Centralize Roslyn analyzers-from-source opt-in and preserve Microsoft.CodeAnalysis.Analyzers package dependency

[Copilot]

This updates the repo to replace direct per-project Microsoft.CodeAnalysis.Analyzers wiring with a shared analyzers-from-source + pack dependency preservation pattern.

• Centralized shared analyzer wiring

  • Added shared opt-in properties in eng/targets/Settings.props:
    • UseRoslynAnalyzersFromSource (default false)
    • IncludeRoslynAnalyzersPackageDependency (default false)
  • Added centralized analyzer ProjectReference logic in eng/targets/Imports.targets when UseRoslynAnalyzersFromSource=true.
  • The centralized analyzer set matches the package aggregate:
    • src/RoslynAnalyzers/Microsoft.CodeAnalysis.Analyzers/Core/Microsoft.CodeAnalysis.Analyzers.csproj
    • src/RoslynAnalyzers/Microsoft.CodeAnalysis.Analyzers/CSharp/Microsoft.CodeAnalysis.CSharp.Analyzers.csproj
    • src/RoslynAnalyzers/Microsoft.CodeAnalysis.Analyzers/VisualBasic/Microsoft.CodeAnalysis.VisualBasic.Analyzers.vbproj
  • Each analyzer project reference is configured as:
    • ReferenceOutputAssembly="false"
    • OutputItemType="Analyzer"
    • PrivateAssets="all"

• Preserve NuGet dependency shape without double analyzer consumption

  • For opted-in packable projects, centralized logic adds PackageReference Include="Microsoft.CodeAnalysis.Analyzers" with analyzer/build assets excluded so analyzers come from source project outputs while dependency metadata is retained for packing.
  • Restored analyzer version/property metadata in:
    • eng/Packages.props
    • eng/Version.Details.props
    • eng/Version.Details.xml

• Project opt-in / scope

  • Added transitive opt-in for src/ via src/Directory.Build.props (UseRoslynAnalyzersFromSource=true for non-source-only builds).
  • Explicitly opted in direct projects updated in this PR:
    • src/Compilers/Core/Portable/Microsoft.CodeAnalysis.csproj
    • src/CodeStyle/Core/Analyzers/Microsoft.CodeAnalysis.CodeStyle.csproj
    • src/Tools/Source/CompilerGeneratorTools/Source/CSharpSyntaxGenerator/CSharpSyntaxGenerator.csproj
  • Enabled package-dependency preservation where needed:
    • Microsoft.CodeAnalysis.csproj
    • Microsoft.CodeAnalysis.CodeStyle.csproj

• Cleanup of conflicting/duplicated wiring

  • Removed per-project analyzer reference blocks from the directly updated projects in favor of shared centralized logic.

Microsoft Reviewers: Open in CodeFlow

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[JoeRobich]

@copilot Please update this PR to use a shared “analyzers from source + pack-only dependency” pattern so we keep NuGet dependency shape unchanged while avoiding duplicate analyzer inclusion.

Goal

For Roslyn projects that currently depend on Microsoft.CodeAnalysis.Analyzers:

1. Consume analyzers via ProjectReference (as analyzers, not assembly refs).
2. Keep NuGet package dependencies showing Microsoft.CodeAnalysis.Analyzers (same as today).
3. Do not consume analyzer assets from PackageReference (no double-add).
4. Centralize logic so projects opt in with a property instead of repeating ItemGroups.

Required implementation

1) Add shared opt-in analyzer ProjectReference logic

Add this to a shared imported file (prefer existing Roslyn central build file; otherwise Directory.Build.props in appropriate scope):

• Property default:
  • UseRoslynAnalyzersFromSource defaults to false.
• When UseRoslynAnalyzersFromSource == true, add ProjectReference entries for all analyzer projects included by Microsoft.CodeAnalysis.Analyzers.Package.
• Each analyzer ProjectReference must set:
  • ReferenceOutputAssembly="false"
  • OutputItemType="Analyzer"
  • PrivateAssets="all"

Important: include the same full analyzer set that the Package project currently aggregates (not just one project).

2) Add shared pack-only dependency logic

Add to shared pack targets file (prefer Roslyn’s existing pack/dependency mechanism; otherwise equivalent in Directory.Build.targets in appropriate scope):

• When UseRoslynAnalyzersFromSource == true and packing is enabled:
  • add pack dependency metadata so produced nuspec still contains dependency on:
    • Microsoft.CodeAnalysis.Analyzers
    • version from existing Roslyn version property (reuse existing property used in repo)

Use Roslyn’s existing dependency item convention for nuspec generation (e.g. PackageDependency or whichever item is already used in this area).
Do not use a functional PackageReference that contributes analyzer/build assets.

3) Opt in all relevant projects (explicit transitive requirement)

Set this property to true for:

• every project directly updated in this PR, and
• every project that would have previously received these analyzers transitively from those updated projects/package flow.

<UseRoslynAnalyzersFromSource>true</UseRoslynAnalyzersFromSource>

This is required to preserve prior effective analyzer coverage: no project should lose analyzer inclusion due to transitive behavior changes.

At minimum, include src/Compilers/Core/Portable/Microsoft.CodeAnalysis.csproj and any other affected Roslyn package-producing projects in this transitive closure.

4) Remove/adjust conflicting references

• Remove per-project analyzer PackageReference usage that would cause duplicate analyzer inclusion.
• Keep package dependency shape via pack-only dependency metadata from step 2.

