code-analysis
This skill sets up the .NET SDK's built-in Roslyn analyzers and establishes a phased strategy for treating warnings as errors. It handles both new projects (immediate enforcement) and legacy codebases (batch-by-batch promotion), ensuring your CI fails on analyzer violations without overwhelming your team. Security rules are always prioritized.
code-analysis enables built-in .NET SDK analyzers and configures warning severity levels for CI enforcement.
AI-generated summary based on this skill's SKILL.md
Install
managedcode/dotnet-skills/code-analysis · repository language: C#
git clone https://github.com/managedcode/dotnet-skills
cp -r dotnet-skills/catalog/Tools/Code-Analysis/skills/code-analysis ~/.claude/skills/code-analysisnpx skillfed install managedcode/dotnet-skills/code-analysisFrequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How do I enable .NET SDK analyzers?
code-analysis enables built-in Roslyn analyzers by setting `<EnableNETAnalyzers>true</EnableNETAnalyzers>` in your .csproj file. Use `<AnalysisLevel>latest-recommended</AnalysisLevel>` to adopt the newest analyzer ruleset. For new projects, apply these settings immediately; for legacy codebases, code-analysis recommends a phased rollout using `<AnalysisMode>AllEnabledByDefault</AnalysisMode>` to gradually surface violations before enforcing them.
What's the strategy for gradual analyzer rollout in legacy projects?
code-analysis uses a batch-by-batch promotion strategy for legacy codebases. Start with `<AnalysisLevel>preview</AnalysisLevel>` to identify violations without breaking builds. Fix warnings by category and severity, then promote rules to errors incrementally using `<TreatWarningsAsErrors>true</TreatWarningsAsErrors>` once your team has addressed them. Security rules (CA5xxx/CA3xxx) are always prioritized for early promotion.
How can I make analyzer warnings fail my CI build?
code-analysis makes warnings fail CI builds by setting `<TreatWarningsAsErrors>true</TreatWarningsAsErrors>` in your .csproj. This converts all analyzer violations into build errors, enforcing code quality standards. For selective enforcement, target specific rule categories—for example, security analyzers (CA5xxx) can be promoted to errors first while other rules remain warnings during your rollout phase.
How do I treat warnings as errors in dotnet?
code-analysis configures `<TreatWarningsAsErrors>true</TreatWarningsAsErrors>` in your project file to convert analyzer warnings into build-blocking errors. Combine this with `<EnableNETAnalyzers>true</EnableNETAnalyzers>` and `<AnalysisLevel>latest-recommended</AnalysisLevel>` for comprehensive enforcement. For legacy projects, code-analysis recommends applying this setting incrementally to avoid overwhelming your team.
What is AnalysisLevel configuration and how do I use it?
code-analysis uses `<AnalysisLevel>` to control which Roslyn analyzer rules are active. Set it to `latest-recommended` for the newest stable ruleset, `preview` for experimental rules, or a specific version like `8.0`. This setting works alongside `<AnalysisMode>` to determine which violations are reported. For legacy codebases, code-analysis suggests starting with a lower level and incrementally raising it as your team fixes violations.
How do I prioritize security analyzer rules like CA5xxx for promotion?
code-analysis prioritizes security analyzers (CA5xxx/CA3xxx) by promoting them to errors before other rule categories. Use `<NoWarn>` to suppress non-security warnings temporarily, then apply `<TreatWarningsAsErrors>true</TreatWarningsAsErrors>` to security rules first. This ensures your codebase addresses critical vulnerabilities early in your analyzer rollout, protecting your application before enforcing broader code quality standards.
SKILL.md
rendered from the published skill — quoted content, verbatim
.NET Code Analysis
Trigger On
- the repo wants first-party .NET analyzers
- CI should fail on analyzer warnings
- the team needs
AnalysisLevelorAnalysisModeguidance - the repo needs a gradual Roslyn warning promotion strategy
Do Not Use For
- third-party analyzer selection by itself
- formatting-only work
Inputs
- the nearest
AGENTS.md - project files or
Directory.Build.props - current analyzer severity policy
Hard Rules for AI Agents
Non-negotiable. Violating these undermines the user's explicit intent.
- Never disable or remove
(truncated - see the full file via the links below)
Read as markdown · JSON record · Browse the source repository
File tree — 5 files
catalog/Tools/Code-Analysis/skills/code-analysis/SKILL.md
catalog/Tools/Code-Analysis/skills/code-analysis/manifest.json
catalog/Tools/Code-Analysis/skills/code-analysis/references/code-analysis.md
catalog/Tools/Code-Analysis/skills/code-analysis/references/config.md
catalog/Tools/Code-Analysis/skills/code-analysis/references/rules.md