Analyzer package

[justindbaur]

🎟️ Tracking

📔 Objective

This adds an analyzer and code-fixer to the main Bitwarden.Server.Sdk package for ADR26 that adds warnings for using Add(Singleton|Scoped|Transient) instead of TryAdd(Singleton|Scoped|Transient).

It also adds an analyzer and code-fixer that comes with Bitwarden.Server.Sdk.Features that adds a warning when a bad feature flag value is used. It also adds a suggestion onto all feature flag keys that helps to remove the feature flag. It attempts to automatically compact common feature flagging patterns for quick removal from the code base.

[claude]

Claude finished @justindbaur's task in 3m 20s —— View job

---

Code Review Complete

Reviewed all 37 changed files in this analyzer package PR. The implementation adds Roslyn analyzers, code fixers, and a source generator for two packages (Bitwarden.Server.Sdk.Features and Bitwarden.Server.Sdk).

No new issues found. All 4 previously identified threads are resolved — the outdated findings (unused context variable, debug message referencing wrong diagnostic ID, unformatted help URL) have been addressed in subsequent commits, and the stale syntax root finding was acknowledged by the author as acceptable.

Severity	File	Issue	Status
⚠️ Important	RemoveFeatureFlagCodeFixer.cs:129-138	Stale syntax root when references are in same document as field declaration	Resolved — author accepted
⚠️ Important	LaunchDarklyFeatureService.cs	Unused context variable	Resolved — code changed
♻️ Debt	RemoveFeatureFlagCodeFixer.cs	Debug message referenced wrong diagnostic ID	Resolved — code changed
♻️ Debt	FeatureFlagAnalyzer.cs	helpLinkUri format placeholder not applied	Resolved — code changed

Verdict: Approve — solid implementation with well-structured analyzers, comprehensive test coverage, and no blocking issues.

[github-actions]

Checkmarx One – Scan Summary & Details – 0375e8ec-4c12-4d37-9e5d-dba54999d592

Great job! No new security vulnerabilities introduced in this pull request

[codecov]

Codecov Report

❌ Patch coverage is 82.37232% with 107 lines in your changes missing coverage. Please review.
✅ Project coverage is 72.76%. Comparing base (12088ac) to head (f1cd45b).

Files with missing lines	Patch %	Lines
....Features.CodeFixers/RemoveFeatureFlagCodeFixer.cs	85.96%	20 Missing and 20 partials ⚠️
...rver.Sdk.Features.Analyzers/FeatureFlagAnalyzer.cs	73.61%	12 Missing and 7 partials ⚠️
...en.Server.Sdk.Features.Analyzers/EquatableArray.cs	19.04%	17 Missing ⚠️
...ver.Sdk.CodeFixers/DependencyInjectionCodeFixer.cs	75.00%	10 Missing and 5 partials ⚠️
...ver.Sdk.Features.Analyzers/TypeSymbolExtensions.cs	78.57%	5 Missing and 1 partial ⚠️
...erver.Sdk.Analyzers/DependencyInjectionAnalyzer.cs	86.36%	4 Missing and 2 partials ⚠️
...er.Sdk.Features.Analyzers/FlagKeyCollectionSpec.cs	93.84%	3 Missing and 1 partial ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##             main     #265      +/-   ##
==========================================
+ Coverage   67.65%   72.76%   +5.10%     
==========================================
  Files          46       55       +9     
  Lines        1141     1748     +607     
  Branches      100      196      +96     
==========================================
+ Hits          772     1272     +500     
- Misses        325      396      +71     
- Partials       44       80      +36     

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud