static-analysis VS Roslynator

Readers should also peruse the 'Multiple languages' section, many of the big names, Coverity, Klocwork et al. are listed there.

see https://github.com/analysis-tools-dev/static-analysis#multip...

this is Matthias from https://analysis-tools.dev.

Not an area I've had to deal with much unfortunately. Here is also a curated list of SAST tools grouped by technology. It can take quite some time to properly vet tools like this, but you might find something valuable in there.

https://github.com/analysis-tools-dev/static-analysis

You can for example rely on static analyzers and scan the repositories (just please take care of making sure that any fix you make actually makes sense, sometimes people will just make whatever causes the reports to go away without understanding them). This site lists a bunch of them for different languages -> https://analysis-tools.dev/

There's a bunch on https://github.com/analysis-tools-dev/static-analysis

https://github.com/analysis-tools-dev/static-analysis - general list of SAST

There's also this project https://github.com/JosefPihrt/Roslynator that can add even more analyzers.

It does. Nearly every style guide I've seen for any language that allows this prefers this style. I personally prefer it when such structures are needed, but would suggest following it just for consistency and the practical benefits.

Roslynator.Analyzers

The reason I say 'similar' above is that though you may treat it as production code, there are some things in the nature of writing tests that may require different coding standard to be enforced. A good example of this is the RCS1046 analyzer, enforcing names of asynchronous methods to be suffixed with 'Async'; in this case it would be acceptable to override this rule (with an .editorconfig for example) so that you're method name continues to describe the behaviour of the application, and we don't have tests named like public async Task My_descriptive_method_name_async().

You can write Roslyn analyzer but you can also simply use this set of analyzers: https://github.com/JosefPihrt/Roslynator. It has analyzers for both async method not ending with Async and non-async methods ending with Async.

My suggestion is to look into installing Roslynator or Sonarlint. Both are free and work with either Visual Studio or VS Code. With them you can right click on your solution and Run Analysis and it will give you a list of "code smells" and automatic fixes for many of them. They are great tools for any dev.

Roslynator while not exactly as good as full R# does a pretty good job for the analysis and refactoring hints imo. Paired with Intellicode + NCrunch (paid) so far has been a good enough experience for us.

I prefer the second and roslynator would give RCS1124: Inline local variable1 for the first one.

Roslynator.Analyzers