Merge branch 'main' into add-super-linter

.config/dotnet-tools.json

@@ -3,7 +3,7 @@
   "isRoot": true,
   "tools": {
     "nbgv": {
-      "version": "3.6.139",
+      "version": "3.6.143",
       "commands": [
         "nbgv"
       ],
@@ -15,6 +15,13 @@
         "dotnet-verify"
       ],
       "rollForward": false
+    },
+    "squigglecop.tool": {
+      "version": "1.0.26",
+      "commands": [
+        "dotnet-squigglecop"
+      ],
+      "rollForward": false
     }
   }
 }

.github/dependabot.yml

@@ -5,7 +5,11 @@ updates:
     schedule:
       interval: "daily"
       time: "08:00"
+      timezone: "America/Los_Angeles"
     open-pull-requests-limit: 10
+    reviewers:
+      - "rjmurillo"
+      - "mattkotsenas"
   - package-ecosystem: nuget
     directory: "/"
     schedule:

.github/workflows/dependabot-approve-and-auto-merge.yml

@@ -0,0 +1,33 @@
+name: Dependabot Pull Request Approve and Merge
+on: pull_request_target
+permissions:
+  pull-requests: write
+  contents: write
+jobs:
+  dependabot:
+    runs-on: ubuntu-latest
+    # Checking the actor will prevent your Action run failing on non-Dependabot
+    # PRs but also ensures that it only does work for Dependabot PRs.
+    if: ${{ github.actor == 'dependabot[bot]' || github.actor == 'dependabot-preview[bot]' }}
+    steps:
+      # This first step will fail if there's no metadata and so the approval
+      # will not occur.
+      - name: Dependabot metadata
+        id: dependabot-metadata
+        uses: dependabot/fetch-metadata@v2.2.0
+        with:
+          github-token: "${{ secrets.GH_ACTIONS_PR_WRITE }}"
+      # Here the PR gets approved.
+      - name: Approve a PR
+        run: gh pr review --approve "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GITHUB_TOKEN: ${{ secrets.GH_ACTIONS_PR_WRITE }}
+      # Finally, this sets the PR to allow auto-merging for patch and minor
+      # updates if all checks pass
+      - name: Enable auto-merge for Dependabot PRs
+        if: ${{ steps.dependabot-metadata.outputs.update-type != 'version-update:semver-major' }}
+        run: gh pr merge --auto --squash "$PR_URL"
+        env:
+          PR_URL: ${{ github.event.pull_request.html_url }}
+          GITHUB_TOKEN: ${{ secrets.GH_ACTIONS_PR_WRITE }}

.github/workflows/dependabot-auto-approve.yml

@@ -0,0 +1,15 @@
+# This workflow will approve pull requests from dependabot
+
+name: Auto approve PRs by dependabot
+on: [pull_request_target]
+
+jobs:
+  autoapprove:
+    name: Auto-Approve a PR by dependabot
+    runs-on: ubuntu-latest
+    steps:
+      - name: Auto approve
+        uses: cognitedata/auto-approve-dependabot-action@v3.0.1
+        if: github.actor == 'dependabot[bot]' || github.actor == 'dependabot-preview[bot]'
+        with:
+          github-token: ${{ secrets.GH_ACTIONS_PR_WRITE }}

.github/workflows/main.yml

@@ -25,6 +25,7 @@ permissions:
 jobs:
   build:
     strategy:
+      fail-fast: false # Run all OSes, even if one fails, to help narrow down issues that only impact some platforms
       matrix:
         os: [windows-2022, ubuntu-22.04]
 
@@ -73,6 +74,13 @@ jobs:
         path: |
           **/*.received.*
 
+    - name: Upload SARIF files
+      uses: actions/upload-artifact@v4
+      if: success() || failure()
+      with:
+        name: SARIF files (${{ matrix.os }})
+        path: ./artifacts/obj/**/*.sarif
+
     - name: Upload Test Report
       uses: actions/upload-artifact@v4
       if: success() || failure()

.github/workflows/release.yml

@@ -5,6 +5,9 @@ on:
   release:
     types:
       - published # Run the workflow when a new GitHub release is published
+      - edited
+      - prereleased
+      - released
 
 permissions:
   security-events: write  # required for CodeQL

CONTRIBUTING.md

@@ -5,3 +5,14 @@ We welcome contributions. If you want to contribute to existing issues, check th
 [good first issue](https://github.com/rjmurillo/moq.analyzers/labels/good%20first%20issue) items in the backlog.
 
