunit.ParallelTestFramework" Version="2.3.0" />

global.json

@@ -1,7 +1,7 @@
 {
   "sdk": {
-    "version": "8.0.101",
-    "rollForward": "latestFeature"
+    "version": "8.0.303",
+    "rollForward": "disable" /* setup-dotnet is broken and we don't want to have differences in CI vs local, so make this disabled */
   },
   "msbuild-sdks": {
     "DotNet.ReproducibleBuilds.Isolated": "1.2.4"

src/EffectiveCSharp.Analyzers/AvoidStringlyTypedApisCodeFixProvider.cs

@@ -47,6 +47,7 @@ public sealed override async Task RegisterCodeFixesAsync(CodeFixContext context)
         }
     }
 
+#pragma warning disable MA0051 // Method is too long
     private static async Task<Solution> UseNameofOperatorAsync(Document document, LiteralExpressionSyntax? literalExpression, CancellationToken cancellationToken)
     {
         string? literalValue = literalExpression?.Token.ValueText;
@@ -92,7 +93,9 @@ private static async Task<Solution> UseNameofOperatorAsync(Document document, Li
             return document.Project.Solution;
         }
 
+#pragma warning disable S2589 // Boolean expressions should not be gratuitous
         if (literalExpression != null)
+#pragma warning restore S2589 // Boolean expressions should not be gratuitous
         {
             ExpressionSyntax nameofExpression = SyntaxFactory.ParseExpression(nameofExpressionText)
                 .WithTriviaFrom(literalExpression);
@@ -108,4 +111,5 @@ private static async Task<Solution> UseNameofOperatorAsync(Document document, Li
 
         return document.Project.Solution;
     }
+#pragma warning restore MA0051 // Method is too long
 }

src/EffectiveCSharp.Analyzers/SpanAnalyzer.cs

@@ -49,8 +49,10 @@ private static void AnalyzeArrayCreation(SyntaxNodeAnalysisContext context)
 
     private static bool IsInsideSpanInitialization(ArrayCreationExpressionSyntax arrayCreation)
     {
+#pragma warning disable S125 // Remove this commented out code
         // Check if the parent is a Span<T> or ReadOnlySpan<T> creation
         // example: new Span<int>(new int[10]);
+#pragma warning restore S125 // Remove this commented out code
         if (arrayCreation.Parent?.Parent?.Parent is not ObjectCreationExpressionSyntax objectCreation)
         {
             return false;