{"enrichment":{"faq":[{"a":"code-analysis enables built-in Roslyn analyzers by setting `<EnableNETAnalyzers>true</EnableNETAnalyzers>` in your .csproj file. Use `<AnalysisLevel>latest-recommended</AnalysisLevel>` to adopt the newest analyzer ruleset. For new projects, apply these settings immediately; for legacy codebases, code-analysis recommends a phased rollout using `<AnalysisMode>AllEnabledByDefault</AnalysisMode>` to gradually surface violations before enforcing them.","q":"How do I enable .NET SDK analyzers?"},{"a":"code-analysis uses a batch-by-batch promotion strategy for legacy codebases. Start with `<AnalysisLevel>preview</AnalysisLevel>` to identify violations without breaking builds. Fix warnings by category and severity, then promote rules to errors incrementally using `<TreatWarningsAsErrors>true</TreatWarningsAsErrors>` once your team has addressed them. Security rules (CA5xxx/CA3xxx) are always prioritized for early promotion.","q":"What's the strategy for gradual analyzer rollout in legacy projects?"},{"a":"code-analysis makes warnings fail CI builds by setting `<TreatWarningsAsErrors>true</TreatWarningsAsErrors>` in your .csproj. This converts all analyzer violations into build errors, enforcing code quality standards. For selective enforcement, target specific rule categories\u2014for example, security analyzers (CA5xxx) can be promoted to errors first while other rules remain warnings during your rollout phase.","q":"How can I make analyzer warnings fail my CI build?"},{"a":"code-analysis configures `<TreatWarningsAsErrors>true</TreatWarningsAsErrors>` in your project file to convert analyzer warnings into build-blocking errors. Combine this with `<EnableNETAnalyzers>true</EnableNETAnalyzers>` and `<AnalysisLevel>latest-recommended</AnalysisLevel>` for comprehensive enforcement. For legacy projects, code-analysis recommends applying this setting incrementally to avoid overwhelming your team.","q":"How do I treat warnings as errors in dotnet?"},{"a":"code-analysis uses `<AnalysisLevel>` to control which Roslyn analyzer rules are active. Set it to `latest-recommended` for the newest stable ruleset, `preview` for experimental rules, or a specific version like `8.0`. This setting works alongside `<AnalysisMode>` to determine which violations are reported. For legacy codebases, code-analysis suggests starting with a lower level and incrementally raising it as your team fixes violations.","q":"What is AnalysisLevel configuration and how do I use it?"},{"a":"code-analysis prioritizes security analyzers (CA5xxx/CA3xxx) by promoting them to errors before other rule categories. Use `<NoWarn>` to suppress non-security warnings temporarily, then apply `<TreatWarningsAsErrors>true</TreatWarningsAsErrors>` to security rules first. This ensures your codebase addresses critical vulnerabilities early in your analyzer rollout, protecting your application before enforcing broader code quality standards.","q":"How do I prioritize security analyzer rules like CA5xxx for promotion?"}],"shadow_tags":["static-analysis","build-gate","warning-escalation","legacy-modernization","code-quality-enforcement","roslyn-diagnostics","incremental-remediation","security-promotion","msbuild-configuration","ci-integration"],"summary_rewrite":"This skill sets up the .NET SDK's built-in Roslyn analyzers and establishes a phased strategy for treating warnings as errors. It handles both new projects (immediate enforcement) and legacy codebases (batch-by-batch promotion), ensuring your CI fails on analyzer violations without overwhelming your team. Security rules are always prioritized."},"files":[{"bytes":8055,"path":"catalog/Tools/Code-Analysis/skills/code-analysis/SKILL.md","sha256":"e3109d36fdd24f3d845b9db5d04bde1dced483b68dc9147b2da17afc1d32501d","url":"https://skillfed.io/files/managedcode/dotnet-skills/code-analysis/29ade49c/SKILL.md"}],"id":"managedcode/dotnet-skills/code-analysis","links":{"html":"https://skillfed.io/managedcode/dotnet-skills/code-analysis","md":"https://skillfed.io/managedcode/dotnet-skills/code-analysis.md","repo":"https://github.com/managedcode/dotnet-skills"},"meta":{"agents_supported":[],"first_seen":"2026-07-28","forks":35,"language":"C#","last_updated":"2026-07-25","license":"MIT","name":"code-analysis","publisher":"managedcode","stars":463},"relations":{"similar":[{"id":"wshaddix/dotnet-skills/dotnet-add-analyzers"},{"id":"wshaddix/dotnet-skills/dotnet-editorconfig"},{"id":"managedcode/dotnet-skills/analyzer-config"},{"id":"wshaddix/dotnet-skills/dotnet-scaffold-project"},{"id":"wshaddix/dotnet-skills/dotnet-build-analysis"},{"id":"Goldziher/ai-rulez/csharp-conventions"},{"id":"managedcode/dotnet-skills/quality-ci"},{"id":"wshaddix/dotnet-skills/dotnet-version-upgrade"},{"id":"wshaddix/dotnet-skills/dotnet-csproj-reading"},{"id":"wshaddix/dotnet-skills/dotnet-roslyn-analyzers"}]},"slug":{"owner":"managedcode","repo":"dotnet-skills","skill":"code-analysis"},"version":"29ade49c"}