{"id":28496067,"url":"https://github.com/sonarsource/sonarqube-roslyn-sdk","last_synced_at":"2025-07-02T15:31:17.570Z","repository":{"id":2828120,"uuid":"46718922","full_name":"SonarSource/sonarqube-roslyn-sdk","owner":"SonarSource","description":"SDK for SonarQube Roslyn Analyzer Plugins ","archived":false,"fork":false,"pushed_at":"2025-06-24T13:01:19.000Z","size":6390,"stargazers_count":88,"open_issues_count":3,"forks_count":42,"subscribers_count":31,"default_branch":"master","last_synced_at":"2025-06-24T13:49:42.937Z","etag":null,"topics":[],"latest_commit_sha":null,"homepage":"","language":"C#","has_issues":true,"has_wiki":null,"has_pages":null,"mirror_url":null,"source_name":null,"license":"lgpl-3.0","status":null,"scm":"git","pull_requests_enabled":true,"icon_url":"https://github.com/SonarSource.png","metadata":{"files":{"readme":"README.md","changelog":null,"contributing":null,"funding":null,"license":"LICENSE.txt","code_of_conduct":null,"threat_model":null,"audit":null,"citation":null,"codeowners":".github/CODEOWNERS","security":"SECURITY.md","support":null,"governance":null,"roadmap":null,"authors":null,"dei":null,"publiccode":null,"codemeta":null,"zenodo":null}},"created_at":"2015-11-23T12:31:17.000Z","updated_at":"2025-06-24T12:50:28.000Z","dependencies_parsed_at":"2024-05-13T12:43:58.408Z","dependency_job_id":"18df11aa-73f9-4c80-99ac-b740f863b9b6","html_url":"https://github.com/SonarSource/sonarqube-roslyn-sdk","commit_stats":null,"previous_names":[],"tags_count":8,"template":false,"template_full_name":null,"purl":"pkg:github/SonarSource/sonarqube-roslyn-sdk","repository_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SonarSource%2Fsonarqube-roslyn-sdk","tags_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SonarSource%2Fsonarqube-roslyn-sdk/tags","releases_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SonarSource%2Fsonarqube-roslyn-sdk/releases","manifests_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SonarSource%2Fsonarqube-roslyn-sdk/manifests","owner_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners/SonarSource","download_url":"https://codeload.github.com/SonarSource/sonarqube-roslyn-sdk/tar.gz/refs/heads/master","sbom_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories/SonarSource%2Fsonarqube-roslyn-sdk/sbom","host":{"name":"GitHub","url":"https://github.com","kind":"github","repositories_count":263165754,"owners_count":23424003,"icon_url":"https://github.com/github.png","version":null,"created_at":"2022-05-30T11:31:42.601Z","updated_at":"2022-07-04T15:15:14.044Z","host_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub","repositories_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repositories","repository_names_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/repository_names","owners_url":"https://repos.ecosyste.ms/api/v1/hosts/GitHub/owners"}},"keywords":[],"created_at":"2025-06-08T11:38:36.381Z","updated_at":"2025-07-02T15:31:17.538Z","avatar_url":"https://github.com/SonarSource.png","language":"C#","funding_links":[],"categories":[],"sub_categories":[],"readme":"# Welcome to the SonarQube Roslyn SDK project\n\n## License\n\nCopyright 2015-2025 SonarSource.\n\nLicensed under the [GNU Lesser General Public License, Version 3.0](http://www.gnu.org/licenses/lgpl.txt)\n\n[![Build Status](https://dev.azure.com/sonarsource/DotNetTeam%20Project/_apis/build/status/SonarQube%20Roslyn%20Analyzer%20SDK?branchName=master)](https://dev.azure.com/sonarsource/DotNetTeam%20Project/_build/latest?definitionId=17\u0026branchName=master)\n\n[![Quality Gate Status](https://sonarcloud.io/api/project_badges/measure?project=sonarqube-roslyn-sdk\u0026metric=alert_status\u0026token=5bf9d3f65527e95102fd8af7b5226c50dba35d66)](https://sonarcloud.io/dashboard?id=sonarqube-roslyn-sdk)\n\n[![Coverage](https://sonarcloud.io/api/project_badges/measure?project=sonarqube-roslyn-sdk\u0026metric=coverage\u0026token=5bf9d3f65527e95102fd8af7b5226c50dba35d66)](https://sonarcloud.io/dashboard?id=sonarqube-roslyn-sdk)\n\n## Overview\nThis repo contains tools to help integrate Roslyn analyzers with SonarQube so that issues detected by the Roslyn analyzers are reported and managed in SonarQube.\nSpecifically, the tools will generate a Java SonarQube plugin that registers the rules with SonarQube. The generated plugin works with the [C# plugin](https://docs.sonarsource.com/sonarqube/latest/analyzing-source-code/languages/csharp/), [VB.NET plugin](https://docs.sonarsource.com/sonarqube/latest/analyzing-source-code/languages/vb-dotnet/) and the [SonarScanner for .NET](https://docs.sonarsource.com/sonarqube/latest/analyzing-source-code/scanners/sonarscanner-for-dotnet/) to handle executing the analyzer and uploading any issues.\nSee this [blog post](https://devblogs.microsoft.com/devops/sonarqube-scanner-for-msbuild-v2-0-released-support-for-third-party-roslyn-analyzers/) for more information.