Get the level and category of each warning, for forwarding to external system

[KalleOlaviNiemitalo]

I'd like to collect warnings reported by the Roslyn C# compiler or analyzers, and forward them to a system that supports additional metadata for each warning:

• severity: LOW, MEDIUM, HIGH
• type: VULNERABILITY, CODE_SMELL, BUG

The C# compiler knows about levels and categories. For example, CS1573 is documented as a level 4 warning, and CA3147 is documented as being in the "Microsoft.Security" category. I could perhaps map levels to severities, and categories to types.

Can I tell the compiler to include the level and category in each warning that it writes to stderr? Alternatively, is there a file that lists the level and category of each known warning, so that I could use it to enrich the warnings after the compiler has output them?

Maybe I should have asked this in https://github.com/dotnet/roslyn/discussions/ instead. I see a "Transfer discussion" link but it does not list that as an available repository.

[333fred]

You need to have write access to the repos to transfer an issue.

As to your question, I believe what you are looking for is the errorlog csc option, which can be accessed in MSBuild with the ErrorLog property. That will allow you specify an output sarif file that will log diagnostics from the compiler.

[KalleOlaviNiemitalo]

Thanks. I imagine I can use Directory.Build.targets to assign a distinct ErrorLog path to each project in the solution.

[KalleOlaviNiemitalo]

The build system will still need to collect errors and warnings from MSBuild as well, in case tools other than the C# compiler output any. Because MSBuild also sees C# compiler warnings, the build system will have to check which of those are duplicates of the more detailed warnings in the SARIF files.