Digitals.Analyzers 1.1.0 

dotnet add package Digitals.Analyzers --version 1.1.0
                    


                    

                
NuGet\Install-Package Digitals.Analyzers -Version 1.1.0
This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package. 
<PackageReference Include="Digitals.Analyzers" Version="1.1.0">
  <PrivateAssets>all</PrivateAssets>
  <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
</PackageReference>
For projects that support PackageReference, copy this XML node into the project file to reference the package. 
<PackageVersion Include="Digitals.Analyzers" Version="1.1.0" />
                    


                            Directory.Packages.props
                        

                    

                
<PackageReference Include="Digitals.Analyzers">
  <PrivateAssets>all</PrivateAssets>
  <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
</PackageReference>
                    


                            Project file
For projects that support Central Package Management (CPM), copy this XML node into the solution Directory.Packages.props file to version the package. 
paket add Digitals.Analyzers --version 1.1.0
                    


                    

                
#r "nuget: Digitals.Analyzers, 1.1.0"
#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package. 
#:package Digitals.Analyzers@1.1.0
#:package directive can be used in C# file-based apps starting in .NET 10 preview 4. Copy this into a .cs file before any lines of code to reference the package. 
#addin nuget:?package=Digitals.Analyzers&version=1.1.0
                    


                            Install as a Cake Addin
                        

                    

                
#tool nuget:?package=Digitals.Analyzers&version=1.1.0
                    


                            Install as a Cake Tool

Digitals.Analyzers

Digitals.Analyzers brings the Digitals C# analyzers and severity policy to every project in a repo: SonarAnalyzer.CSharp, Roslynator, the VS Threading analyzers and BannedApiAnalyzers, configured as one policy, plus our own DT0#### rules and four build checks. It covers production code; test projects add Digitals.Testing on top.

Reference it once, in Directory.Build.props, and remove any direct reference to the analyzers it bundles:

<PropertyGroup>
  <Nullable>enable</Nullable>
  <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
  <WarningsAsErrors>nullable</WarningsAsErrors>
  <EnforceCodeStyleInBuild>true</EnforceCodeStyleInBuild>
  <GenerateDocumentationFile>true</GenerateDocumentationFile>
</PropertyGroup>
<ItemGroup>
  <PackageReference Include="Digitals.Analyzers" PrivateAssets="all" />
</ItemGroup>

Without EnforceCodeStyleInBuild the IDE rules stay in the editor, and without GenerateDocumentationFile the build never reports an unused using. On a target older than net10.0, also set <NuGetAuditMode>all</NuGetAuditMode>. The reference has no Version because it assumes central package management, with the version in Directory.Packages.props; without it, add Version with the latest from this page.

What Does
Severity policy A global AnalyzerConfig at global_level 100. Every rule it turns on is a warning or a suggestion, never an error, so TreatWarningsAsErrors decides how hard it bites.
Banned APIs (RS0030) The ambient clock (DateTime.Now, DateTimeOffset.UtcNow, ...): inject TimeProvider. The int millisecond overloads of Task.Delay, Thread.Sleep, new CancellationTokenSource and CancelAfter: pass a TimeSpan. In production code only, EF Core's FromSqlRaw family (use FromSql($"...")), Html.Raw, HtmlString and MarkupString (let Razor encode), and process arguments as one string (use ArgumentList).
Taint analysis The SDK's CA3001-CA3012, shipped off, raised to warning: a request value that reaches SQL, a file path, a process start or another injection sink unchecked, followed across methods and classes.
DT0#### rules Time types, new HttpClient(), dynamic, money held as double, nullable collections, #region, negative boolean names, a local reused for an unrelated value, file names, and six rules that keep each method at one level of abstraction.
DIGB001 Fails the build on a direct reference to Newtonsoft.Json, AutoMapper, EF6, System.Data.SqlClient or EF Core lazy-loading proxies.
DIGB002, DIGB003 Fail the build when Nullable isn't enable or TreatWarningsAsErrors isn't true, since without them the policy is advisory.
DIGB004 Warns, and under TreatWarningsAsErrors fails, when the NuGet vulnerability audit is weakened.
SonarLint.xml Sonar's thresholds, such as cyclomatic complexity 15 rather than 10. Add your own SonarLint.xml as AdditionalFiles and the packaged one steps aside.
SARIF dotnet build -p:DigitalsSarifDir=artifacts/sarif writes every finding, suggestion level included, as SARIF per project.

A repo-local .editorconfig beats the packaged policy, so dotnet_diagnostic.<ID>.severity = none there turns a rule off. Each build check has its own opt-out (DigitalsAllowBannedPackages, DigitalsAllowNullableDisabled, DigitalsAllowWarningsNotAsErrors, DigitalsAllowWeakNuGetAudit), set beside a comment saying why.

The Analyzers rules page explains every rule: why it exists, a failing and a passing example, and the message the build prints. Moving an existing repo onto the package, including how to stage the first wave of findings: the adoption guide.

The analyzers run in the compiler, so the package works for any target framework from a .NET 10 SDK up. It is C# only in practice: Sonar and Roslynator don't analyze VB or F#. The bundled analyzers keep their own licences and reach you as ordinary NuGet dependencies. Release notes are on GitHub Releases.

There are no supported framework assets in this package.

Learn more about Target Frameworks and .NET Standard.

NuGet packages

This package is not used by any NuGet packages.

GitHub repositories

This package is not used by any popular GitHub repositories.

https://github.com/Digitals-OYT-Ltd/csharp-conventions/releases