\n\n### Integration with the SonarScanner for .NET\nThe [SonarScanner for .NET](https://docs.sonarsource.com/sonarqube/latest/analyzing-source-code/scanners/sonarscanner-for-dotnet/) will automatically execute your custom rules as part of an analysis build using the configuration you have defined in the Quality Profile. There is no need to manually reference your analyzer NuGet package in the MSBuild projects you want to analyse.\n\nThe SonarScanner for .NET can also import issues from Roslyn analyzers that do not have plugins created using this SDK. However, they will be imported as \"external issues\" and are handled differently in SonarQube. See [External .NET issues](https://docs.sonarsource.com/sonarqube/latest/analyzing-source-code/importing-external-issues/external-analyzer-reports/#external-dotnet-issues) for more information.\n\n### Integration with SonarLint for Visual Studio\nIf you define a Quality Profile that references your custom rules then [SonarLint for Visual Studio](https://github.com/sonarsource/sonarlint-visualstudio) in *Connected Mode* will include those rules in the ruleset it generates.\nHowever, it will **not** automatically configure Visual Studio to execute your custom rules.\nIf you want your customer rules to be executed inside Visual Studio then you will need reference your analyzer NuGet package from your MSBuild projects, or install your analyzer VSIX on each developer machine.\n\nSee the [SonarLint for Visual Studio documentation](https://docs.sonarsource.com/sonarlint/visual-studio/team-features/connected-mode/) for more information on Connected Mode.\n\n## Getting started\n\n1. Download the latest [released version](https://github.com/SonarSource/sonarqube-roslyn-sdk/releases/latest), or clone and build this repository.\n  \n1. Run the generator tool `RoslynSonarQubePluginGenerator.exe` specifying the analyzer NuGet package id\n    ```\n    RoslynSonarQubePluginGenerator.exe /a:YourAnalyzerNugetPackageId\n    ```\n\n1. Copy the generated `youranalyzernugetpackageid-plugin.1.0.0.jar` into your SonarQube `extensions\\plugins` directory.\n\n1. Restart your SonarQube server.\n\n1. Add the rules to a Quality Profile in SonarQube.\n\n1. Configure your SonarQube project to use the new Quality Profile.\n\n1. Run an analysis using the [SonarScanner for .NET](https://docs.sonarsource.com/sonarqube/latest/analyzing-source-code/scanners/sonarscanner-for-dotnet/).\n\nYou can run `RoslynSonarQubePluginGenerator.exe` without parameters to see all the available command line options.\n\n## Compatibility\n\n| SDK | Minimal compatible SQ | Tested with SQ |\n|-----|-----------------------|----------------|\n| 1.0 | 4.5.2                 | 6.7            |\n| 2.0 | 6.7                   | 7.3alpha1      |\n| 3.0 | 7.9.6                 | 9.1            |\n| 3.1 | 7.9.6                 | 9.7            |\n| 4.0 | 9.9                   | 10.5.1         |\n\nPlugins generated with a specific SDK version will not work with SonarQube versions older than the minimal compatible version. The latest version available for testing at the time of the SDK release is indicated in the *Tested with SQ* column. \n\n\n## Updating compatible Roslyn version\n\nThe SDK is compatible with analyzer targeting Roslyn from version 1.0.0 up to the version specified in [Directory.Build.props](./Directory.Build.props#L10).\n\nTo support a newer version of Roslyn, follow these steps:\n1. Find the latest version of Roslyn on [NuGet](https://www.nuget.org/packages/Microsoft.CodeAnalysis).\n1. Update the version in the [Directory.Build.props](./Directory.Build.props). \n1. Rebuild the SDK.\n1. Run the SDK against your analyzer.\n\n## Target users\nThere are two groups of target users:\n\n1. Roslyn analyzer authors\n\n   Analyzer authors will be able to use the tools during development to provide additional metadata about their rules (e.g. SonarQube severity, tags, a richer description, ...) and generate the SonarQube plugin. See below for additional notes if you are developing your analyzer and running the SDK against the generated NuGet repeatedly on the same development machine.\n\n1. Roslyn analyzer users\n\n   If the analyzer author has not provided a SonarQube plugin for their analyzer then users will be able to generate a plugin from an analyzer NuGet package, although they won't be able to provide such rich metadata.\n\n## Advanced scenarios\n\n### Customizing the rules.xml file\nTo customize the `rules.xml` file, run the generator once against the NuGet package. The generator will produce a template `rules.xml` for the analyzers found in the package as well as producing the .jar file. Edit the `rules.xml` file then run the generator tool again, this time providing the `/rules` parameter to point to the edited `rules.xml` file.