The Microsoft Build Engine (MSBuild) is the build platform for .NET and Visual Studio.
This report summarizes scanner evidence for dotnet/msbuild, a C# project with 5,551 GitHub stars. SynthScan examined 767,770 lines of code across 2782 source files, recording 3316 pattern matches distributed across 16 syntactic categories. The legacy adjusted pattern signal is 4.6 (Low pattern signal); it is not an authorship estimate.
Use the findings to ask whether maintainers can explain intent, verify dependencies, simplify unnecessary scaffolding, and focus review effort. Risk Payload v1 adds ownership, supply-chain, over-engineering, and review-effort vectors when available. These are prompts for human verification, not probabilities, security findings, or measured maintenance costs.
Use each vector to guide manual verification of the underlying findings.
Can maintainers explain intent, assumptions, and trade-offs? 3237 finding(s).
Are imports declared and package/API names verified? 6 finding(s).
Are wrappers, guards, and repeated structures necessary? 76 finding(s).
Which changes need focused human review? 3316 finding(s).
This chart tracks the legacy adjusted pattern score across scan runs. Changes can reflect source changes, scan coverage, or detector/scoring versions; they do not measure AI adoption or prove that a team refactored code. Compare runs only when their scoring versions are compatible. The dashed line tracks the raw pattern-hit count.
Groups findings by configured severity weight. Severity is not a confidence estimate, security rating, or proof that a package is missing. Verify imports against the project's manifests and inspect each finding in its local design context.
This horizontal bar chart shows where configured pattern scores accumulate across directories. Treat the bars as locations to inspect, not as evidence of authorship or code quality. Use the file-level findings to decide whether a directory needs a focused ownership, dependency, complexity, or review check.
The scanner identified 3316 distinct pattern matches across 16 syntactic categories. Each entry below represents a discrete location in the source code where the engine recorded a detector match to inspect in context. Expand any category row to inspect the individual file paths, line numbers, code snippets, and the lexical context (CODE, COMMENT, or STRING) in which each match was detected.
Reading the findings table: The Severity column indicates the configured finding weight (CRITICAL / HIGH / MEDIUM / LOW). The Context column identifies whether the match occurred inside executable code, an inline comment, or a string literal — legacy comment-context matches receive a ×1.5 score weight. The ⚡ bolt icon marks clustered matches: three or more patterns within a 10-line window, each receiving an additional ×1.5 density multiplier under the legacy scoring model.
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | .vsts-dotnet-ci.yml | 41 | arguments: -ConfigFile $(Build.SourcesDirectory)/NuGet.config -Password $Env:Token | COMMENT |
| LOW | .vsts-dotnet-ci.yml | 161 | env: | COMMENT |
| LOW | .vsts-dotnet-ci.yml | 281 | # - task: PowerShell@2 | COMMENT |
| LOW | .vsts-dotnet-ci.yml | 541 | # targetPath: '$(Build.SourcesDirectory)/artifacts/TestResults/CoverageResults/WindowsFullFramework' | COMMENT |
| LOW | eng/common/SetupNugetSources.sh | 1 | #!/usr/bin/env bash | COMMENT |
| LOW | eng/common/vmr-sync.sh | 1 | #!/bin/bash | COMMENT |
| LOW | eng/common/vmr-sync.sh | 21 | ### | COMMENT |
| LOW | eng/common/native/init-distro-rid.sh | 1 | #!/bin/sh | COMMENT |
| LOW | eng/common/native/init-distro-rid.sh | 61 | COMMENT | |
| LOW | …common/templates-official/variables/pool-providers.yml | 1 | # Select a pool provider based off branch name. Anything with branch name containing 'release' must go into an -Svc pool | COMMENT |
| LOW | eng/common/templates/vmr-build-pr.yml | 1 | # This pipeline is used for running the VMR verification of the PR changes in repo-level PRs. | COMMENT |
| LOW | eng/common/templates/variables/pool-providers.yml | 1 | # Select a pool provider based off branch name. Anything with branch name containing 'release' must go into an -Svc pool | COMMENT |
