CA1416 doesn't work when Microsoft.CodeAnalysis.NetAnalyzers is referenced directly with EnableNETAnalyzers=false

[amaltinsky]

When a project has a dependency on Microsoft.CodeAnalysis.NetAnalyzers v10.0.103 and EnableNETAnalyzers is set to false, CA1416 warnings aren't being triggered when they should (reproduction code).

This didn't use to be the case with Microsoft.CodeAnalysis.NetAnalyzers v8.0.0. In fact, adding a dependency on Microsoft.CodeAnalysis.NetAnalyzers v8.0.0 used to set EnableNETAnalyzers to false to prevent collisions between the SDK's built-in analyzers and the package-provided ones.

[amaltinsky]

I believe that this should be tagged as Microsoft.CodeAnalysis.NetAnalyzers

[amaltinsky]

@jjonescz @CyrusNajmabadi @KalleOlaviNiemitalo

[jjonescz]

I believe that this should be tagged as Microsoft.CodeAnalysis.NetAnalyzers

Not sure about that, given this is about the property EnableNETAnalyzers, it might be more "SDK area" rather than "analyzers area", but added the label anyway.

[amaltinsky]

@jjonescz
Thanks for that.

I believe that the issue could be related to the packaging of Microsoft.CodeAnalysis.NetAnalyzers nuget. I further nailed down the breakage as happening between 10.0.0-preview.25380.108 (produces the warning correctly) and 10.0.100-rc.1.25451.107 (doesn't produce it anymore). The preview version has additional directories like "buildTransitive", "rulesets" and others, while the RC version does not: