Add SquiggleCop to baseline analyzer settings (#166)

Add [SquiggleCop](https://github.com/MattKotsenas/SquiggleCop) to
baseline the analyzers and their configuration. This intends to prevent
accidental changes / regressions to the project, such as #165.

Changes made
- Add `SquiggleCop.Tasks` and wire into the existing `$(PedanticMode)`
to validate baselines
- Add `SquiggleCop.Tool` to support ad-hoc baselining / troubleshooting
- Update `CONTRIBUTING.md` with re-baselining procedure
- Update SDK in `global.json` to latest version and disable rollforward
to support reproducible build
- Update pipelines to upload SARIF files to aid debugging

.config/dotnet-tools.json

@@ -15,6 +15,13 @@
         "dotnet-verify"
       ],
       "rollForward": false
+    },
+    "squigglecop.tool": {
+      "version": "1.0.8",
+      "commands": [
+        "dotnet-squigglecop"
+      ],
+      "rollForward": false
     }
   }
 }

.github/workflows/main.yml

@@ -25,6 +25,7 @@ permissions:
 jobs:
   build:
     strategy:
+      fail-fast: false # Run all OSes, even if one fails, to help narrow down issues that only impact some platforms
       matrix:
         os: [windows-2022, ubuntu-22.04]
 
@@ -73,6 +74,13 @@ jobs:
         path: |
           **/*.received.*
 
+    - name: Upload SARIF files
+      uses: actions/upload-artifact@v4
+      if: success() || failure()
+      with:
+        name: SARIF files (${{ matrix.os }})
+        path: ./artifacts/obj/**/*.sarif
+
     - name: Upload Test Report
       uses: actions/upload-artifact@v4
       if: success() || failure()

CONTRIBUTING.md

@@ -5,3 +5,14 @@ We welcome contributions. If you want to contribute to existing issues, check th
 [good first issue](https://github.com/rjmurillo/moq.analyzers/labels/good%20first%20issue) items in the backlog.
 
 If you have new ideas or want to complain about bugs, feel free to [create a new issue](https://github.com/rjmurillo/moq.analyzers/issues/new).
+
+## Updating SquiggleCop baselines
+
+To update SquiggleCop baselines, run this command and review and commit the results:
+
+```powershell
+dotnet clean && dotnet build /p:PedanticMode=true /p:SquiggleCop_AutoBaseline=true
+```
+
+`$(PedanticMode)` turns on the CI configuration (e.g. `TreatWarningsAsErrors`) and `$(SquiggleCop_AutoBaseline)`
+automatically accepts the new baseline.

build/targets/codeanalysis/CodeAnalysis.props

@@ -30,6 +30,10 @@
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
     </PackageReference>
+    <PackageReference Include="SquiggleCop.Tasks">
+      <PrivateAssets>all</PrivateAssets>
+      <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>
+    </PackageReference>
     <PackageReference Include="Microsoft.VisualStudio.Threading.Analyzers">
       <PrivateAssets>all</PrivateAssets>
       <IncludeAssets>runtime; build; native; contentfiles; analyzers; buildtransitive</IncludeAssets>

build/targets/codeanalysis/CodeAnalysis.targets

@@ -3,5 +3,22 @@
     <PedanticMode Condition=" '$(PedanticMode)' == '' ">$([MSBuild]::ValueOrDefault('$(ContinuousIntegrationBuild)', 'false'))</PedanticMode>
     <TreatWarningsAsErrors>$(PedanticMode)</TreatWarningsAsErrors>
     <MSBuildTreatWarningsAsErrors>$(PedanticMode)</MSBuildTreatWarningsAsErrors>
+    <SquiggleCop_Enabled>$(PedanticMode)</SquiggleCop_Enabled>
   </PropertyGroup>
+
+  <Target Name="SetErrorLog" BeforeTargets="CoreCompile">
+    <!--
+      ErrorLog is needed for SquiggleCop.
+
+      The value is set in a Target and not directly as a property because `$(IntermediateOutputPath)` and `$(OutputPath)`
+      are calculated properties and thus shouldn't be relied on during the initial property evaluation phase.
+      See https://github.com/dotnet/sdk/issues/41852.
+
+      We use `$(IntermediateOutputPath)` to ensure the file ends up in the `obj/` folder and not with sources to clearly
+      delineate inputs and outputs.
+    -->
+    <PropertyGroup Condition=" '$(ErrorLog)' == '' ">
+      <ErrorLog>$(IntermediateOutputPath)/$(MSBuildProjectName).sarif,version=2.1</ErrorLog>
+    </PropertyGroup>
+  </Target>
 </Project>

build/targets/codeanalysis/Packages.props

@@ -5,6 +5,7 @@
     <PackageVersion Include="Roslynator.Analyzers" Version="4.12.4" />
     <PackageVersion Include="StyleCop.Analyzers" Version="1.2.0-beta.556" />
     <PackageVersion Include="SonarAnalyzer.CSharp" Version="9.30.0.95878" />    
+    <PackageVersion Include="SquiggleCop.Tasks" Version="1.0.8" />
     <PackageVersion Include="Microsoft.VisualStudio.Threading.Analyzers" Version="17.10.48" />
     <PackageVersion Include="ExhaustiveMatching.Analyzer" Version="0.5.0" />
   </ItemGroup>