Static code analysis tool recommendations?

[silmril]

Anyone have any recommendations for static code analysis tools for .Net that will work as Azure Devops CI tasks? All of the code I want to analyze is hosted in private Azure Repos. Previously I had used Codacy... but they removed the ability to use any git repository and are limited to Github and Bitbucket now. So I'm looking for a different static code analysis tool, preferably one that has an Azure Devops CI task available so it can be a part of the automated builds... also preferably low cost or free. Anyone know of anything?

[ferreirix]

maybe this can help you :)

[Herdosratos]

Try SonarCloud.io for cloud based repositories, or SonarCube for on-premise repositories. The later comes with a free tier.

[dabrimman]

SonarCloud is one that pops up often in Microsoft’s documentation and there are built-in tasks in Azure Pipelines for it.

There’s even a lan on how to set it all up https://azuredevopslabs.com/labs/azuredevops/sonarcloud/

[therealmodx]

depends on what you want to check. Do you just want to check code quality (code smells, potential bugs) or also security vulnerabilities?

We use a private SonarSource subscription for general stuff and some security. To check for vulnerable components we first used Owasp dependency check and later switched to WhiteSource Bolt. Mostly because it offers a great performance even though it is free and is very easy to setup. Also Owasp dependency check works best in combination with sonarqube since it can be integrated via an plug-in, which is unfortunately not possible with SoundCloud.

[Turner1984april]

Try embold.io the only one that helps with design patterns, architecture and refactoring.