Fix TaskAnalyzer review defaults and inherit effective transitive severity

[VolPlita]

Related issue(s): #14993 (follow-up only)

Context

MSBuildTask0004 still defaults to Warning on regular tasks, and MSBuildTask0005 has an independent Warning severity even when the originating rule is informational. Updating the analyzer package can break existing builds that treat warnings as errors.

#14775 intentionally kept MSBuildTask0001/0004 active for all tasks. #14994 lowered MSBuildTask0001/0009/0010 to Info but omitted MSBuildTask0004/0005. #15045 shipped those defaults unchanged.

This revives the existing draft instead of creating another PR. The earlier proposal removed MSBuildTask0005 and reported the originating IDs with call-chain details. This implementation keeps MSBuildTask0005 and makes it inherit effective severity.

Changes Made

• Lower MSBuildTask0004 to Info for regular and MT-scoped tasks.
• Make MSBuildTask0005 inherit the originating rule's effective severity at the unsafe call site. Use Roslyn's CompilationWithAnalyzers.GetEffectiveDiagnostics for compiler precedence, explicit default resets, warnings-as-errors exemptions, pragmas, and SuppressMessage. Also apply Roslyn's category/all-analyzer bulk-configuration precedence.
• Preserve explicit MSBuildTask0005 severity and suppression settings. dotnet_diagnostic.MSBuildTask0005.severity = default retains inheritance.
• Add CustomSeverityConfigurable to the supported MSBuildTask0005 descriptor so ordinary compiler builds execute the analyzer even when the descriptor defaults to Info. MT warnings no longer depend on requesting an error log or explicitly enabling 0005.
• Prevent the compiler from promoting an inherited exempt Warning a second time under the MSBuildTask0005 ID.
• Preserve rule IDs, MT analysis scope, call-chain messages, call-site locations, and deduplication. Share the category-to-descriptor mapping between direct and transitive analysis.
• Update release metadata, README, unit regressions, and real packaged-consumer tests.

Compatibility

Default MSBuildTask0001/0004 transitive findings are Info. Scoped MSBuildTask0002/0003 findings remain Warning unless configuration changes their effective severity. Runtime task execution and MT opt-in scope are unchanged.

Effective-severity inheritance intentionally changes configuration behavior: an originating rule configured as Error can now make its transitive MSBuildTask0005 finding an Error. An originating suppression or warnings-as-errors exemption is inherited unless MSBuildTask0005 has its own explicit severity override. Therefore, this is not solely a compatibility relaxation. No engine ChangeWave is introduced; this changes analyzer configuration semantics rather than MSBuild execution.

Approved limitation: preserving an inherited warnings-as-errors exemption requires a frozen reporting descriptor for that specific report. Third-party DiagnosticSuppressor plugins cannot suppress that frozen diagnostic. Explicit settings, NoWarn, pragmas, and SuppressMessage are evaluated before reporting and still work. Ordinary MSBuildTask0005 reports retain their configurable descriptor. Inheritance evaluates compiler configuration and source suppressions, not arbitrary third-party suppressor execution for an originating diagnostic that is never reported.

Testing

Validation used the repository's pinned SDK 11.0.100-rc.1.26420.103, with MSBUILDUSESERVER=0 and MSBUILDDISABLENODEREUSE=1 to isolate local build servers.

• dotnet test src\TaskAnalyzer.Tests\TaskAnalyzer.Tests.csproj -c Release — passed: 398 tests, 0 failed, 0 skipped, 0 build warnings/errors.
• .\build.cmd -v quiet — passed: 0 warnings, 0 errors.
• After activating artifacts\msbuild-build-env.bat, dotnet --version — passed: 11.0.100-rc.1.26420.103.
• In the bootstrap environment, dotnet build src\Samples\Dependency\Dependency.csproj -v:q — passed: 0 warnings/errors.
• artifacts\bin\bootstrap\core\dotnet.exe msbuild -help — passed: locally built MSBuild 18.13.0-dev.26511.1.
• dotnet format whitespace src\TaskAnalyzer\TaskAnalyzer.csproj --no-restore --verify-no-changes --include src\TaskAnalyzer\DiagnosticDescriptors.cs src\TaskAnalyzer\MultiThreadableTaskAnalyzer.cs src\TaskAnalyzer\SharedAnalyzerHelpers.cs src\TaskAnalyzer\TransitiveCallChainAnalyzer.cs — passed.
• dotnet format whitespace src\TaskAnalyzer.Tests\TaskAnalyzer.Tests.csproj --no-restore --verify-no-changes --include src\TaskAnalyzer.Tests\MultiThreadableTaskAnalyzerTests.cs src\TaskAnalyzer.Tests\TransitiveCallChainAnalyzerTests.cs src\TaskAnalyzer.Tests\PackageContractTests.cs — passed.
• git diff --check — passed.