| LOW | eng/common/core-templates/stages/renovate.yml | 1 | # -------------------------------------------------------------------------------------- | COMMENT |
| LOW | …g/common/core-templates/steps/get-github-app-token.yml | 1 | # Mints a short-lived GitHub App installation access token by signing a JWT | COMMENT |
| LOW | eng/common/core-templates/steps/install-microbuild.yml | 1 | parameters: | COMMENT |
| LOW | eng/common/core-templates/job/renovate.yml | 1 | # -------------------------------------------------------------------------------------- | COMMENT |
| LOW | eng/common/core-templates/job/source-build.yml | 1 | parameters: | COMMENT |
| LOW | eng/common/core-templates/job/source-build.yml | 21 | # published by source-build. | COMMENT |
| LOW | documentation/specs/BuildCheck/BuildCheck.md | 261 | /// </summary> | COMMENT |
| LOW | documentation/specs/BuildCheck/BuildCheck.md | 341 | /// the current project, or from some import. If supported it can help tuning the level of detail or noise from che | COMMENT |
| LOW | documentation/wiki/Binary-Log.md | 421 | public sealed class BinaryLogReaderErrorEventArgs : EventArgs | COMMENT |
| LOW | azure-pipelines/quarantine.yml | 1 | # Quarantined-test re-validation pipeline. | COMMENT |
| LOW | azure-pipelines/cts-collect.yml | 1 | # azure-pipelines/cts-collect.yml | COMMENT |
| LOW | azure-pipelines/cts-apply.yml | 1 | # azure-pipelines/cts-apply.yml | COMMENT |
| LOW | azure-pipelines/cts-apply.yml | 21 | # | COMMENT |
| LOW | azure-pipelines/cts-apply.yml | 41 | # job goes wrong — that is fine for the *pipeline* result, but it | COMMENT |
| LOW | azure-pipelines/cts-apply.yml | 61 | exclude: | COMMENT |
| LOW | azure-pipelines/cts-apply.yml | 81 | default: https://devdiv.pkgs.visualstudio.com/_packaging/VS/nuget/v3/index.json | COMMENT |
| LOW | azure-pipelines/cts-steps/collect-steps.yml | 1 | # azure-pipelines/cts-steps/collect-steps.yml | COMMENT |
| LOW | azure-pipelines/cts-steps/collect-steps.yml | 181 | Write-Host "##vso[task.setvariable variable=CtsBaselineProduced]$produced" | COMMENT |
| LOW | azure-pipelines/cts-steps/collect-steps.yml | 201 | # implicit non-zero from cts. | COMMENT |
| LOW | azure-pipelines/cts-steps/apply-steps.yml | 1 | # azure-pipelines/cts-steps/apply-steps.yml | COMMENT |
| LOW | .github/workflows/review.agent.lock.yml | 1 | # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"9810f054f46aa011ec93d1c816f2fdfc23cc866201067abb95755471df9 | COMMENT |
| LOW | .github/workflows/review.agent.lock.yml | 21 | # gh aw compile | COMMENT |
| LOW | .github/workflows/review.agent.lock.yml | 41 | # - COPILOT_PAT_7 | COMMENT |
| LOW | .github/workflows/review-on-open.agent.lock.yml | 1 | # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"efdcc2c986f14cd241ed3dfb2f4ac3ba7d17ee8a796ae8e54586e8c0922 | COMMENT |
| LOW | .github/workflows/review-on-open.agent.lock.yml | 21 | # gh aw compile | COMMENT |
| LOW | .github/workflows/review-on-open.agent.lock.yml | 41 | # - COPILOT_PAT_7 | COMMENT |
| LOW | .github/workflows/dreaming.agent.lock.yml | 1 | # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"09b5bed382ee7c17de4e5545a1a393b8621554a64bc4b59e2196317addc | COMMENT |
| LOW | .github/workflows/dreaming.agent.lock.yml | 21 | # gh aw compile | COMMENT |
| LOW | .github/workflows/dreaming.agent.lock.yml | 41 | # - COPILOT_PAT_8 | COMMENT |
| LOW | .github/workflows/flaky-test-fixer.agent.lock.yml | 1 | # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"b6cd645c78c763ff04f73546e189d42eeb775a10ae42c6c4a0d6551abf2 | COMMENT |
| LOW | .github/workflows/flaky-test-fixer.agent.lock.yml | 21 | # gh aw compile | COMMENT |
| LOW | .github/workflows/flaky-test-fixer.agent.lock.yml | 41 | # - COPILOT_PAT_8 | COMMENT |
| LOW | .github/workflows/labeler-predict-pulls.yml | 1 | # Workflow template imported and updated from: | COMMENT |
| LOW | .github/workflows/flaky-test-detector.agent.md | 61 | max: 1 | COMMENT |
| LOW | .github/workflows/flaky-test-detector.agent.lock.yml | 1 | # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"7148393ef41f0ad490985f493b5dde708317c56b83b1159624f8e8df549 | COMMENT |
| LOW | .github/workflows/flaky-test-detector.agent.lock.yml | 21 | # gh aw compile | COMMENT |