\n\nThe XML snippet below shows the expected format for tags and debt remediation information.\n\n```xml\n\u003c?xml version=\"1.0\" encoding=\"utf-8\"?\u003e\n\u003crules\u003e\n  \u003crule\u003e\n    \u003ckey\u003eS1000\u003c/key\u003e\n    \u003cname\u003eMy title\u003c/name\u003e\n    \u003cseverity\u003eBLOCKER|CRITICAL|MAJOR|MINOR|INFO\u003c/severity\u003e\n    \u003ccardinality\u003eSINGLE\u003c/cardinality\u003e\n    \u003cdescription\u003e\u003c![CDATA[My description]]\u003e\u003c/description\u003e\n    \u003ctag\u003emy-first-tag\u003c/tag\u003e\n    \u003ctag\u003emy-second-tag\u003c/tag\u003e\n    \u003ctype\u003eBUG\u003c/type\u003e\n    \u003cdebtRemediationFunction\u003eCONSTANT_ISSUE\u003c/debtRemediationFunction\u003e\n    \u003cdebtRemediationFunctionOffset\u003e15min\u003c/debtRemediationFunctionOffset\u003e\n  \u003c/rule\u003e\n\u003c/rules\u003e\n``` \n\n### Configuring NuGet feeds\nThe SDK will look for NuGet.config files in the following locations:\n- in the directory containing `RoslynSonarQubeGenerator.exe`\n- `%AppData%\\NuGet` - the standard pre-user location)\n- `%ProgramData%\\NuGet\\Config\\SonarQube` - a custom machine-wide location\n- `%ProgramData%\\NuGet\\Config` - the standard machine-wide location\n\nIf the analyzer you want to package is available in a private NuGet feed then you will need to create an appropriate `NuGet.config` file to point to the private feed. Alternatively you can use the `/customnugetrepo:file:///PathToRepo` parameter. This will overwrite the above mentioned NuGet behaviour.\n\n### Generating a jar for an analyzer that is not available from a NuGet feed\nIf you want to create a jar for Roslyn analyzer that is not available from a NuGet feed (e.g. an analyzer you have created on your local machine) you can specify a package source that points at a local directory containing the *.nupkg* file created by the standard Roslyn templates. See the [NuGet docs](https://learn.microsoft.com/en-us/nuget/hosting-packages/overview) for more information.\n\nBy default, the [NuGet.config](./RoslynPluginGenerator/NuGet.config#L16) file shipped with the RoslynSonarQubeGenerator has a local package source configured that points to `C:\\LocalNugetFeed`.\n\n### NuGet packaging information\n\nThe SDK uses information from the NuGet package to populate the fields in the generated plugin that affect how the plugin is described in the Update Centre in the SonarQube UI. It is not currently possible to customise these values.\n\nThe NuGet package properties are documented [here](https://learn.microsoft.com/en-us/nuget/reference/nuspec#required-metadata-elements) and the SonarQube plugin properties are documented [here](https://docs.sonarsource.com/sonarqube/latest/extension-guide/developing-a-plugin/plugin-basics/#advanced-build-properties).\n\nThe NuGet package properties are mapped to plugin properties as follows:\n\n| Plugin property           | NuGet property | Falls back to |\n|---------------------------|----------------|---------------|\n| Plugin-Name               | title          | id            |\n| Plugin-Description        | description    |               |\n| Plugin-Version            | version        |               |\n| Plugin-Developers         | authors        |               |\n| Plugin-Organisation       | owners         | authors       |\n| Plugin-Homepage           | projectUrl     |               |\n| Plugin-TermsConditionsUrl | licenseUrl     |               |\n| Plugin-License            | licenseNames** | licenseUrl    |\n| Key*                      | id             |               |\n\n\\* This property is not visible to users, but must be unique. It is calculated from the package id.\n\n\\*\\* This property is assigned heuristically by the NuGet.org website based on the licenseUrl.\n\n### Additional notes for Roslyn analyzer authors\nThe SDK caches the NuGet packages it downloads locally under `%temp%\\.sonarqube.sdk\\.nuget`.\n\nThis matters if you are developing your analyzer iteratively on a development machine i.e. with the following workflow:\n\u003e change analyzer code -\u003e build package -\u003e deploy package to local NuGet feed -\u003e run SDK against the new package -\u003e repeat\n\nIn that case, you have to do one of the following before running the SDK:\n* change the package version number, or\n* delete your package from the local cache (`%temp%\\.sonarqube.sdk\\.nuget`).\n\nIf you don't, the SDK exe will use the cached version, rather than the version you have just built.\n","project_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsonarsource%2Fsonarqube-roslyn-sdk","html_url":"https://awesome.ecosyste.ms/projects/github.com%2Fsonarsource%2Fsonarqube-roslyn-sdk","lists_url":"https://awesome.ecosyste.ms/api/v1/projects/github.com%2Fsonarsource%2Fsonarqube-roslyn-sdk/lists"}