Roslyn Analyzers Issues Import in NDepend

See Reporting Roslyn Analyzers' Issues that explains the benefit of importing Roslyn Analyzers's Issues with NDepend. This documentation focuses on how to import Roslyn Analyzers's Issues.

Importing Roslyn Analyzers' Issues in NDepend (3 minutes video)

Exporting Roslyn Analyzer issues so that NDepend can collect them

When an NDepend project references one or several .NET solution file(s) the tool expects to collect Roslyn Analyzers' issues in .json files in the directory $(SolutionDir)\.sarif.

The json format expected to describe issues to import is SARIF (Static Analysis Results Interchange Format). SARIF is not just about Roslyn Analyzers. Any .NET tool exporting code issues in a SARIF file format can be used, like for example, some custom tools in your company.

To obtain SARIF .json files in a directory $(SolutionDir)\.sarif just create the file $(SolutionDir)\Directory.Build.Props that contains:

<Project>
  <PropertyGroup Condition="'$(SolutionDir)' != ''">
    <ErrorLog>$(SolutionDir)\.sarif\$(MSBuildProjectName).json</ErrorLog>
  </PropertyGroup>
</Project>

When this Directory.Build.Props file exists, when compiling a solution, a file named ProjectFileName.json is created for each project in the directory $(SolutionDir)\.sarif. This file contains Roslyn Analyzers issues described through the SARIF format.

The directory $(SolutionDir)\.sarif won't be created automatically. You need to create this directory before compiling, manually or automatically with a mkdir command.

Warnings emitted by the C# compiler are actually emitted by Roslyn Analyzers with names like CS1234. As long as <ErrorLog>$(SolutionDir)\.sarif\$(MSBuildProjectName).json</ErrorLog> is defined, the C# compiler warnings will be exported in the SARIF .json files and then imported by NDepend.

The NDepend Project Properties tab: Import Roslyn and R# Analyzers Issues

Here is a screenshot of this tab below:

• A) An option let's cancel the default behavior to search for SARIF .json file in the directory $(SolutionDir)\.sarif.
• B) A button let's create both the directory $(SolutionDir)\.sarif and the file $(SolutionDir)\Directory.Build.Props (when they don't exist) for each solution referenced by the NDepend project.
• C) Documentation about how to import issues generated ReSharper Code Inspections and also stored in SARIF files.
• D) It is possible to specify any other directory in which to search for SARIF .json files.

Accessing the Roslyn Analyzers issues in NDepend

Roslyn Analyzers issues are first-class citizens in NDepend. They are shown side by side with issues generated by CQLinq rules and ReSharper Code Inspections everywhere in the product.

• In the report rule list: (see it live here)
• In the report issues in source code: (see it live here)
• They are counted in the report projects and source files issues sum: (see it live here)
• There are listed in the UI Queries and Rules Explorer:
• They can be matched by any CQLinq C# LINQ query, that queries issues. In the screenshot below we can see that when a Roslyn Analyzer is selected in the Queries and Rules Explorer panel, a C# LINQ query is generated to query the issues of the Roslyn Analyzers:

Popular Roslyn Analyzers Suites

The file $(SolutionDir)\Directory.Build.Props can also be used to define one or several Roslyn Analyzers suite(s) applied to the projects of the solution. For example you might want to use...

• Microsoft.CodeAnalysis.NetAnalyzers
• Meziantou.Analyzers
• Roslynator
• StyleCop.Analyzers

... this way (make sure to update the version(s)):

<Project>
  <PropertyGroup Condition="'$(SolutionDir)' != ''">
    <ErrorLog>$(SolutionDir)\.sarif\$(MSBuildProjectName).json</ErrorLog>
  </PropertyGroup>

  <PackageReference Include="Microsoft.CodeAnalysis.NetAnalyzers" Version="8.0.0">
    <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
    <PrivateAssets>all</PrivateAssets>
  </PackageReference>

  <PackageReference Include="Roslynator.Analyzers" Version="4.11.0">
    <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
    <PrivateAssets>all</PrivateAssets>
  </PackageReference>

  <PackageReference Include="Meziantou.Analyzer" Version="2.0.146">
    <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
    <PrivateAssets>all</PrivateAssets>
  </PackageReference>

</Project>
        

Disabling some Roslyn Analyzer

Some Roslyn Analyzers can be duplicate of some NDepend default rules or some R# Code Inspections:

To avoid having duplicated rules you can turn-off some Roslyn Analyzers in a file named $(SolutionDir)\.editorconfig This way:

[*.cs]
dotnet_diagnostic.MA0053.severity = none  
dotnet_diagnostic.RCS1225.severity = none