| LOW | .github/workflows/flaky-test-detector.agent.lock.yml | 41 | # - COPILOT_PAT_8 | COMMENT |
| LOW | .github/workflows/dreaming.agent.md | 41 | # ATOMIC, independently-reviewable PR (each on its own branch) instead of one mixed bag. If everything | COMMENT |
| LOW | .github/workflows/dreaming.agent.md | 61 | # approval before it can merge, so human review is preserved at the PR gate. | COMMENT |
| LOW | .github/workflows/flaky-test-fixer.agent.md | 61 | # several create_pull_request outputs in one run, each captured as its own branch/bundle. | COMMENT |
| LOW | .github/workflows/close-stale-prs.agent.lock.yml | 1 | # gh-aw-metadata: {"schema_version":"v4","frontmatter_hash":"5ca7adafe4941b87d64a84b28f6fc6574843a258f096e669cce8f8025b9 | COMMENT |
| LOW | .github/workflows/close-stale-prs.agent.lock.yml | 21 | # gh aw compile | COMMENT |
| LOW | .github/workflows/close-stale-prs.agent.lock.yml | 41 | # - COPILOT_PAT_8 | COMMENT |
| LOW | src/GlobalUsings.cs | 1 | // Licensed to the .NET Foundation under one or more agreements. | COMMENT |
| LOW | src/MSBuild/MSBuildClientApp.cs | 21 | /// 2. establishes a connection with MSBuild server and sends a build request. | COMMENT |
| LOW | src/MSBuild/InitializationException.cs | 21 | /// </summary> | COMMENT |
| LOW | src/MSBuild/InitializationException.cs | 101 | COMMENT | |
| LOW | src/MSBuild/ProjectSchemaValidationHandler.cs | 21 | { | COMMENT |
| 3070 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM⚡ | eng/common/core-templates/stages/renovate.yml | 1 | # -------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | eng/common/core-templates/stages/renovate.yml | 3 | # -------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | eng/common/core-templates/stages/renovate.yml | 9 | # -------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | eng/common/core-templates/job/renovate.yml | 1 | # -------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | eng/common/core-templates/job/renovate.yml | 3 | # -------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM⚡ | eng/common/core-templates/job/renovate.yml | 17 | # -------------------------------------------------------------------------------------- | COMMENT |
| MEDIUM | azure-pipelines/cts-collect.yml | 17 | # ============================================================ | COMMENT |
| MEDIUM | azure-pipelines/cts-collect.yml | 22 | # ============================================================ | COMMENT |
| MEDIUM | azure-pipelines/cts-apply.yml | 22 | # ============================================================ | COMMENT |
| MEDIUM | azure-pipelines/cts-apply.yml | 27 | # ============================================================ | COMMENT |
| MEDIUM | .github/workflows/skill-validation.yml | 40 | # ── Determine changed skills/agents (PRs only) ─────────────── | COMMENT |
| MEDIUM | .github/workflows/skill-validation.yml | 80 | # ── Filter to only changed skills/agents (PRs only) ────────── | COMMENT |
| MEDIUM | .github/workflows/skill-validation.yml | 114 | # ── Download & cache skill-validator ────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/skill-validation.yml | 149 | # ── Run skill-validator check ───────────────────────────────── | COMMENT |
| MEDIUM | .github/workflows/skill-validation.yml | 206 | # ── Upload results for the commenting workflow ──────────────── | COMMENT |
| MEDIUM | .github/workflows/validate-pat-pool.yml | 37 | # ----------------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/validate-pat-pool.yml | 41 | # ----------------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/validate-pat-pool.yml | 143 | # ----------------------------------------------------------- | COMMENT |
| MEDIUM | .github/workflows/validate-pat-pool.yml | 145 | # ----------------------------------------------------------- | COMMENT |
| MEDIUM | …d.UnitTests/BackEnd/TaskParameterTypeVerifier_Tests.cs | 343 | // ─── ITaskItem<T> and ITaskItem<T>[] coverage ───────────────────────── | COMMENT |
| MEDIUM | …TaskAnalyzer.Tests/MultiThreadableTaskAnalyzerTests.cs | 24 | // ═══════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | …TaskAnalyzer.Tests/MultiThreadableTaskAnalyzerTests.cs | 26 | // ═══════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | …TaskAnalyzer.Tests/MultiThreadableTaskAnalyzerTests.cs | 262 | // ═══════════════════════════════════════════════════════════════════════ | STRING |
