Single sarif file

.config/dotnet-tools.json

@@ -24,7 +24,7 @@
       "rollForward": false
     },
     "fsharp-analyzers": {
-      "version": "0.25.0",
+      "version": "0.32.1",
       "commands": [
         "fsharp-analyzers"
       ],

.github/workflows/main.yml

@@ -27,15 +27,6 @@ jobs:
     - name: "trigger fantomas-tools action"
       if: matrix.os == 'ubuntu-latest' && github.ref == 'refs/heads/main'
       run: "curl -H 'Accept: application/vnd.github.everest-preview+json' -H 'Authorization: token ${{secrets.FANTOMAS_TOOLS_TOKEN}}' --request POST --data '{\"event_type\": \"fantomas-commit-on-main\"}' https://api.github.com/repos/fsprojects/fantomas-tools/dispatches"
-    - name: "Run analyzers"
-      run: dotnet fsi build.fsx -- -p Analyze
-      continue-on-error: true
-      if: matrix.os == 'ubuntu-latest'
-    - name: Upload SARIF file
-      uses: github/codeql-action/upload-sarif@v3
-      if: matrix.os == 'ubuntu-latest' && (github.event_name != 'push' || github.actor != 'dependabot[bot]')
-      with:
-        sarif_file: analysisreports
     - name: "Documentation"
       if: matrix.os == 'windows-latest' && github.ref == 'refs/heads/main'
       uses: peaceiris/actions-gh-pages@v4
@@ -49,6 +40,26 @@ jobs:
         GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       run: dotnet fsi build.fsx -p Release
 
+  analyze:
+    name: Analyze solution
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v5
+
+      - name: Setup .NET Core
+        uses: actions/setup-dotnet@v4
+
+      - name: Run analyzers
+        run: dotnet fsi build.fsx -- -p Analyze
+        continue-on-error: true
+
+      - name: Upload merged SARIF
+        if: github.event_name != 'push' || github.actor != 'dependabot[bot]'
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: analysis.sarif
+
   # Builds the project in a dev container
   build-devcontainer:
     runs-on: ubuntu-latest

Directory.Build.props

@@ -65,6 +65,5 @@ Some common use cases include:
            <PrivateAssets>all</PrivateAssets>
            <IncludeAssets>runtime; build; native; contentfiles; analyzers</IncludeAssets>
        </PackageReference>
-       <PackageReference Include="FSharp.Analyzers.Build" PrivateAssets="All" />
    </ItemGroup>
 </Project>

Directory.Build.targets

@@ -5,12 +5,4 @@
         <PackageReference Include="Ionide.KeepAChangelog.Tasks" PrivateAssets="all" />
         <PackageReference Include="DotNet.ReproducibleBuilds" PrivateAssets="all" />
     </ItemGroup>
-    <PropertyGroup>
-        <CodeRoot Condition="$(CodeRoot) == ''">.</CodeRoot>
-        <FSharpAnalyzersOtherFlags>--analyzers-path &quot;$(PkgG-Research_FSharp_Analyzers)/analyzers/dotnet/fs&quot;</FSharpAnalyzersOtherFlags>
-        <FSharpAnalyzersOtherFlags>$(FSharpAnalyzersOtherFlags) --analyzers-path &quot;$(PkgIonide_Analyzers)/analyzers/dotnet/fs&quot;</FSharpAnalyzersOtherFlags>
-        <FSharpAnalyzersOtherFlags>$(FSharpAnalyzersOtherFlags) --verbosity d</FSharpAnalyzersOtherFlags>
-        <FSharpAnalyzersOtherFlags>$(FSharpAnalyzersOtherFlags) --code-root $(CodeRoot)</FSharpAnalyzersOtherFlags>
-        <FSharpAnalyzersOtherFlags>$(FSharpAnalyzersOtherFlags) --report &quot;$(CodeRoot)/analysisreports/$(MSBuildProjectName)-analysis.sarif&quot;</FSharpAnalyzersOtherFlags>
-    </PropertyGroup>
 </Project>

Directory.Packages.props

@@ -14,9 +14,8 @@
         <PackageVersion Include="Ionide.KeepAChangelog.Tasks" Version="0.1.8"/>
         <PackageVersion Include="DotNet.ReproducibleBuilds" Version="1.1.1"/>
 
