Enable SDL Roslyn analysis (incl. internal IA* analyzers) in the OneBranch build

Directory.Packages.props

@@ -108,6 +108,24 @@
     <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="8.0.1" />
   </ItemGroup>
 
+  <!-- ===================================================================== -->
+  <!-- Internal SDL analyzers (private ADO.Net pipelines only) -->
+  <!--
+    Microsoft.Internal.Analyzers provides the internal "IA*" SDL Roslyn rules. The package is
+    Microsoft-internal and confidential: it is restored ONLY from an internal NuGet feed, ONLY by
+    the private ADO.Net project pipelines, and ONLY when EnableAnalyzers and InternalAnalyzers are
+    both true (see the InternalAnalyzers block in src/Directory.Build.props). Public builds and
+    public CI never set those flags, so the version below is only declared for the private analysis
+    pass and is never seen by a public build.
+
+    The version is supplied by the private pipeline via the InternalAnalyzersVersion
+    property. There is intentionally NO default: the pipeline pins the exact version, and an
+    unset value fails restore rather than silently drifting.
+  -->
+  <ItemGroup Condition="'$(EnableAnalyzers)' == 'true' AND '$(InternalAnalyzers)' == 'true'">
+    <PackageVersion Include="Microsoft.Internal.Analyzers" Version="$(InternalAnalyzersVersion)" />
+  </ItemGroup>
+
   <!-- ===================================================================== -->
   <!-- SqlServer Dependencies -->
 

NuGet.analysis.config

@@ -0,0 +1,50 @@
+<?xml version="1.0" encoding="utf-8"?>
+<configuration>
+  <!-- Analysis builds select this file explicitly. Keep governed and local in sync with NuGet.config. -->
+  <packageSources>
+    <clear />
+
+    <!-- Local contains packages produced by this repository for cross-package development and CI. -->
+    <add key="local" value="packages/" />
+
+    <!-- Governed contains vetted external dependencies and published SqlClient packages. -->
+    <add key="governed" value="https://sqlclientdrivers.pkgs.visualstudio.com/public/_packaging/sqlclient/nuget/v3/index.json" />
+
+    <!-- Internal analyzers contains private Microsoft analyzer packages used only by analysis builds. -->
+    <add key="internal-analyzers" value="%INTERNAL_ANALYZERS_FEED%" />
+  </packageSources>
+  <packageSourceMapping>
+    <!-- Only packages produced by this repository may be restored from the local feed. -->
+    <packageSource key="local">
+      <package pattern="Microsoft.Data.SqlClient" />
+      <package pattern="Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider" />
+      <package pattern="Microsoft.Data.SqlClient.Extensions.Abstractions" />
+      <package pattern="Microsoft.Data.SqlClient.Extensions.Azure" />
+      <package pattern="Microsoft.Data.SqlClient.Internal.Logging" />
+      <package pattern="Microsoft.SqlServer.Server" />
+    </packageSource>
+    <!--
+      NuGet uses the most specific matching pattern to determine eligible sources. Because local
+      uses exact package IDs, governed must repeat them; otherwise those packages could only restore
+      from local and would not fall back to governed when no local artifact is available. The "*"
+      pattern makes governed eligible for every other dependency.
+    -->
+    <packageSource key="governed">
+      <package pattern="*" />
+      <package pattern="Microsoft.Data.SqlClient" />
+      <package pattern="Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider" />
+      <package pattern="Microsoft.Data.SqlClient.Extensions.Abstractions" />
+      <package pattern="Microsoft.Data.SqlClient.Extensions.Azure" />
+      <package pattern="Microsoft.Data.SqlClient.Internal.Logging" />
+      <package pattern="Microsoft.SqlServer.Server" />
+    </packageSource>
+    <!--
+      Use the Microsoft.Internal.* prefix instead of only Microsoft.Internal.Analyzers so companion
+      or transitive packages in the same internal namespace also restore from this feed. This prefix
+      is more specific than the governed/local "*" patterns, so NuGet gives it precedence.
+    -->
+    <packageSource key="internal-analyzers">
+      <package pattern="Microsoft.Internal.*" />
+    </packageSource>
+  </packageSourceMapping>
+</configuration>

NuGet.config

@@ -5,19 +5,43 @@
     <clear />
 
     <!--
-      We do not use the public nuget.org feed. Instead, we use a governed feed maintained by our
-      SqlClientDrivers ADO organization. Packages must be individually vetted and added to this
-      feed manually before they will be available for consumption by our builds.
+      Local contains packages produced by this repository. Developers and pipelines use it to test
+      packages together before they are published, such as SqlClient with a newly built Abstractions.
+    -->
+    <add key="local" value="packages/" />
+
+    <!--
+      Governed is the vetted upstream source for all external dependencies and published SqlClient
+      packages. We do not use nuget.org directly; packages must be approved and added to this feed.
 