| MEDIUM | …TaskAnalyzer.Tests/MultiThreadableTaskAnalyzerTests.cs | 264 | // ═══════════════════════════════════════════════════════════════════════ | STRING |
| MEDIUM | …TaskAnalyzer.Tests/MultiThreadableTaskAnalyzerTests.cs | 350 | // ═══════════════════════════════════════════════════════════════════════ | STRING |
| MEDIUM | …TaskAnalyzer.Tests/MultiThreadableTaskAnalyzerTests.cs | 352 | // ═══════════════════════════════════════════════════════════════════════ | STRING |
| MEDIUM | …TaskAnalyzer.Tests/MultiThreadableTaskAnalyzerTests.cs | 417 | // ═══════════════════════════════════════════════════════════════════════ | STRING |
| MEDIUM | …TaskAnalyzer.Tests/MultiThreadableTaskAnalyzerTests.cs | 419 | // ═══════════════════════════════════════════════════════════════════════ | STRING |
| MEDIUM | …TaskAnalyzer.Tests/MultiThreadableTaskAnalyzerTests.cs | 536 | // ═══════════════════════════════════════════════════════════════════════ | STRING |
| MEDIUM | …TaskAnalyzer.Tests/MultiThreadableTaskAnalyzerTests.cs | 538 | // ═══════════════════════════════════════════════════════════════════════ | STRING |
| MEDIUM | …TaskAnalyzer.Tests/MultiThreadableTaskAnalyzerTests.cs | 913 | // ═══════════════════════════════════════════════════════════════════════ | STRING |
| MEDIUM | …TaskAnalyzer.Tests/MultiThreadableTaskAnalyzerTests.cs | 915 | // ═══════════════════════════════════════════════════════════════════════ | STRING |
| MEDIUM | …TaskAnalyzer.Tests/MultiThreadableTaskAnalyzerTests.cs | 953 | // ═══════════════════════════════════════════════════════════════════════ | STRING |
| MEDIUM | …TaskAnalyzer.Tests/MultiThreadableTaskAnalyzerTests.cs | 955 | // ═══════════════════════════════════════════════════════════════════════ | STRING |
| MEDIUM | …TaskAnalyzer.Tests/MultiThreadableTaskAnalyzerTests.cs | 978 | // ═══════════════════════════════════════════════════════════════════════ | STRING |
| MEDIUM | …TaskAnalyzer.Tests/MultiThreadableTaskAnalyzerTests.cs | 980 | // ═══════════════════════════════════════════════════════════════════════ | STRING |
| MEDIUM | …TaskAnalyzer.Tests/MultiThreadableTaskAnalyzerTests.cs | 1393 | // ═══════════════════════════════════════════════════════════════════════ | STRING |
| MEDIUM | …TaskAnalyzer.Tests/MultiThreadableTaskAnalyzerTests.cs | 1395 | // ═══════════════════════════════════════════════════════════════════════ | STRING |
| MEDIUM | …TaskAnalyzer.Tests/MultiThreadableTaskAnalyzerTests.cs | 1669 | // ═══════════════════════════════════════════════════════════════════════ | STRING |
| MEDIUM | …TaskAnalyzer.Tests/MultiThreadableTaskAnalyzerTests.cs | 1671 | // ═══════════════════════════════════════════════════════════════════════ | STRING |
| MEDIUM | …TaskAnalyzer.Tests/MultiThreadableTaskAnalyzerTests.cs | 1761 | // ═══════════════════════════════════════════════════════════════════════ | STRING |
| MEDIUM | …TaskAnalyzer.Tests/MultiThreadableTaskAnalyzerTests.cs | 1763 | // ═══════════════════════════════════════════════════════════════════════ | STRING |
| MEDIUM | …TaskAnalyzer.Tests/MultiThreadableTaskAnalyzerTests.cs | 1832 | // ═══════════════════════════════════════════════════════════════════════ | STRING |
| MEDIUM | …TaskAnalyzer.Tests/MultiThreadableTaskAnalyzerTests.cs | 1834 | // ═══════════════════════════════════════════════════════════════════════ | STRING |
| MEDIUM | …TaskAnalyzer.Tests/MultiThreadableTaskAnalyzerTests.cs | 2051 | // ═══════════════════════════════════════════════════════════════════════ | STRING |
| MEDIUM | …TaskAnalyzer.Tests/MultiThreadableTaskAnalyzerTests.cs | 2053 | // ═══════════════════════════════════════════════════════════════════════ | STRING |
| MEDIUM | …TaskAnalyzer.Tests/MultiThreadableTaskAnalyzerTests.cs | 2319 | // ═══════════════════════════════════════════════════════════════════════ | STRING |
| MEDIUM | …TaskAnalyzer.Tests/MultiThreadableTaskAnalyzerTests.cs | 2321 | // ═══════════════════════════════════════════════════════════════════════ | STRING |
| MEDIUM | …Analyzer.Tests/UnsupportedTaskItemTypeAnalyzerTests.cs | 117 | // ═══════════════════════════════════════════════════════════════════════ | STRING |
| MEDIUM | …Analyzer.Tests/UnsupportedTaskItemTypeAnalyzerTests.cs | 119 | // ═══════════════════════════════════════════════════════════════════════ | STRING |
| MEDIUM | …Analyzer.Tests/UnsupportedTaskItemTypeAnalyzerTests.cs | 189 | // ═══════════════════════════════════════════════════════════════════════ | STRING |
| MEDIUM | …Analyzer.Tests/UnsupportedTaskItemTypeAnalyzerTests.cs | 191 | // ═══════════════════════════════════════════════════════════════════════ | STRING |
| MEDIUM | …Analyzer.Tests/UnsupportedTaskItemTypeAnalyzerTests.cs | 366 | // ═══════════════════════════════════════════════════════════════════════ | STRING |
| MEDIUM | …Analyzer.Tests/UnsupportedTaskItemTypeAnalyzerTests.cs | 368 | // ═══════════════════════════════════════════════════════════════════════ | STRING |
| MEDIUM | …Analyzer.Tests/UnsupportedTaskItemTypeAnalyzerTests.cs | 387 | // ═══════════════════════════════════════════════════════════════════════ | STRING |
| MEDIUM | …Analyzer.Tests/UnsupportedTaskItemTypeAnalyzerTests.cs | 389 | // ═══════════════════════════════════════════════════════════════════════ | STRING |
| MEDIUM | …askAnalyzer.Tests/PreferTypedParameterAnalyzerTests.cs | 17 | // ═══════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | …askAnalyzer.Tests/PreferTypedParameterAnalyzerTests.cs | 19 | // ═══════════════════════════════════════════════════════════════════════ | COMMENT |
| MEDIUM | …askAnalyzer.Tests/PreferTypedParameterAnalyzerTests.cs | 351 | // ═══════════════════════════════════════════════════════════════════════ | STRING |
| MEDIUM | …askAnalyzer.Tests/PreferTypedParameterAnalyzerTests.cs | 353 | // ═══════════════════════════════════════════════════════════════════════ | STRING |
| 8 more matches not shown… | ||||
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …ssets/Net35WinFormsApp/Properties/Settings.Designer.cs | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …sets/Net35WinFormsApp/Properties/Resources.Designer.cs | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | src/Tasks.UnitTests/Copy_Tests.cs | 3149 | /// First copy fails as requested, subsequent copies succeed. | COMMENT |
| HIGH | …oslynCodeTaskFactory_Tests.CSharpFragment.verified.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …y_Tests.VisualBasicFragmentWithProperties.verified.txt | 3 | ' This code was generated by a tool. | CODE |
| HIGH | …ry_Tests.CSharpFragmentSourceCodeFromFile.verified.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …tory_Tests.CSharpMethodSourceCodeFromFile.verified.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …CodeTaskFactory_Tests.VisualBasicFragment.verified.txt | 3 | ' This code was generated by a tool. | CODE |
| HIGH | …actory_Tests.CSharpFragmentWithProperties.verified.txt | 3 | // This code was generated by a tool. | COMMENT |
| HIGH | …ynCodeTaskFactory_Tests.VisualBasicMethod.verified.txt | 3 | ' This code was generated by a tool. | CODE |
| HIGH | …/RoslynCodeTaskFactory_Tests.CSharpMethod.verified.txt | 3 | // This code was generated by a tool. | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| CRITICAL | …c/Build.UnitTests/BuildEventArgsSerialization_Tests.cs | 767 | e => e.TracingData.InfrastructureTracingData.Keys.Count.ToString(), | CODE |
| CRITICAL | …ild.OM.UnitTests/Definition/DefinitionEditing_Tests.cs | 1740 | metadatum.Xml.Parent.Parent.Parent.RemoveAllChildren(); | CODE |
| CRITICAL | src/Tasks.UnitTests/CodeTaskFactoryTests.cs | 1587 | string output = Microsoft.Build.UnitTests.Shared.RunnerUtilities.ExecMSBuild( | STRING |
| CRITICAL | …tTests/AssemblyDependency/AssemblyInformation_Tests.cs | 46 | /// <see cref="Windows.Win32.System.Com.ComClassFactory.TryCreateFromModule(string, System.Guid, string, out Wind | COMMENT |
| CRITICAL | …tTests/AssemblyDependency/AssemblyInformation_Tests.cs | 300 | /// <see cref="Windows.Win32.System.Com.ComClassFactory.TryCreateFromModule(string, System.Guid, string, out Wi | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | …migration/skills/multithreaded-task-migration/SKILL.md | 12 | ### Step 1: Update Task Class Declaration | COMMENT |
