HttpClient.Resilience.Analyzers.Scan 0.1.214

HCR Scan

Scan any .NET solution for HttpClient, IHttpClientFactory, typed-client, Polly, and Microsoft.Extensions.Http.Resilience problems without adding a package to it.

dnx HttpClient.Resilience.Analyzers.Scan                 # .NET 10 SDK, no install step
dnx HttpClient.Resilience.Analyzers.Scan -- MyApp.slnx -o results.sarif

dotnet tool install -g HttpClient.Resilience.Analyzers.Scan   # .NET 8 or 9 SDK
hcr-scan MyApp.slnx

The scanner builds the solution with the HttpClient.Resilience.Analyzers analyzers injected, then prints the rules that fired, how often, where, the line of code, and a link to each rule's page. It also writes a SARIF 2.1.0 file for GitHub code scanning. Your project files are not changed unless you pass --fix.

Use it to try the analyzers on a real codebase before adding the package, compare releases, and review suspected false positives with the surrounding source in the HTML report.

Options

Put the scanner's arguments after -- when using dnx.

False-positive triage

The HTML report is the fastest review surface:

hcr-scan ./MyApp.slnx --findings all --html hcr-review.html

It groups findings by rule, shows the message and a few lines of source around every hit, and provides search and severity filters. For a focused review, limit the scan to one rule:

hcr-scan ./MyApp.slnx --rules HCR060 --html hcr060.html

The text and Markdown reports show the source line, so a suspected false positive can be checked against the exact code path without opening the solution. Suppressed diagnostics are omitted, just as they are in a normal build.

Full guide: https://georgepwall1991.github.io/HttpClient.Resilience.Analyzers/scanning/