Include `StyleCop` analyzer in `Microsoft.Extensions.StaticAnalysis`

[julealgon]

We have started using Microsoft.Extensions.StaticAnalysis in most of our projects as a means to standardize and unify on a more strict static analysis profile without introducing too much maintenance overhead (just a single preconfigured NuGet).

However, we would also like to introduce standard StyleCop analyzer rules to our repositories, enforcing common practices in the .NET ecosystem:

• https://www.nuget.org/packages/StyleCop.Analyzers/

While we can include the StyleCop analyzer separately and configure it to our liking, I think it would make a lot of sense for that analyzer to be included in this extension for the same reason that the other analyzers are included today:

• Microsoft-defined standard set of rules without needing extra configuration on consumers, provides higher cohesion across the ecosystem
• Centralized inclusion via a single package that is easier to maintain across multiple repositories and solutions

Would it be possible for Microsoft.Extensions.StaticAnalysis to include StyleCop?

@sharwell FYI

[stephentoub]

That package hasn't been updated in three years, and the last stable release was six years ago. As far as I can tell it's no longer being maintained.

[julealgon]

@stephentoub there is a very large discussion on that front. There's been probably hundreds of -beta package releases for that analyzer and people talking about a "stable release" all the time.

If you look at the issues on the repo, you'll see it is actually highly active. Sharwell created tons of very recent tasks there related to modern C# versions, for instance:

• https://github.com/DotNetAnalyzers/StyleCopAnalyzers/issues

But yes... versioning is a bit of a mess over there. This is one of the reasons I mentioned @sharwell here. Maybe he could share some insights into this.

This is also relevant:

It would be awesome to get a new stable release of it and have it participate in Microsoft.Extensions.StaticAnalysis IMHO. Would benefit the entire community.

EDIT:
Also for reference:

• What would be needed for a new release version? DotNetAnalyzers/StyleCopAnalyzers#3826

[julealgon]

I see other well-known Microsoft folks as contributors to the repo as well. Wonder what they think of this:

• @Youssef1313
• @AArnott
• @jnm2

[stephentoub]

Even if it were well-maintained and there was even a new beta version in the last three years, I'm still not convinced it's appropriate for Microsoft.Extensions.StaticAnalysis. StyleCop is about style, which is highly personal, variable, and outside the realm of what the opinionated set of analyzers in M.E.StaticAnalysis is about. I don't see a lot of value in including it. You can easily add the StyleCop reference if you want to use it.

[jnm2]

I think StyleCop.Analyzers could use some performance work, and I have only ever left enabled a minority of the rules because of how opinionated (inflexible) they are. I wish something existed that had the flexibility of, say, ESLint.

[julealgon]

Even if it were well-maintained and there was even a new beta version in the last three years, I'm still not convinced it's appropriate for Microsoft.Extensions.StaticAnalysis. StyleCop is about style, which is highly personal, variable, and outside the realm of what the opinionated set of analyzers in M.E.StaticAnalysis is about.

I agree in a sense, but not completely. While yes, a lot of it is highly personal or specific, there is a large subset of formatting that is widely adopted as standard by the community and has a well-defined "default". I think just having this (much smaller admittedly) subset set by Microsoft would still be very useful for everyone consuming this library.

I don't see a lot of value in including it.

I see very similar value to the existing analyzers. Sure, they don't impact performance, but static analysis is not only about performance. Formatting is an area that brings a lot of unnecessary friction to reviews, and having the more standard rules enforced on build eliminates that completely.

You can easily add the StyleCop reference if you want to use it.

Well yes... but adding it individually will increase maintenance since now we have to define that same set of base rules ourselves. That is a big aspect of this repo, that it is a "curated set" of rules (as the readme says).

It is the same overhead of just including SonarAnalyzer.CSharp or Microsoft.VisualStudio.Threading.Analyzers individually.

If you guys don't think this is a good idea, what will end up happening on our side is that we'll end up having our own Affinitiv.Extensions.StaticAnalysis that packages Microsoft.Extensions.StaticAnalysis together with the StyleCop analyzer and then use that package on all repos. It is possible, but I think it would make sense to avoid needing to do that by having it be part of this package in the first place. It's going to add non-trivial management burden for us.