| LOW | …migration/skills/multithreaded-task-migration/SKILL.md | 28 | ### Step 2: Absolutize Paths Before File Operations | COMMENT |
| LOW | …migration/skills/multithreaded-task-migration/SKILL.md | 48 | ### Step 3: Replace Environment Variable APIs | COMMENT |
| LOW | …migration/skills/multithreaded-task-migration/SKILL.md | 55 | ### Step 4: Replace Process Start APIs | COMMENT |
| LOW | .github/skills/dotnet-aot-compat/SKILL.md | 63 | ### Step 1: Enable AOT analysis in the .csproj | COMMENT |
| LOW | .github/skills/dotnet-aot-compat/SKILL.md | 75 | ### Step 2: Build and collect warnings | COMMENT |
| LOW | .github/skills/dotnet-aot-compat/SKILL.md | 93 | ### Step 3: Triage warnings by code (do NOT read every file) | COMMENT |
| LOW | .github/skills/dotnet-aot-compat/SKILL.md | 105 | ### Step 4: Fix warnings iteratively (innermost first) | COMMENT |
| LOW | .github/skills/dotnet-aot-compat/SKILL.md | 205 | ### Step 5: Rebuild and repeat | COMMENT |
| LOW | .github/skills/dotnet-aot-compat/SKILL.md | 209 | ### Step 6: Validate all TFMs | COMMENT |
| LOW | .github/skills/use-bootstrap-msbuild/SKILL.md | 14 | ## Step 1: Build MSBuild with Bootstrap | COMMENT |
| LOW | .github/skills/use-bootstrap-msbuild/SKILL.md | 30 | ## Step 2: Run Your Repro Project | COMMENT |
| LOW | .github/skills/deploy-msbuild-to-vs/SKILL.md | 27 | ## Step 1: Build MSBuild | COMMENT |
| LOW | .github/skills/deploy-msbuild-to-vs/SKILL.md | 43 | ## Step 2: Locate Your VS MSBuild Bin Folder | COMMENT |
| LOW | .github/skills/deploy-msbuild-to-vs/SKILL.md | 85 | ## Step 3: Deploy with the Script | COMMENT |
| LOW | .github/skills/deploy-msbuild-to-vs/SKILL.md | 112 | ## Step 4: Test in Visual Studio | COMMENT |
| LOW | .github/skills/merge-dependency-updates/SKILL.md | 27 | ### Step 1: Gather All Bot PRs | COMMENT |
| LOW | .github/skills/merge-dependency-updates/SKILL.md | 41 | ### Step 2: Analyze Each PR (in parallel) | COMMENT |
| LOW | .github/skills/merge-dependency-updates/SKILL.md | 106 | ### Step 3: Update Branches & Bump Versions (dependency PRs only) | COMMENT |
| LOW | .github/skills/merge-dependency-updates/SKILL.md | 142 | ### Step 4: Produce the Dashboard | COMMENT |
| LOW⚡ | .github/skills/changewaves/SKILL.md | 37 | ## Step 1: Determine the Correct Wave Version | COMMENT |
| LOW⚡ | .github/skills/changewaves/SKILL.md | 41 | ## Step 2: Condition Your Feature on the Wave | COMMENT |
| LOW⚡ | .github/skills/changewaves/SKILL.md | 45 | ## Step 3: Write Tests | COMMENT |
| LOW⚡ | .github/skills/changewaves/SKILL.md | 49 | ## Step 4: Document the Feature | COMMENT |
| LOW | .github/skills/pipelines-health-check/SKILL.md | 66 | ### Step 1: Run all data collection scripts | COMMENT |
| LOW | .github/skills/pipelines-health-check/SKILL.md | 85 | ### Step 2: Present the overview table IMMEDIATELY | COMMENT |
| LOW | .github/skills/pipelines-health-check/SKILL.md | 169 | ### Step 3: Identify problems | COMMENT |
| LOW | src/Tasks/CallTarget.cs | 17 | /// NOTE: This class is not the implementation that actually runs at build time. The MSBuild engine | COMMENT |
| LOW⚡ | src/Utilities/ToolTask.cs | 1115 | // Step 1: Wait for the process handle to be signaled. | COMMENT |
| LOW⚡ | src/Utilities/ToolTask.cs | 1120 | // Step 2: Wait for the AsyncStreamReader to deliver all remaining data. | COMMENT |
| LOW | …s.UnitTests/ResourceHandling/GenerateResource_Tests.cs | 1112 | // Step 1: create a resx file directly from the resources, to get a framework generated resx | COMMENT |
| LOW | …ts/ResourceHandling/GenerateResourceOutOfProc_Tests.cs | 742 | // Step 1: create a resx file directly from the resources, to get a framework generated resx | COMMENT |
| LOW | src/Build/Logging/ConsoleLogger.cs | 298 | /// NOTE: This method was public by accident in Whidbey, so it cannot be made internal now. It has | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | eng/common/cross/install-debs.py | 126 | # keyboxd, which makes it robust on hosts running GnuPG 2.4+ (e.g. Azure | COMMENT |
| LOW | …ommon/core-templates/steps/enable-internal-sources.yml | 34 | # If running on dnceng (internal project), just use the default behavior for NuGetAuthenticate. | COMMENT |
| MEDIUM | src/MSBuild/XMake.cs | 380 | /// Returns true if arguments allows or make sense to leverage msbuild server. | COMMENT |