       https://sqlclientdrivers.visualstudio.com/public/_artifacts/feed/sqlclient
     -->
     <add key="governed" value="https://sqlclientdrivers.pkgs.visualstudio.com/public/_packaging/sqlclient/nuget/v3/index.json" />
-
+  </packageSources>
+  <packageSourceMapping>
+    <!-- Only packages produced by this repository may be restored from the local feed. -->
+    <packageSource key="local">
+      <package pattern="Microsoft.Data.SqlClient" />
+      <package pattern="Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider" />
+      <package pattern="Microsoft.Data.SqlClient.Extensions.Abstractions" />
+      <package pattern="Microsoft.Data.SqlClient.Extensions.Azure" />
+      <package pattern="Microsoft.Data.SqlClient.Internal.Logging" />
+      <package pattern="Microsoft.SqlServer.Server" />
+    </packageSource>
     <!--
-      This package source is used by developers and our pipelines builds when we need to reference
-      packages that are not available on the public nuget.org feed, for example to test MDS that
-      depends on a version of Abstractions that was just built in the workspace.
+      NuGet uses the most specific matching pattern to determine eligible sources. Because local
+      uses exact package IDs, governed must repeat them; otherwise those packages could only restore
+      from local and would not fall back to governed when no local artifact is available. The "*"
+      pattern makes governed eligible for every other dependency.
     -->
-    <add key="local" value="packages/" />
-  </packageSources>
+    <packageSource key="governed">
+      <package pattern="*" />
+      <package pattern="Microsoft.Data.SqlClient" />
+      <package pattern="Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider" />
+      <package pattern="Microsoft.Data.SqlClient.Extensions.Abstractions" />
+      <package pattern="Microsoft.Data.SqlClient.Extensions.Azure" />
+      <package pattern="Microsoft.Data.SqlClient.Internal.Logging" />
+      <package pattern="Microsoft.SqlServer.Server" />
+    </packageSource>
+  </packageSourceMapping>
 </configuration>

build.proj

@@ -176,6 +176,112 @@
     -->
     <SkipDependencyPack Condition="'$(SkipDependencyPack)' == ''">false</SkipDependencyPack>
 
