Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
.NET Analyzers: AnalysisLevel, CA Rules, .globalconfig, WarningsAsErrors and Rolling Out Gradually in a Legacy Project
Pinning AnalysisLevel to a release such as 10.0-recommended stops an SDK upgrade from silently enabling new rules and breaking CI; in Bookstore the .NET 11 SDK gave a CA2028 error with latest and passed cleanly with the pinned level. The post covers the roles of .globalconfig and .editorconfig, CA1309 and a coupon that fails on the Turkish i, CA2100 and a real SQL injection, targeted WarningsAsErrors, justified suppressions, and SARIF with pull request annotations.
What Is Static Analysis, What Does It Find and Miss? Linters, Analyzers, Type Checkers and SAST
Static analysis catches bug patterns and rule violations without running the code, but it cannot see business rules that are not written in the code. In a Bookstore price import pull request, the .NET 10 defaults found 2 problems and Recommended mode 7 diagnostics; even with a clean build, a negative price and a bug reading 329,90 as 32990 still reached the database. The post covers the tool spectrum, severity, the layers from IDE to dashboard and the ratchet strategy.