Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
What Is Static Analysis, What Does It Find and Miss? Linters, Analyzers, Type Checkers and SAST
Static analysis catches bug patterns and rule violations without running the code, but it cannot see business rules that are not written in the code. In a Bookstore price import pull request, the .NET 10 defaults found 2 problems and Recommended mode 7 diagnostics; even with a clean build, a negative price and a bug reading 329,90 as 32990 still reached the database. The post covers the tool spectrum, severity, the layers from IDE to dashboard and the ratchet strategy.
.NET Analyzers: AnalysisLevel, CA Rules, .globalconfig, WarningsAsErrors and Rolling Out Gradually in a Legacy Project
Pinning AnalysisLevel to a release such as 10.0-recommended stops an SDK upgrade from silently enabling new rules and breaking CI; in Bookstore the .NET 11 SDK gave a CA2028 error with latest and passed cleanly with the pinned level. The post covers the roles of .globalconfig and .editorconfig, CA1309 and a coupon that fails on the Turkish i, CA2100 and a real SQL injection, targeted WarningsAsErrors, justified suppressions, and SARIF with pull request annotations.
Third-Party Analyzers and Writing Your Own Roslyn Analyzer: BannedApiAnalyzers, Popular Packages, DiagnosticAnalyzer and CodeFix
If a rule only says 'don't use this API', BannedApiAnalyzers is enough; if you need a code fix, team-specific logic or a context-aware message, you write your own Roslyn analyzer. In Bookstore, Meziantou, Roslynator and SonarAnalyzer added 87 warnings and 14 times the analysis time but didn't catch DateTime.UtcNow by default. The post builds a TimeProvider rule with an operation-callback analyzer, a code fix in a separate assembly, Microsoft.CodeAnalysis.Testing tests and a NuGet package.