assistance with fxcop - msbuild

I am at present developing a mvc4 project that comunicates to a set of wcf services. I am setting such up in tfs build for a team of developers.
I am very much a newbie to fxcop and code analysis in general. I am currently researching it and have some questions following this:
Is it recommended to use the rules that come with fxcop?
Should it be included as a build task during builds?
What is the value from it?
Are there guidelines to what rules to abide by or is it best to go with the default?
Is it correct to run the analysis as a post build event?
I am a newbie to fxcop and would like some feedback. I am as it is integrating stylecop in to my build.

Take a look at this haacked blog post: http://haacked.com/archive/2012/07/05/turkish-i-problem-and-why-you-should-care.aspx.
I think it answers most of your questions. Some of the pointers are:
Is it recommended to use the rules that come with fxcop?
For a new project I would enable all rules, and over time disable the ones you find distracting. For an existing project, I would enable minimal rules, and over time slowly add new rules and clean up the code as required.
The code analysis rules are:
Design Warnings
Globalization Warnings
Interoperability Warnings
Maintainability Warnings
Mobility Warnings
Naming Warnings
Performance Warnings
Portability Warnings
Reliability Warnings
Security Warnings
Usage Warnings
Should it be included as a build task during builds?
Yes. This is the method I used: http://kentb.blogspot.co.nz/2011_01_01_archive.html
It can be enabled via the UI if your IDE supports it. However I had issues when different projects used different rulesets (eg, a unit test project may be more relaxed). The procedure from kentb's blog works around that issue.
Alternatively you could call FxCop directly from a post build event.
What is the value from it?
Well structured code and reduced production issues.
Are there guidelines to what rules to abide by or is it best to go with the default?
Again - go with whatever works for you. For example, you may not care that the binaries are not strongly named. The haacked blog post has some good pointers.
Is it correct to run the analysis as a post build event?
If you follow kentb's blog post, or enable it via the IDE GUI (assuming your IDE supports it), then it will be run as part of the build process. If you call FxCop directly, then it will need to be done as a post build event.

Related

ASP.NET Core front-end developer workflow with VSCode and VS 2019

I haven't done any cshtml front-end development for a few years.
What's the current, generally accepted way for ASP.NET Core front-end developers to work across a range of tools on Windows?
By that, I mean a way to have the front-end JS build and the .NET project(s) also build and to work rapidly in the browser and code.
My thinking is.
We have much better command line story around dotnet today.
Some folk like VS Code.
Some folk prefer VS 2019, and some like either, depending.
We need to work on UI aspects sometimes.
But we also need to attach a debugger and debug the server logic sometimes.
The build server should have no problem, be simple, and rely mostly on build logic held in the repo.
Tooling, and kicking off the whole build and serve process should be understandable and familiar.
It should be pretty simple to get going after a team noob clones the repo.
My initial thought would be to setup NPM then use something like Gulp to kick off everything, including running dotnet run.
Then when running under the Visual Studio 2019 debugger, use the Task Runner Explorer to kick off the Gulp stuff but skip the dotnet run part.
(shame there doesn't seem to be a command line for start VS(Code or 2019) and attach debugger)
Now I'm expecting to get a "primarily opinion based" SO beating, but there are general trends and ideas that go into designing all these tools for how they can all play ball together and what the dev story looks like.
You've pretty much already described the process. However, I'll add a few things:
You don't need the dotnet run bit. Visual Studio and VS Code are both capable of debugging directly.
You can assign the gulp tasks to build tasks in Task Runner Explorer, so you really don't even then to think about running those directly. I'm not as sure on this aspect of VS Code, but I'm sure there's probably some extension to handle it, if it's not already built-in.
If you want true ease of development, the best thing you can do is use Docker. Just add a Dockerfile to each project that actually runs (i.e. not a class library) and set up the steps to build and run it there. In Visual Studio, you can right-click the project and choose Add > Docker Support, and it will actually generate a ready-made Dockerfile, though you may need to add a step or two to handle the client-side build steps. In any case, this then becomes truly click and run, with nothing to worry about. The story is even better when you use docker-compose, as then Visual Studio and VS Code can spin up your entire application stack all at once, including external dependencies such as a database, Redis instance, etc. If you haven't used Docker before, start now. It's absolutely revolutionary for development.
One note for CI/CD, as much as possible, you should add a YAML file to describe your CI/CD pipeline. Depending on the the actual provider you're using for build/release, there might be some differences, so consult the relevant documentation. (Azure DevOps, for example, doesn't currently support describing release pipelines in yaml, though you can still do your build that way.) In any case, this allows you to configure all this in code, and have it committed to source control.
You may consider the same for your infrastructure. Azure has ARM templates, AWS has CloudFormation, GCP has Deployment Manager. There's also third-party tools like Terraform or Ansible. All of these, in some form or fashion (usually JSON or YAML) allow you to define all the characteristics of the infrastructure you're going to deploy to and commit that to source control. This makes deployment and things like creating new environments as breeze.