 If you have new ideas or want to complain about bugs, feel free to [create a new issue](https://github.com/rjmurillo/moq.analyzers/issues/new).
+
+## Updating SquiggleCop baselines
+
+To update SquiggleCop baselines, run this command and review and commit the results:
+
+```powershell
+dotnet clean && dotnet build /p:PedanticMode=true /p:SquiggleCop_AutoBaseline=true
+```
+
+`$(PedanticMode)` turns on the CI configuration (e.g. `TreatWarningsAsErrors`) and `$(SquiggleCop_AutoBaseline)`
+automatically accepts the new baseline.

Directory.Packages.props

@@ -22,12 +22,12 @@
   <ItemGroup>
     <PackageVersion Include="BenchmarkDotNet" Version="0.13.12" />
     <PackageVersion Include="GetPackFromProject" Version="1.0.6" />
-    <PackageVersion Include="Nerdbank.GitVersioning" Version="3.6.139" />
+    <PackageVersion Include="Nerdbank.GitVersioning" Version="3.6.143" />
     <PackageVersion Include="System.CommandLine" Version="2.0.0-beta1.21216.1" />
     <PackageVersion Include="System.CommandLine.Rendering" Version="2.0.0-beta1.20074.1" />
     <PackageVersion Include="Newtonsoft.Json" Version="13.0.3" />
     <PackageVersion Include="Perfolizer" Version="0.2.1" />
     <PackageVersion Include="Microsoft.Extensions.Logging" Version="8.0.0" />
-    <PackageVersion Include="Microsoft.Diagnostics.Tracing.TraceEvent" Version="3.1.12" />
+    <PackageVersion Include="Microsoft.Diagnostics.Tracing.TraceEvent" Version="3.1.15" />
   </ItemGroup>
 </Project>

build/scripts/Set-SquiggleCopBaseline.ps1

@@ -0,0 +1,3 @@
+Get-ChildItem *.csproj -recurse -File | ForEach-Object{ 
+    dotnet clean $_.FullName && dotnet build $_.FullName /p:PedanticMode=true /p:SquiggleCop_AutoBaseline=true 
+}

build/targets/codeanalysis/.globalconfig

@@ -7,3 +7,24 @@ is_global=true
 # AV2210 : Pass -warnaserror to the compiler or add <TreatWarningsAsErrors>True</TreatWarningsAsErrors> to your project file
 # This is set as part of the CI build. It is intentionally not set locally to allow for a fast inner dev loop.
 dotnet_diagnostic.AV2210.severity = none
+
+# Enable Effective C# Analyzers
+dotnet_diagnostic.ECS0100.severity = warning
+dotnet_diagnostic.ECS0200.severity = warning
+dotnet_diagnostic.ECS0300.severity = warning
+dotnet_diagnostic.ECS0400.severity = warning
+dotnet_diagnostic.ECS0500.severity = warning
+dotnet_diagnostic.ECS0600.severity = warning
+dotnet_diagnostic.ECS0700.severity = warning
+dotnet_diagnostic.ECS0800.severity = warning
+dotnet_diagnostic.ECS0900.severity = warning
+dotnet_diagnostic.ECS1000.severity = warning
+dotnet_diagnostic.ECS1100.severity = warning
+dotnet_diagnostic.ECS1200.severity = warning
+dotnet_diagnostic.ECS1300.severity = warning
+dotnet_diagnostic.ECS1400.severity = warning
+dotnet_diagnostic.ECS1500.severity = warning
+dotnet_diagnostic.ECS1600.severity = warning
+dotnet_diagnostic.ECS1700.severity = warning
+dotnet_diagnostic.ECS1800.severity = warning
+dotnet_diagnostic.ECS1900.severity = warning

build/targets/codeanalysis/CodeAnalysis.props

@@ -5,8 +5,6 @@
     <AnalysisMode>preview</AnalysisMode>
     <WarningLevel>9999</WarningLevel>
     <GenerateDocumentationFile>true</GenerateDocumentationFile>
-    <TreatWarningsAsErrors Condition=" '$(ContinuousIntegrationBuild)' == 'true' ">true</TreatWarningsAsErrors>
-    <MSBuildTreatWarningsAsErrors Condition=" '$(ContinuousIntegrationBuild)' == 'true' ">true</MSBuildTreatWarningsAsErrors>
   </PropertyGroup>
 
   <ItemGroup>
@@ -32,10 +30,18 @@
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
+    <PackageReference Include="SquiggleCop.Tasks">
+      <PrivateAssets>all</PrivateAssets>
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+    </PackageReference>
     <PackageReference Include="Microsoft.VisualStudio.Threading.Analyzers">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
     <PackageReference Include="ExhaustiveMatching.Analyzer" />
+    <PackageReference Include="EffectiveCSharp.Analyzers">
+      <PrivateAssets>all</PrivateAssets>
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+    </PackageReference>
   </ItemGroup>
 </Project>

build/targets/codeanalysis/CodeAnalysis.targets

@@ -1,2 +1,8 @@
 <Project>
+  <PropertyGroup Label="Computed properties">
+    <PedanticMode Condition=" '$(PedanticMode)' == '' ">$([MSBuild]::ValueOrDefault('$(ContinuousIntegrationBuild)', 'false'))</PedanticMode>
+    <TreatWarningsAsErrors>$(PedanticMode)</TreatWarningsAsErrors>
+    <MSBuildTreatWarningsAsErrors>$(PedanticMode)</MSBuildTreatWarningsAsErrors>
+    <SquiggleCop_Enabled>$(PedanticMode)</SquiggleCop_Enabled>
+  </PropertyGroup>
 </Project>

build/targets/codeanalysis/Packages.props

@@ -1,11 +1,13 @@
 <Project>
   <ItemGroup>
-    <PackageVersion Include="Meziantou.Analyzer" Version="2.0.160" />
+    <PackageVersion Include="Meziantou.Analyzer" Version="2.0.163" />
     <PackageVersion Include="Microsoft.CodeAnalysis.Analyzers" Version="3.3.4" />
     <PackageVersion Include="Roslynator.Analyzers" Version="4.12.4" />
     <PackageVersion Include="StyleCop.Analyzers" Version="1.2.0-beta.556" />
-    <PackageVersion Include="SonarAnalyzer.CSharp" Version="9.28.0.94264" />    
-    <PackageVersion Include="Microsoft.VisualStudio.Threading.Analyzers" Version="17.10.48" />
+    <PackageVersion Include="SonarAnalyzer.CSharp" Version="9.32.0.97167" />    
+    <PackageVersion Include="SquiggleCop.Tasks" Version="1.0.26" />
+    <PackageVersion Include="Microsoft.VisualStudio.Threading.Analyzers" Version="17.11.20" />
     <PackageVersion Include="ExhaustiveMatching.Analyzer" Version="0.5.0" />
+    <PackageVersion Include="EffectiveCSharp.Analyzers" Version="0.1.0" />
   </ItemGroup>
 </Project>