+    <!--
+      IsolatedBuildPath
+      Applies to:     Build* targets (driver and extension projects)
+      Description:    When set, redirects each project's binary output (bin) to an isolated
+                      location instead of the repo's artifacts/ folder, and forces a full
+                      (non-incremental) compile. This lets a build run at any time without
+                      clobbering existing real build output - for example, an analysis pass that
+                      only needs to compile the code and must not disturb a real build's output.
+
+                      * bin is redirected under "$(IsolatedBuildPath)/bin/" via ArtifactPath. Each
+                        project's OutputPath already appends a project-specific subfolder, so the
+                        projects do not collide and the real artifacts/ folder is left untouched.
+                      * The intermediate (obj) directory is intentionally left at its default,
+                        per-project location. MSBuild resolves the default relative obj/ against
+                        each project's own directory, which keeps intermediates separate for the
+                        multiple projects that make up a package (for example the ref, src, and
+                        notsupported projects of the driver). Pointing every project at a single
+                        shared obj/ under the isolated path makes those projects overwrite each
+                        other's restore assets and fail. The non-incremental switch guarantees a
+                        full recompile regardless of any pre-existing intermediate output.
+
+                      NOTE: Even though an isolated build shares the default obj/ with a prior real
+                      build, it does not perturb that real build's output. The non-incremental switch
+                      does not run Clean or delete anything; it disables the incremental/up-to-date
+                      checks and forces a full recompile so the analyzers see every source file. Real
+                      output is safe because bin is redirected to $(IsolatedBuildPath): the isolated
+                      build only ever writes to the isolated bin, never to the real artifacts/ bin.
+                      The recompile just rewrites the shared obj/ intermediates, which is harmless
+                      because nothing downstream consumes obj/.
+      Default value:  [blank] (normal artifacts/ location and incremental build are used)
+      Example:        C:\agent\_temp\isolated-build
+    -->
+    <IsolatedBuildPath Condition="'$(IsolatedBuildPath)' == ''" />
+    <IsolatedBuildArgument Condition="'$(IsolatedBuildPath)' != ''">
+      --no-incremental
+      -p:ArtifactPath="$(IsolatedBuildPath)/bin/"
+    </IsolatedBuildArgument>
+
+    <!--
+      EnableAnalyzers
+      Applies to:     Build* targets (driver and extension projects)
+      Description:    When true, turns on the full set of Roslyn analyzers for every project that is
+                      compiled and makes each project emit a per-project SARIF v1 log (see the
+                      EnableAnalyzers block in src/Directory.Build.props).
+
+                      The flag is forwarded to each project's own "dotnet build" invocation via
+                      EnableAnalyzersArgument. This forwarding is required because .NET [Roslyn]
+                      analyzers are compiler-integrated: they must run in the leaf compile, and each
+                      leaf compile is a separate "dotnet build" process that build.proj launches with
+                      an <Exec> - it does not inherit properties from this orchestrating build.
+
+                      Independent of IsolatedBuildPath. Analysis is normally run together with
+                      IsolatedBuildPath so the analyzer build does not disturb real build output, but
+                      the two properties can be set independently.
+      Default value:  false
+      Allowed values: (true|false)
+    -->
+    <EnableAnalyzers Condition="'$(EnableAnalyzers)' == ''">false</EnableAnalyzers>
+    <EnableAnalyzersArgument Condition="'$(EnableAnalyzers.ToLower())' == 'true'">
+      -p:EnableAnalyzers=true
+    </EnableAnalyzersArgument>
+
+    <!--
+      InternalAnalyzers
+      Applies to:     Build* targets (driver and extension projects)
+      Description:    When true (and EnableAnalyzers is also true), additionally runs the internal
+                      Microsoft.Internal.Analyzers ("IA*") Roslyn rules (see the InternalAnalyzers
+                      block in src/Directory.Build.props). The Microsoft.Internal.Analyzers package
+                      is Microsoft-internal and confidential, so this flag is set ONLY by the private
+                      ADO.Net project pipelines, which have access to an internal NuGet feed. The
+                      public build and public CI never set it.
+
+                      Like EnableAnalyzers, it is forwarded into each leaf "dotnet build" (it is
+                      appended to EnableAnalyzersArgument) because the analyzers are
+                      compiler-integrated and must run in the leaf compile.
+      Default value:  false
+      Allowed values: (true|false)
+    -->
+    <InternalAnalyzers Condition="'$(InternalAnalyzers)' == ''">false</InternalAnalyzers>
+    <EnableAnalyzersArgument Condition="'$(EnableAnalyzers.ToLower())' == 'true' AND '$(InternalAnalyzers.ToLower())' == 'true'">$(EnableAnalyzersArgument)
+      -p:InternalAnalyzers=true
+    </EnableAnalyzersArgument>
+
+    <!--
+      InternalAnalyzersNugetConfig
+      Applies to:     Build* targets, only when InternalAnalyzers is true
+      Description:    Path to the analysis NuGet.config that adds the internal feed hosting
+                      Microsoft.Internal.Analyzers. It is forwarded into each leaf "dotnet build"
+                      as -p:RestoreConfigFile.
+      Default value:  [blank]
+    -->
+    <EnableAnalyzersArgument Condition="'$(EnableAnalyzers.ToLower())' == 'true' AND '$(InternalAnalyzers.ToLower())' == 'true' AND '$(InternalAnalyzersNugetConfig)' != ''">$(EnableAnalyzersArgument)
+      -p:RestoreConfigFile="$(InternalAnalyzersNugetConfig)"
+    </EnableAnalyzersArgument>
+
+    <!--
+      InternalAnalyzersVersion
+      Applies to:     Build* targets, only when InternalAnalyzers is true
+      Description:    Version of the Microsoft.Internal.Analyzers package to restore. It has no
+                      default (see Directory.Packages.props); the private ADO.Net pipeline pins it.
+      Default value:  [blank]
+    -->
+    <EnableAnalyzersArgument Condition="'$(EnableAnalyzers.ToLower())' == 'true' AND '$(InternalAnalyzers.ToLower())' == 'true' AND '$(InternalAnalyzersVersion)' != ''">$(EnableAnalyzersArgument)
+      -p:InternalAnalyzersVersion=$(InternalAnalyzersVersion)
+    </EnableAnalyzersArgument>
+
     <!--
       SigningKeyPath
       Applies to:     Build*, Pack* (driver targets only)
@@ -459,6 +565,8 @@
       <DotnetCommand>
         "$(DotnetPath)dotnet" build "$(SqlClientNotSupportedProjectPath)"
         -p:Configuration=$(Configuration)
+        $(IsolatedBuildArgument)
+        $(EnableAnalyzersArgument)
         -p:GenApiPath="@(GenApiArtifactPath->'%(FullPath)')"
         $(SigningKeyPathArgument)
 
@@ -489,6 +597,8 @@
       <DotnetCommand>
         "$(DotnetPath)dotnet" build $(SqlClientRefProjectPath)
         -p:Configuration=$(Configuration)
+        $(IsolatedBuildArgument)
+        $(EnableAnalyzersArgument)
         $(SigningKeyPathArgument)
 
