C#

​

Code Analysis

​

.deepsource.toml

​

name

• Type: String
• Presence: mandatory
• Description: Shortcode of the analyzer.
• Example:

name = "csharp"

​

enabled

• Type: Boolean
• Presence: optional
• Description: Toggle whether this analyzer should be run.
• Example:

enabled = true

​

meta

• Type: Table
• Presence: optional
• Description: Any supported metadata to pass to the analyzer.
• Example:

[analyzers.meta]
  cyclomatic_complexity_threshold = "high"

​

cyclomatic_complexity_threshold

• Type: String
• Presence: optional
• Description: Specify the acceptable risk category for your project as the threshold. All functions with complexity beyond this threshold will raise an issue. For example, setting the threshold to low will flag all functions that have a cyclomatic complexity of more than 5, while setting the threshold to critical will not flag any function.
• Available Values: low, medium, high, very-high and critical

• Default Value: medium
• Example:

cyclomatic_complexity_threshold = "high"

​

Sample config

version = 1

test_patterns = [
  "tests/**"
]

exclude_patterns = [
  "**/examples/**"
]

[[analyzers]]
name = "csharp"
enabled = true

  [analyzers.meta]
  cyclomatic_complexity_threshold = "high"

​

Code Coverage

​

Via dotnet test

# Run your tests
dotnet test --collect:"XPlat Code Coverage" --logger:"console;verbosity=detailed" --results-directory /tmp/test-results/

# Install 'deepsource CLI'
curl https://deepsource.io/cli | sh

# Set DEEPSOURCE_DSN env variable from repository settings page
export DEEPSOURCE_DSN=https://sampledsn@deepsource.io

# From the root directory, run the report coverage command and provide the absolute file path to the generated report.
# In this case, the filepath looks something like /tmp/test-results/abcf7e0-b7df-4b0c-b919-7cb480d0f123/coverage.cobertura.xml
#
# Make sure to double check the test run ID, i.e. the GUID and the file path.
./bin/deepsource report --analyzer test-coverage --key csharp --value-file /tmp/test-results/<test_guid>/coverage.cobertura.xml

​

Code Formatter (Transformer)

​

dotnet-format

​

name

• Type: String
• Presence: mandatory
• Description: Shortcode of this transformer.
• Example:

name = "dotnet-format"

​

enabled

• Type: Boolean
• Presence: optional
• Description: Toggle whether this transformer should be run.
• Example:

enabled = true

​

Vulnerability Scanning

• packages.lock.json
• .csproj files
• packages.config
• .deps.json

• For modern PackageReference-styled projects, a lockfile can be generated in either of the following ways:
  • By enabling the RestorePackagesWithLockFile property in your *.csproj file.
    Copy

    <Project Sdk="Microsoft.NET.Sdk">
      <PropertyGroup>
        <RestorePackagesWithLockFile>true</RestorePackagesWithLockFile>
      </PropertyGroup>
    </Project>
    

  • By using dotnet restore with the RestorePackagesWithLockFile MSBuild property.
    Copy

    dotnet restore -p:RestorePackagesWithLockFile=true
    

  • By using dotnet restore with the --use-lock-file flag.
    Copy

    dotnet restore --use-lock-file
    

• For legacy projects, a lockfile can be generated as follows:
  • Using nuget restore and packages.config.
    Copy

    nuget restore packages.config -PackagesDirectory ./packages -UseLockFile
    

  • Using nuget restore and a *.sln file.
    Copy

    nuget restore YourSolution.sln -UseLockFile
    

1. dotnet restore
2. nuget restore

Note: The lockfile must be committed to your repository and tracked in version control. It should not be treated as a temporary file that’s generated and discarded during the build process.