| MEDIUM | src/Tasks/ManifestUtil/TrustInfo.cs | 210 | // If you want to utilize File and Registry Virtualization for backward compatibility | COMMENT |
| MEDIUM | …Build.UnitTests/BackEnd/TaskRouter_IntegrationTests.cs | 576 | /// Provides robust assertions that are less fragile than raw log string matching. | COMMENT |
| MEDIUM | src/Build.UnitTests/BackEnd/BuildManager_Tests.cs | 4115 | /// not reload it from disk but instead fully utilize the entire translate project instance state | STRING |
| MEDIUM | src/Tasks.UnitTests/XamlTestHelpers.cs | 23 | // make as robust as possible | COMMENT |
| MEDIUM | …itTests/AssemblyDependency/GlobalAssemblyCacheTests.cs | 75 | /// Essentially specific version for the gac resolver means do not filter by runtime. | COMMENT |
| MEDIUM | …itTests/AssemblyDependency/GlobalAssemblyCacheTests.cs | 98 | /// Essentially specific version for the gac resolver means do not filter by runtime. | COMMENT |
| MEDIUM | …itTests/AssemblyDependency/GlobalAssemblyCacheTests.cs | 145 | /// Essentially specific version for the gac resolver means do not filter by runtime. | COMMENT |
| MEDIUM | …itTests/AssemblyDependency/GlobalAssemblyCacheTests.cs | 166 | /// Essentially specific version for the gac resolver means do not filter by runtime. | COMMENT |
| MEDIUM | src/Tasks.UnitTests/AssemblyDependency/Miscellaneous.cs | 4880 | /// When very long paths are passed in we should be robust. | COMMENT |
| MEDIUM | src/Tasks.UnitTests/AssemblyDependency/Miscellaneous.cs | 4910 | /// Need to be robust in the face of assembly names with special characters. | COMMENT |
| MEDIUM | …ld/BackEnd/Components/RequestBuilder/RequestBuilder.cs | 654 | // another project or when we are Yielding the Build Engine while running certain tasks. Essentially, the R | COMMENT |
| MEDIUM | src/Build/Instance/TaskRegistry.cs | 1550 | // Another way to address this is to load types from compiled assembly - that would be more robu | COMMENT |
| MEDIUM | src/Build/Evaluation/Evaluator.cs | 1684 | // Essentially, we will try to load that project file by trying multiple values (search paths) for the | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | documentation/specs/event-source.md | 130 | ### Process, build, and graph orchestration | COMMENT |
| MEDIUM | …umentation/specs/BuildCheck/BuildCheck-Architecture.md | 60 | Prerequisites: [MSBuild Nodes Orchestration](../../wiki/Nodes-Orchestration.md#orchestration) | CODE |
| MEDIUM | .github/workflows/flaky-test-detector.agent.md | 80 | # Run agentic jobs in an isolated `copilot-pat-pool` environment. | COMMENT |
| MEDIUM | .github/workflows/review-on-open.agent.md | 41 | # Run agentic jobs in an isolated `copilot-pat-pool` environment. | COMMENT |
| MEDIUM | .github/workflows/review.agent.md | 28 | # Run agentic jobs in an isolated `copilot-pat-pool` environment. | COMMENT |
| MEDIUM | .github/workflows/dreaming.agent.md | 75 | # Run agentic jobs in an isolated `copilot-pat-pool` environment. | COMMENT |
| MEDIUM | .github/workflows/flaky-test-fixer.agent.md | 82 | # Run agentic jobs in an isolated `copilot-pat-pool` environment. | COMMENT |
| MEDIUM | .github/workflows/close-stale-prs.agent.md | 19 | # Run agentic jobs in an isolated `copilot-pat-pool` environment. | COMMENT |
| MEDIUM | .github/workflows/shared/pat_pool.README.md | 82 | # Run agentic jobs in an isolated `copilot-pat-pool` environment. | COMMENT |
| MEDIUM | .github/workflows/shared/pat_pool.README.md | 214 | [configure-repo]: https://github.github.com/gh-aw/guides/agentic-authoring/#configuring-your-repository | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | eng/common/tools.sh | 337 | # Check if the script is older than 30 days using timestamp file | COMMENT |
| LOW | eng/common/tools.sh | 446 | # Check if the toolset has already been extracted | COMMENT |
| LOW | eng/common/SetupNugetSources.sh | 66 | # Check if disabledPackageSources section exists | COMMENT |
| LOW | eng/common/SetupNugetSources.sh | 72 | # Check if this source name is disabled | COMMENT |
| LOW | eng/common/SetupNugetSources.sh | 92 | # Check if source already exists | COMMENT |