         <!-- Versioning arguments -->
@@ -518,6 +628,8 @@
       <DotnetCommand>
         "$(DotnetPath)dotnet" build $(SqlClientProjectPath)
         -p:Configuration=$(Configuration)
+        $(IsolatedBuildArgument)
+        $(EnableAnalyzersArgument)
         $(SigningKeyPathArgument)
 
         <!-- Versioning arguments -->
@@ -669,7 +781,7 @@
     </PropertyGroup>
     <Message Importance="High" Text=">>> Running manual tests for SqlClient"/>
     <Message Text="    Command: $(DotnetCommand)"/>
     <Exec ConsoleToMsBuild="true" Command="$(DotnetCommand)" />
   </Target>
 
   <!-- TestSqlClientUnit: Runs unit tests for SqlClient -->
@@ -698,7 +810,7 @@
     </PropertyGroup>
     <Message Importance="High" Text=">>> Running unit tests for SqlClient"/>
     <Message Text="    Command: $(DotnetCommand)"/>
     <Exec ConsoleToMsBuild="true" Command="$(DotnetCommand)" />
   </Target>
 
   <!-- ================================================================= -->
@@ -719,6 +831,8 @@
       <DotnetCommand>
         "$(DotnetPath)dotnet" build "$(AkvProviderProjectPath)"
         -p:Configuration=$(Configuration)
+        $(IsolatedBuildArgument)
+        $(EnableAnalyzersArgument)
         $(SigningKeyPathArgument)
 
         <!--Versioning arguments -->
@@ -824,6 +938,8 @@
       <DotnetCommand>
         "$(DotnetPath)dotnet" build "$(AbstractionsProjectPath)"
         -p:Configuration=$(Configuration)
+        $(IsolatedBuildArgument)
+        $(EnableAnalyzersArgument)
         $(SigningKeyPathArgument)
 
         <!-- Versioning arguments -->
@@ -927,6 +1043,8 @@
       <DotnetCommand>
         "$(DotnetPath)dotnet" build "$(AzureProjectPath)"
         -p:Configuration=$(Configuration)
+        $(IsolatedBuildArgument)
+        $(EnableAnalyzersArgument)
         $(SigningKeyPathArgument)
 
         <!-- Versioning arguments -->
@@ -1027,6 +1145,8 @@
       <DotnetCommand>
         "$(DotnetPath)dotnet" build $(LoggingProjectPath)
         -p:Configuration=$(Configuration)
+        $(IsolatedBuildArgument)
+        $(EnableAnalyzersArgument)
         $(SigningKeyPathArgument)
 
         <!-- Versioning arguments -->
@@ -1091,6 +1211,8 @@
       <DotnetCommand>
         "$(DotnetPath)dotnet" build $(SqlServerProjectPath)
         -p:Configuration=$(Configuration)
+        $(IsolatedBuildArgument)
+        $(EnableAnalyzersArgument)
         $(SigningKeyPathArgument)
 
         <!--Versioning arguments -->

eng/pipelines/common/templates/steps/override-sni-version.yml

@@ -42,6 +42,19 @@ steps:
       # add the new package source
       $packageSources.AppendChild($newSource)
 
+      # Exact mappings take precedence over the governed feed's wildcard, ensuring validation SNI
+      # packages are restored from this source. Both package IDs are externally produced and are
+      # therefore intentionally not eligible for the repository's local feed.
+      $packageSourceMapping = $xml.SelectSingleNode('//ns:packageSourceMapping', $nsm)
+      $newMapping = $xml.CreateElement("packageSource")
+      $newMapping.SetAttribute("key","SNIValidation")
+      foreach ($packageId in @("Microsoft.Data.SqlClient.SNI", "Microsoft.Data.SqlClient.SNI.runtime")) {
+        $package = $xml.CreateElement("package")
+        $package.SetAttribute("pattern", $packageId)
+        $newMapping.AppendChild($package)
+      }
+      $packageSourceMapping.AppendChild($newMapping)
+
       # save the xml file
       $xml.Save($NugetCfg)
       type $NugetCfg

eng/pipelines/onebranch/jobs/build-buildproj-job.yml

@@ -149,7 +149,9 @@ jobs:
       # such as _CheckPwshToolRestored that run during RoslynAnalyzers and Build.
       - template: /eng/pipelines/common/steps/restore-dotnet-tools.yml@self
 
-      # Perform Roslyn analysis before building, since this step will clobber build output.
+      # Run Roslyn analysis. This step is self-contained: it performs its own build into an
+      # isolated output location, so it can run at any point in the job without clobbering the
+      # real build output below.
       - template: /eng/pipelines/onebranch/steps/roslyn-analyzers-buildproj-step.yml@self
         parameters:
           dependencyArguments: $(sqlServerVersionArgument)