build/targets/tests/Packages.props

@@ -1,12 +1,12 @@
 <Project>
   <ItemGroup>
-    <PackageVersion Include="ReportGenerator" Version="5.3.7" />
+    <PackageVersion Include="ReportGenerator" Version="5.3.8" />
     <PackageVersion Include="Microsoft.CodeAnalysis.CSharp.CodeFix.Testing" Version="1.1.2-beta1.24314.1" />
-    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.10.0" />
+    <PackageVersion Include="Microsoft.NET.Test.Sdk" Version="17.11.0" />
     <PackageVersion Include="Verify.Nupkg" Version="1.1.6" />
-    <PackageVersion Include="Verify.Xunit" Version="25.0.4" />
+    <PackageVersion Include="Verify.Xunit" Version="26.2.0" />
     <PackageVersion Include="xunit" Version="2.9.0" />
     <PackageVersion Include="xunit.runner.visualstudio" Version="2.8.2" />
-    <PackageVersion Include="Meziantou.Xunit.ParallelTestFramework" Version="2.2.0" />
+    <PackageVersion Include="Meziantou.Xunit.ParallelTestFramework" Version="2.3.0" />
   </ItemGroup>
 </Project>

global.json

@@ -1,7 +1,7 @@
 {
   "sdk": {
-    "version": "8.0.101",
-    "rollForward": "latestFeature"
+    "version": "8.0.400",
+    "rollForward": "disable"
   },
   "msbuild-sdks": {
     "DotNet.ReproducibleBuilds.Isolated": "1.2.4"

src/Moq.Analyzers/AsShouldBeUsedOnlyForInterfaceAnalyzer.cs

@@ -8,8 +8,8 @@ namespace Moq.Analyzers;
 [DiagnosticAnalyzer(LanguageNames.CSharp)]
 public class AsShouldBeUsedOnlyForInterfaceAnalyzer : DiagnosticAnalyzer
 {
-    private const string Title = "Moq: Invalid As type parameter";
-    private const string Message = "Mock.As() should take interfaces only";
+    private static readonly LocalizableString Title = "Moq: Invalid As type parameter";
+    private static readonly LocalizableString Message = "Mock.As() should take interfaces only";
 
     private static readonly DiagnosticDescriptor Rule = new(
         DiagnosticIds.AsShouldOnlyBeUsedForInterfacesRuleId,
@@ -32,7 +32,7 @@ public override void Initialize(AnalysisContext context)
         context.RegisterCompilationStartAction(RegisterCompilationStartAction);
     }
 
-    private void RegisterCompilationStartAction(CompilationStartAnalysisContext context)
+    private static void RegisterCompilationStartAction(CompilationStartAnalysisContext context)
     {
         // Ensure Moq is referenced in the compilation
         ImmutableArray<INamedTypeSymbol> mockTypes = context.Compilation.GetMoqMock();
@@ -42,11 +42,13 @@ private void RegisterCompilationStartAction(CompilationStartAnalysisContext cont
         }
 
         // Look for the Mock.As() method and provide it to Analyze to avoid looking it up multiple times.
+#pragma warning disable ECS0900 // Minimize boxing and unboxing
         ImmutableArray<IMethodSymbol> asMethods = mockTypes
             .SelectMany(mockType => mockType.GetMembers(WellKnownTypeNames.As))
             .OfType<IMethodSymbol>()
             .Where(method => method.IsGenericMethod)
             .ToImmutableArray();
+#pragma warning restore ECS0900 // Minimize boxing and unboxing
 
         if (asMethods.IsEmpty)
         {
@@ -58,18 +60,20 @@ private void RegisterCompilationStartAction(CompilationStartAnalysisContext cont
             OperationKind.Invocation);
     }
 
-    private void Analyze(OperationAnalysisContext context, ImmutableArray<IMethodSymbol> wellKnownAsMethods)
+    private static void Analyze(OperationAnalysisContext context, ImmutableArray<IMethodSymbol> wellKnownAsMethods)
     {
         if (context.Operation is not IInvocationOperation invocationOperation)
         {
             return;
         }
 
         IMethodSymbol targetMethod = invocationOperation.TargetMethod;
+#pragma warning disable ECS0900 // Minimize boxing and unboxing
         if (!targetMethod.IsInstanceOf(wellKnownAsMethods))
         {
             return;
         }
+#pragma warning restore ECS0900 // Minimize boxing and unboxing
 
         ImmutableArray<ITypeSymbol> typeArguments = targetMethod.TypeArguments;
         if (typeArguments.Length != 1)