Validation (please do and summarize in PR comment)

1. Build: analyzer list shows analyzers coming from project outputs (not duplicated by package assets).
2. Pack: resulting nuspec for affected packages still includes dependency on Microsoft.CodeAnalysis.Analyzers with expected version/property.
3. No net loss of analyzers compared to what Microsoft.CodeAnalysis.Analyzers.Package previously aggregated.
4. Confirm all direct + previously transitive consumer projects have UseRoslynAnalyzersFromSource=true.
5. Add a short note in PR description of the new shared opt-in property and where analyzer list is centrally defined.

[Copilot]

@copilot Please update this PR to use a shared “analyzers from source + pack-only dependency” pattern so we keep NuGet dependency shape unchanged while avoiding duplicate analyzer inclusion.

##...

Implemented in aeb04bb.

Changes made:

• Added shared opt-in properties in eng/targets/Settings.props:
  • UseRoslynAnalyzersFromSource (default false)
  • IncludeRoslynAnalyzersPackageDependency (default false)
• Centralized analyzer ProjectReference wiring in eng/targets/Imports.targets (Core/CSharp/VB analyzer projects, with ReferenceOutputAssembly="false", OutputItemType="Analyzer", PrivateAssets="all").
• Centralized dependency-shape preservation in eng/targets/Imports.targets for opted-in packable projects via PackageReference Include="Microsoft.CodeAnalysis.Analyzers" ExcludeAssets="analyzers;build;buildTransitive".
• Opted in transitive scope via src/Directory.Build.props and direct projects explicitly:
  • src/Compilers/Core/Portable/Microsoft.CodeAnalysis.csproj
  • src/CodeStyle/Core/Analyzers/Microsoft.CodeAnalysis.CodeStyle.csproj
  • src/Tools/Source/CompilerGeneratorTools/Source/CSharpSyntaxGenerator/CSharpSyntaxGenerator.csproj
• Removed duplicated per-project analyzer ProjectReference blocks from those direct projects.
• Restored analyzer version/property wiring in eng/Packages.props, eng/Version.Details.props, and eng/Version.Details.xml.

Validation notes:

• dotnet build succeeded for Microsoft.CodeAnalysis.csproj and Microsoft.CodeAnalysis.CodeStyle.csproj before the feed outage recurred.
• I hit repeated upstream feed download failures for Microsoft.CodeAnalysis.Analyzers.5.6.0-2.26151.2 (VS blob endpoint) while validating additional restore-dependent scenarios, so full local end-to-end restore/pack validation could not be completed in this sandbox.
• No UI changes in this PR (no screenshot applicable).

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• se1vsblobprodcus349.vsblob.vsassets.io
  • Triggering command: /usr/share/dotnet/dotnet /usr/share/dotnet/dotnet /usr/share/dotnet/sdk/10.0.103/NuGet.Build.Tasks.Console.dll Recursive=True;CleanupAssetsForUnsupportedProjects=True;DisableParallel=False;Force=False;ForceEvaluate=False;HideWarningsAndErrors=False;IgnoreFailedSources=False;Interactive=False;NoCache=False;NoHttpCache=False;RestorePackagesConfig=False /usr/share/dotnet/sdk/10.0.103/MSBuild.dll /home/REDACTED/work/roslyn/roslyn/src/Compilers/Core/Portable/Microsoft.CodeAnalysis.csproj NuGetInteractive=false;EnableDefaultCompileItems=false;EnableDefaultEmbeddedResourceItems=false;EnableDefaultNoneItems=false;MSBuildRestoreSessionId=705e560f-1259-4c3a-8624-2fd24ca6af24;MSBuildIsRestoring=True;ExcludeRestorePackageImports=True;OriginalMSB (dns block)
  • Triggering command: /usr/share/dotnet/dotnet /usr/share/dotnet/dotnet /usr/share/dotnet/sdk/10.0.103/NuGet.Build.Tasks.Console.dll Recursive=True;CleanupAssetsForUnsupportedProjects=True;DisableParallel=False;Force=False;ForceEvaluate=False;HideWarningsAndErrors=False;IgnoreFailedSources=False;Interactive=False;NoCache=False;NoHttpCache=False;RestorePackagesConfig=False /usr/share/dotnet/sdk/10.0.103/MSBuild.dll /home/REDACTED/work/roslyn/roslyn/src/Tools/Source/CompilerGeneratorTools/Source/CSharpSyntaxGenerator/CSharpSyntaxGenerator.csproj NuGetInteractive=false;EnableDefaultCompileItems=false;EnableDefaultEmbeddedResourceItems=false;EnableDefaultNoneItems=false;MSBuildRestoreSessionId=c6c90cbe-9b4f-4e44-94e7-a2852d202a68;MSBuildIsRestoring=True;ExcludeRestorePackageImports=True;OriginalMSB (dns block)
  • Triggering command: /usr/share/dotnet/dotnet /usr/share/dotnet/dotnet /usr/share/dotnet/sdk/10.0.103/NuGet.Build.Tasks.Console.dll Recursive=True;CleanupAssetsForUnsupportedProjects=True;DisableParallel=False;Force=False;ForceEvaluate=False;HideWarningsAndErrors=False;IgnoreFailedSources=False;Interactive=False;NoCache=False;NoHttpCache=False;RestorePackagesConfig=False /usr/share/dotnet/sdk/10.0.103/MSBuild.dll /home/REDACTED/work/roslyn/roslyn/src/Tools/Source/CompilerGeneratorTools/Source/CSharpSyntaxGenerator/CSharpSyntaxGenerator.csproj NuGetInteractive=false;EnableDefaultCompileItems=false;EnableDefaultEmbeddedResourceItems=false;EnableDefaultNoneItems=false;MSBuildRestoreSessionId=fcfa13ad-2497-4751-9fa8-67be869894bc;MSBuildIsRestoring=True;ExcludeRestorePackageImports=True;OriginalMSB (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)