Fail build on static code analysis warnings with msbuild and bamboo

Using bamboo v5.7 with msbuild v12, how do I fail a build if there are any static code analysis warnings? We do have our projects all set to treat all warnings as errors so the project itself doesn't build, but bamboo is not detecting this and continues on.
This seems basic, what might I be doing wrong?
The simple answer is you are doing nothing wrong, nor are you missing anything.
While it seems like basic functionality, Bamboo's MSBuild task currently doesn't support reading, reporting or failing the build on Warnings or Errors. The task only fails because MSBuild (or XBuild if you are using Mono) returns with an error code when a compiler error occurs.
Also, MSBuild doesn't actually support failing on all warnings either, as you can see here.
You have a couple options.
You can use one of the options in the referenced post
You could roll your own MSBuild log parser plugin using Atlassian's Plugin SDK.
You could make a simple script that is executed after the build, reads the logs and returns a non-zero integer if there were compiler warnings.
You can vote for the issue in the Atlassian Jira and also for the related issue for parsing build details.
Whatever your solution, I hope you share it with the many of us that have run into the same problem. It seems to be something quite common, so I was surprised there wasn't an issue already open for this in Atlassian's Jira instance
For VS 2008 and later, a new project setting was added for this. See this link.

BundleTransformer with LESS - Decent Example Exists anywhere?

I really like the idea of this BundleTransformer plugin from NuGet, and I see that they have LESS support. But ...
After weeks of trying, I cannot find any decent example of how to use it. The documentation is unclear, to say the very least. This is the closest I could find, which does not compile or work.
who-could-ask-for-more-with-less-css
Well, the simple answer is that I could ask for more.
Can someone please assist me with the simple task of creating a bundle that has .less files in it, that will run? I am completely lost.
I would suggest reading the wiki page for bundle transformer and also, as the wiki page suggests, make sure you are familiar with ASP.NET bundling and minification.
If you follow the examples of usage you should be up and running.
I know this is an older post but figured I'd chime in. The Bundle Transformer Codeplex discussion board (Feb 2015) mentions that BundleTransformer is no longer considered a modern client-side build tool and they are recommending you go with Gulp or Grunt - which both have support starting in Visual Studio 2013.3 via VSIX extensions and more baked in to VS2014. FYI -This Scott Hanselman post explains how to get up and going with Grunt and Gulp in Visual Studio. I think if you're using BundleTransformer for simple Less compilation it works fine, but doesn't allow you to do things like generate CSS Sourcemaps which make your browser's dev tools aware of the Less source files, which in my humble opinion is critical for using a CSS preprocessor - the ability to see the LESS line numbers of your source files in the styles pane.

Build publisher policy assembly as part of an automated build

Has anyone solved the problem of automatically building publisher policy assemblies as part of an automated build? I've trawled the web and there are plenty of people asking about this but no solutions.
Constructing policy assemblies is hugely error prone when done manually and in any case needs to be part of the continuous integration build that we run in TeamCity.
I'm hoping specifically for a solution that uses MSBuild and can run on TeamCity, but I can interpolate from other solutions if necessary. Surely, someone MUST have done this?

What build tool do you use professionally?

At home, I use CTRL+SHIFT+B or F7 or whatever key sequence initiates the build for my build tool. At work, this doesn't quite cut it.
At my first job (an internship) we used a product called Visual Build, which I have come to like very much. It's the best build tool I've ever worked with. The down side here is that it's not free.
At my latest job, I came in knowing literally nothing about Ant. Now, unfortunately, I've become deeply involved in our build processes, and cannot extricate myself. It works, yes, but after coming from Visual build, it seems like it's fighting me every step of the way. Yes, it's free, but we're not trying to be a free-software-only development company or anything.
I've never looked in to make or any other build tools, so I don't really know what else is out there.
Has anybody ever seen or had experience with Visual Build? Mostly I'm fond of a few key things:
it has a GUI
it runs arbitrary VBScript without the need of a compiled class
you can step through the build process, or start from anywhere in the middle.
Are there any free build tools that have this? Is there any way to convince people that it's worth it to move on? It's 2008. We use IDEs to develop, why not (IBEs) to build?
Edit: I'm mostly looking for an answer to my last questions; Is there a solution with a built-in GUI that I can use for free?
Not very sophisticated, but we use a set of batch files. And that works great.
We use FinalBuilder - I think it's very similar to VisualBuild, though I've not used the latter.
It does run from the command line, and you can integrate it with CC.Net if you want.
For Java projects we use Teamcity, sort of cruise control like, but you can also do a remote run, i.e. you send your changes to the server, it builds and does unit tests, if everything works ok, THEN you checkin, very nice build tool and free for up to 20 build configurations.
For our Visual Studio 2005 projects including packaging the final exes and dlls with InstallShield and putting them up on a shared server we use Final Builder, it's not free, but it is very easy to use and get started with.
We also telnet out (from FinalBuilder) to a number of other platforms (Unix/Linux/OpenVMS) and start remote builds by running makefiles there.
We do not use continous build, but there is a FinalBuilder Server which handles that and comes free with the FinalBuilder Professional license.
We are very happy with FinalBuilder, it's quite easy to get up to speed with and powerful enough to solve most problems.
CMake. Generates build file for KDevelop, Eclipse, Makefiles and Visual Studio (and XCode), and it really works. You can easily extend it with macros, although the programming capabilities are rather limited. It's easy to learn, and porting an existing application from Visual Studio to it is pretty easy. However, you are limited to C++/C and IIRC Fortran code.
KDE is also using CMake now, so it seems to scale very well (i.e. generation time for the projects/dependency checking is not too bad).
I am not sure this is exactly what you are looking for, but I LOVE CruiseControl.NET. I have it build my projects using the MSBuild task. It doesn't have a GUI exactly, but there is a web interface to view the results of your builds and a System Tray resident program which will alert you of the build status.
UppercuT. It's free.
UppercuT uses NAnt to build and it is the insanely easy to use Build Framework.
Automated Builds as easy as (1) solution name, (2) source control path, (3) company name for most projects!!!
http://code.google.com/p/uppercut/
Some good explanations here: UppercuT
Going back to the keystrokes thing for a sec, I found Hoekey which the CTO loves. I don't use it myself, but as a way of assign keystrokes to things, it's pretty good.
I know nothing of Visual Build, but from your description it sounds like it is tied to Windows and doesn't run from the command line.
If you are building Java software (I assume you are since you are using Ant), it's preferable to have a cross-platform tool. If you can run the tool from the command-line, then it is scriptable which is extremely important for automation.
Ant is also extensible and a de facto standard. Many tools that you may use (Cobertura, TestNG, etc.) provide Ant tasks so that they can easily be intergrated with your build.
I use Ant for all Java projects. Some people prefer Maven, but I'm not one of them. Ant is far from perfect (the XML syntax is a bit clunky) but it is well documented, extremely stable and pretty straightforward.
If you use a standard tool, such as Ant or Maven, you will be able to take advantage of any number of Continuous Integration products. I doubt you will find many that work with Visual Build.
Most IDEs support Ant, so they give you a GUI of sorts and your CI server will give you a web interface for doing builds.
NAnt (.NET port of Ant). Works great and is easily extensible.
For small projects I do use post-build scripts and with the support of 7z, Nsis and similar CLI tools it's doing the job perfectly for me.
TeamCity and CuriseControl works well for any projects,but here is why you would like to choose TeamCity:-
Ease of setup: During setup we found TeamCity easier to setup and use especially compared to CruiseControl. We did not need to edit XML files or massively configure individual build machines like CruiseControl.
Ease of extensibility:TeamCity stands out in its ease of extensibility too. If we find that builds are waiting in the queue too long, we can add more computers as agents. The only additional work on our end is registering the new computers with the TeamCity server and installing msbuild and subversion.
Interaction with Subversion: One can check how many and what changes were committed to subversion since the last build, who started a build etc.
I've grown very fond of scons for building C++ files. It's very straightforward and the build scripts are written in Python (which is much better than some hacked together DSL IMO).
Ant or Maven are great little build tools.
And if you want to automate the build process there are some great tools like TeamCity and Bamboo.
Personally I use Makefiles for pretty much everything because they are simple as hell. But in my work, I'm forced to use ant.
The main problem I have against ant is that XML makes it hard to read and understand, even with the correct indentation. On the other hand, the verbosity of XML can help when reading someone else's ant file, but still makes it a PITA when the file is more than a few tens of lines.
As for having a GUI to build... I've always felt that's a minus rather than a plus.
Maven is the best for me because it handles the project dependencies