code-analysis
This skill sets up the .NET SDK's built-in Roslyn analyzers and establishes a phased strategy for treating warnings as errors. It handles both new projects (immediate enforcement) and legacy codebases (batch-by-batch promotion), ensuring your CI fails on analyzer violations without overwhelming your team. Security rules are always prioritized.
code-analysis enables built-in .NET SDK analyzers and configures warning severity levels for CI enforcement.
AI-generated summary based on this skill's SKILL.md
Decision gist · record as of 2026-07-25
code-analysis enables built-in .NET SDK analyzers and configures warning severity levels for CI enforcement. This skill sets up the .NET SDK's built-in Roslyn analyzers and establishes a phased strategy for treating warnings as errors. It handles both new projects (immediate enforcement) and legacy codebases (batch-by-batch promotion), ensuring your CI fails on analyzer violations without overwhelming your team. Security rules are always prioritized.
Use it when
- code-analysis uses a batch-by-batch promotion strategy for legacy codebases.
- code-analysis makes warnings fail CI builds by setting `<TreatWarningsAsErrors>true</TreatWarningsAsErrors>` in your .csproj.
Verify before relying
Read SKILL.md below before installing (5 files). Open directory: indexed for reading, not audited.
Similar skills
Install
managedcode/dotnet-skills/code-analysis · repository language: C#
Open directory. Skills are indexed for reading, not audited. Review a skill's body before installing it.
Frequently asked questions
AI-generated answers based on this skill's SKILL.md and metadata
How do I enable .NET SDK analyzers?
code-analysis enables built-in Roslyn analyzers by setting `<EnableNETAnalyzers>true</EnableNETAnalyzers>` in your .csproj file. Use `<AnalysisLevel>latest-recommended</AnalysisLevel>` to adopt the newest analyzer ruleset. For new projects, apply these settings immediately; for legacy codebases, code-analysis recommends a phased rollout using `<AnalysisMode>AllEnabledByDefault</AnalysisMode>` to gradually surface violations before enforcing them.
What's the strategy for gradual analyzer rollout in legacy projects?
code-analysis uses a batch-by-batch promotion strategy for legacy codebases. Start with `<AnalysisLevel>preview</AnalysisLevel>` to identify violations without breaking builds. Fix warnings by category and severity, then promote rules to errors incrementally using `<TreatWarningsAsErrors>true</TreatWarningsAsErrors>` once your team has addressed them. Security rules (CA5xxx/CA3xxx) are always prioritized for early promotion.
How can I make analyzer warnings fail my CI build?
code-analysis makes warnings fail CI builds by setting `<TreatWarningsAsErrors>true</TreatWarningsAsErrors>` in your .csproj. This converts all analyzer violations into build errors, enforcing code quality standards. For selective enforcement, target specific rule categories—for example, security analyzers (CA5xxx) can be promoted to errors first while other rules remain warnings during your rollout phase.
How do I treat warnings as errors in dotnet?
code-analysis configures `<TreatWarningsAsErrors>true</TreatWarningsAsErrors>` in your project file to convert analyzer warnings into build-blocking errors. Combine this with `<EnableNETAnalyzers>true</EnableNETAnalyzers>` and `<AnalysisLevel>latest-recommended</AnalysisLevel>` for comprehensive enforcement. For legacy projects, code-analysis recommends applying this setting incrementally to avoid overwhelming your team.
What is AnalysisLevel configuration and how do I use it?
code-analysis uses `<AnalysisLevel>` to control which Roslyn analyzer rules are active. Set it to `latest-recommended` for the newest stable ruleset, `preview` for experimental rules, or a specific version like `8.0`. This setting works alongside `<AnalysisMode>` to determine which violations are reported. For legacy codebases, code-analysis suggests starting with a lower level and incrementally raising it as your team fixes violations.
How do I prioritize security analyzer rules like CA5xxx for promotion?
code-analysis prioritizes security analyzers (CA5xxx/CA3xxx) by promoting them to errors before other rule categories. Use `<NoWarn>` to suppress non-security warnings temporarily, then apply `<TreatWarningsAsErrors>true</TreatWarningsAsErrors>` to security rules first. This ensures your codebase addresses critical vulnerabilities early in your analyzer rollout, protecting your application before enforcing broader code quality standards.
SKILL.md
Rendered from the published skill. Quoted content, verbatim.
.NET Code Analysis
Trigger On
- the repo wants first-party .NET analyzers
- CI should fail on analyzer warnings
- the team needs
AnalysisLevelorAnalysisModeguidance - the repo needs a gradual Roslyn warning promotion strategy
Do Not Use For
- third-party analyzer selection by itself
- formatting-only work
Inputs
- the nearest
AGENTS.md - project files or
Directory.Build.props - current analyzer severity policy
Hard Rules for AI Agents
Non-negotiable. Violating these undermines the user's explicit intent.
- Never disable or remove
(truncated - see the full file via the links below)
File tree — 5 files
catalog/Tools/Code-Analysis/skills/code-analysis/SKILL.md
catalog/Tools/Code-Analysis/skills/code-analysis/manifest.json
catalog/Tools/Code-Analysis/skills/code-analysis/references/code-analysis.md
catalog/Tools/Code-Analysis/skills/code-analysis/references/config.md
catalog/Tools/Code-Analysis/skills/code-analysis/references/rules.md
Let your AI agent find skills like this
Example. Real query, live index.
You found this page by searching. An agent finds it by wishing: SkillFed indexes 56,283 agent skills by what they can do, searchable in plain language.
wish › “Enable and configure built-in .NET SDK analyzers with appropriate severity levels”
Give your agent the search over MCP, or paste the wish link into any chat. No install? Search from any chat →
Related skills
This skill establishes a single source of truth for .NET analyzer severity and code-style rules by creating or normalizing a repo-root .editorconfig file. It detects your current configuration state, structures rule ownership explicitly, and validates that settings are reproducible across local and CI builds.
This skill deploys the free JetBrains ReSharper Command Line Tools to inspect and refactor .NET repositories using `jb inspectcode` and `jb cleanupcode`. It manages durable team settings through solution-level configuration, enforces quality gates by surfacing and fixing issues rather than ignoring them, and integrates with your build and test pipeline.
stylecop-analyzers sets up the StyleCop.Analyzers package in .NET repositories, establishing clear ownership between root .editorconfig and stylecop.json configuration. It detects existing state, adds the package where needed, and prevents rule overlap with other analyzer packs. Use it when your team requires stronger style conventions than SDK analyzers alone provide.
Roslynator equips .NET projects with open-source static analysis and code-cleanup capabilities through NuGet analyzer packages and an optional command-line tool. Configure rule severity in `.editorconfig`, run analysis and fix workflows, or detect unused code—all while respecting your repo's existing analyzer setup.
This skill installs and configures Meziantou.Analyzer, a comprehensive rule set for .NET codebases covering design, usage, security, performance, and style concerns. It manages package setup, severity configuration in `.editorconfig`, and avoids duplication with SDK or Roslynator analyzers. Use it when your team wants broader diagnostic coverage without managing multiple analyzer packages.
complexity sets up .NET's built-in maintainability analyzers to enforce cyclomatic complexity and coupling limits across your codebase. It configures CA1502, CA1505, and CA1506 rules in .editorconfig and CodeMetricsConfig.txt, then validates thresholds through the build pipeline.
More skills format (MIT)