-        <PackageVersion Include="G-Research.FSharp.Analyzers" Version="0.9.3" />
-        <PackageVersion Include="Ionide.Analyzers" Version="0.9.0" />
-        <PackageVersion Include="FSharp.Analyzers.Build" Version="0.3.0" />
+        <PackageVersion Include="G-Research.FSharp.Analyzers" Version="0.18.0" />
+        <PackageVersion Include="Ionide.Analyzers" Version="0.14.7" />
 
         <PackageVersion Include="StreamJsonRpc" Version="2.20.20" />
         <PackageVersion Include="Newtonsoft.Json" Version="13.0.3" />

Directory.Solution.targets

@@ -1,17 +1,28 @@
 <Project>
+    <!-- Import the NuGet props file to get access to Pkg* variables -->
+    <Import Project="artifacts/obj/Fantomas/Fantomas.fsproj.nuget.g.props" Condition="Exists('artifacts/obj/Fantomas/Fantomas.fsproj.nuget.g.props')" />
 
     <ItemGroup>
         <ProjectsToAnalyze Include="src/**/*.fsproj" Exclude="src/Fantomas.FCS/Fantomas.FCS.fsproj"/>
     </ItemGroup>
 
-    <Target Name="AnalyzeSolution">
+    <Target Name="AnalyzeSolution" Condition="Exists('artifacts/obj/Fantomas/Fantomas.fsproj.nuget.g.props')">
         <PropertyGroup>
             <CodeRoot>$(SolutionDir)</CodeRoot>
         </PropertyGroup>
-        <RemoveDir Directories="$(SolutionDir)/analysisreports" />
-        <MSBuild Projects="@(ProjectsToAnalyze)" 
-                 Targets="AnalyzeFSharpProject"
-                 Properties="CodeRoot=$(CodeRoot)" ContinueOnError="true" />
+
+        <PropertyGroup>
+            <FSharpAnalyzersOtherFlags>--analyzers-path &quot;$(PkgG-Research_FSharp_Analyzers)/analyzers/dotnet/fs&quot;</FSharpAnalyzersOtherFlags>
+            <FSharpAnalyzersOtherFlags>$(FSharpAnalyzersOtherFlags) --analyzers-path &quot;$(PkgIonide_Analyzers)/analyzers/dotnet/fs&quot;</FSharpAnalyzersOtherFlags>
+            <FSharpAnalyzersOtherFlags>$(FSharpAnalyzersOtherFlags) --verbosity d</FSharpAnalyzersOtherFlags>
+            <FSharpAnalyzersOtherFlags>$(FSharpAnalyzersOtherFlags) --code-root $(CodeRoot)</FSharpAnalyzersOtherFlags>
+            <FSharpAnalyzersOtherFlags>$(FSharpAnalyzersOtherFlags) --report &quot;$(CodeRoot)/analysis.sarif&quot;</FSharpAnalyzersOtherFlags>
+        </PropertyGroup>
+        <Delete Files="$(SolutionDir)/analysis.sarif" Condition="Exists('$(SolutionDir)/analysis.sarif')" />
+
+        <!-- Execute fsharp-analyzers with all projects in a single process -->
+        <Exec Command="dotnet fsharp-analyzers $(FSharpAnalyzersOtherFlags) @(ProjectsToAnalyze->'--project &quot;%(FullPath)&quot;', ' ')" 
+              ContinueOnError="true" />
     </Target>
 
 </Project>

build.fsx

@@ -1,9 +1,8 @@
-#r "nuget: Fun.Build, 1.0.3"
+#r "nuget: Fun.Build, 1.1.16"
 #r "nuget: CliWrap, 3.6.4"
 #r "nuget: FSharp.Data, 6.3.0"
 #r "nuget: Ionide.KeepAChangelog, 0.1.8"
 #r "nuget: Humanizer.Core, 2.14.1"
-#load "./sarif.fsx"
 
 open System
 open System.IO
@@ -502,8 +501,9 @@ pipeline "PublishAlpha" {
 
 pipeline "Analyze" {
     workingDir __SOURCE_DIRECTORY__
+    stage "RestoreTools" { run "dotnet tool restore" }
+    stage "RestoreSolution" { run "dotnet restore --tl" }
     stage "Analyze" { run "dotnet msbuild /t:AnalyzeSolution" }
-    stage "Merge" { run Sarif.mergeSarifFiles }
     runIfOnlySpecified true
 }