Real packaged-consumer builds reproduce and verify all four review findings: normal-build MT warning delivery without ErrorLog, an originating default reset over global Error, NoWarn/WarningsAsErrors precedence over editorconfig, and TreatWarningsAsErrors with an originating WarningsNotAsErrors exemption. They also cover explicit MSBuildTask0005 overrides/suppression and category/all-analyzer configuration. Unit tests cover originating pragmas and SuppressMessage, every originating rule category, and call-site configuration.

The complete affected analyzer suite was run. The full repository test suite and other compiler/IDE host versions were not exercised.

Dependencies and Follow-up

No companion PR or merge-order dependency. The original draft commits remain in branch history, with their proposal superseded by the current implementation. No force-push or history rewrite was used.

[Copilot]

🟡 Changes recommended

Severity resolution does not consistently follow Roslyn’s command-line and explicit-default precedence rules.

1 open finding

• Preserve explicit Default severity for originating diagnostics · New

What changed in this PR

Aligns TaskAnalyzer severities with compatibility-safe defaults while preserving configurable enforcement.

Changes:

• Lowers MSBuildTask0004 to Info.
• Makes MSBuildTask0005 inherit originating-rule severity.
• Updates documentation, release metadata, and regression/package tests.

File	Description
src/​TaskAnalyzer/​TransitiveCallChainAnalyzer.cs	Implements transitive severity inheritance.
src/​TaskAnalyzer/​SharedAnalyzerHelpers.cs	Shares category-to-descriptor mapping.
src/​TaskAnalyzer/​MultiThreadableTaskAnalyzer.cs	Uses the shared mapping.
src/​TaskAnalyzer/​DiagnosticDescriptors.cs	Lowers 0004/0005 descriptor defaults.
src/​TaskAnalyzer/​README.md	Documents updated severity behavior.
src/​TaskAnalyzer/​AnalyzerReleases.Unshipped.md	Records changed rule severities.
src/​TaskAnalyzer.Tests/​TransitiveCallChainAnalyzerTests.cs	Tests inherited and configured severities.
src/​TaskAnalyzer.Tests/​MultiThreadableTaskAnalyzerTests.cs	Tests 0004 Info defaults and overrides.
src/​TaskAnalyzer.Tests/​PackageContractTests.cs	Validates packaged analyzer behavior.

🧠 Review effort: Balanced

---

💡 Add a code-review agent skill for context-aware, tailored reviews. Learn more in the docs.

[github-actions]

#	Dimension	Verdict
4	Test Coverage & Completeness	🟡 1 MAJOR

✅ 23/24 dimensions clean.

• Test Coverage & Completeness — package-contract assertions verify diagnostic IDs but not the configured warning severity.

Warning

Firewall blocked 4 domains

The following domains were blocked by the firewall during workflow execution:

• api.github.com
• github.com
• patchdiff.githubusercontent.com
• raw.githubusercontent.com

[!TIP]
api.github.com is blocked because GitHub API access uses the built-in GitHub tools by default. Instead of adding api.github.com to network.allowed, use tools.github.mode: gh-proxy for direct pre-authenticated GitHub CLI access without requiring network access to api.github.com:

tools:
  github:
    mode: gh-proxy

See GitHub Tools for more information on gh-proxy mode.

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "api.github.com"
    - "github.com"
    - "patchdiff.githubusercontent.com"
    - "raw.githubusercontent.com"

See Network Configuration for more information.

Generated by Expert Code Review (on open) for #14777 · copilot · gpt56 · 1.3K AIC · ⌖ 0.507 AIC · ⊞ 24.9K

Comments that could not be inline-anchored

src/TaskAnalyzer.Tests/PackageContractTests.cs:203

[MAJOR] Test Coverage & Completeness

This package-consumption regression can still pass if the explicit warning settings are ignored and both diagnostics remain Info: the output still contains MSBuildTask0004 and MSBuildTask0005, so these ID-only assertions do not prove that packaged analyzer configuration restored warning severity. For example, changing both test settings to suggestion would satisfy the current assertions.

Recommendation: Assert warning MSBuildTask0004 an…

[Copilot]

🔵 Needs a closer look

Manual Roslyn severity-precedence handling affects build-breaking diagnostics across compiler hosts not covered by validation.

0 open findings

1 resolved since last review

• Preserve explicit Default severity for originating diagnostics

🧠 Review effort: Balanced