| LOW | eng/common/SetupNugetSources.sh | 122 | # Check if disabledPackageSources section exists | COMMENT |
| LOW | eng/common/SetupNugetSources.sh | 192 | # Check if there is no existing credential for this FeedName | COMMENT |
| LOW | eng/common/core-templates/steps/source-build.yml | 31 | # Check if AzDO substitutes in a build config from a variable, and use it if so. | COMMENT |
| LOW | eng/common/core-templates/steps/install-microbuild.yml | 64 | # Check if ESRP is disabled while SignType is real | COMMENT |
| LOW | …ithub/workflows/SyncAnalyzerTemplateMSBuildVersion.yml | 33 | # Check if the XML file exists | COMMENT |
| LOW | …ithub/workflows/SyncAnalyzerTemplateMSBuildVersion.yml | 48 | # Check if the JSON file exists | COMMENT |
| LOW | …ithub/workflows/SyncAnalyzerTemplateMSBuildVersion.yml | 56 | # Check if the versionPrefix is different from the current defaultValue | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | eng/common/cross/build-rootfs.sh | 693 | # Create the symlink in the same directory | COMMENT |
| MEDIUM | eng/common/core-templates/job/helix-job-monitor.yml | 214 | # Create a minimal NuGet.config that only references the local nupkg directory. | COMMENT |
| MEDIUM | azure-pipelines/vs-insertion.yml | 1 | # Create a VS insertion (DotNet-MSBuild-Trusted -> VS) from a CI run on main or any servicing branch. | COMMENT |
| MEDIUM | azure-pipelines/vs-insertion-experimental.yml | 1 | # Create an experimental VS insertion auto-triggered from exp/* branches to validate changes before merging to main | COMMENT |
| MEDIUM | …ithub/workflows/SyncAnalyzerTemplateMSBuildVersion.yml | 29 | # Define the paths to your XML and JSON files | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| HIGH | …TaskAnalyzer.Tests/TransitiveCallChainAnalyzerTests.cs | 0 | is_global = true msbuild_task_analyzer.run_mt_analyzers_on_all_tasks = true | STRING |
| HIGH | …TaskAnalyzer.Tests/MultiThreadableTaskAnalyzerTests.cs | 0 | is_global = true msbuild_task_analyzer.run_mt_analyzers_on_all_tasks = true | STRING |
| HIGH | …lyzer.Tests/MultiThreadableTaskCodeFixProviderTests.cs | 0 | is_global = true msbuild_task_analyzer.run_mt_analyzers_on_all_tasks = true | STRING |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | src/Tasks/GetAssembliesMetadata.cs | 54 | // During DTB the referenced project may not has been built yet, so we need to check if the assembly alr | COMMENT |
| LOW⚡ | src/Utilities/ToolTask.cs | 1115 | // Step 1: Wait for the process handle to be signaled. | COMMENT |
| LOW⚡ | src/Utilities/ToolTask.cs | 1120 | // Step 2: Wait for the AsyncStreamReader to deliver all remaining data. | COMMENT |
| LOW | …ties/TrackedDependencies/CanonicalTrackedInputFiles.cs | 383 | // now that we have our dependencies, we need to check if any of them are newer than the outputs. | COMMENT |
| LOW | …s.UnitTests/ResourceHandling/GenerateResource_Tests.cs | 1112 | // Step 1: create a resx file directly from the resources, to get a framework generated resx | COMMENT |
| LOW | …ts/ResourceHandling/GenerateResourceOutOfProc_Tests.cs | 742 | // Step 1: create a resx file directly from the resources, to get a framework generated resx | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | eng/common/native/install-dependencies.sh | 7 | # Usage: | COMMENT |
| LOW | …common/templates-official/variables/pool-providers.yml | 12 | # How to use: | COMMENT |
| LOW | eng/common/templates/variables/pool-providers.yml | 12 | # How to use: | COMMENT |
| LOW⚡ | eng/common/core-templates/job/renovate.yml | 11 | # Usage: | COMMENT |
| LOW | src/Framework/IExtendedBuildEventArgs.cs | 21 | /// Example usage: | COMMENT |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | eng/common/cross/install-debs.py | 20 | CODE | |
| LOW | eng/common/cross/install-debs.py | 196 | CODE | |
| LOW | eng/common/cross/install-debs.py | 221 | CODE | |
| LOW | eng/common/cross/install-debs.py | 259 | CODE | |
| LOW | eng/common/cross/install-debs.py | 293 | CODE | |
| LOW | eng/common/cross/install-debs.py | 348 | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| MEDIUM | eng/common/cross/install-debs.py | 42 | print(f"Error downloading {url}: {type(e).__name__} - {e}. Retrying...") | CODE |
| MEDIUM | eng/common/cross/install-debs.py | 206 | print(f"Error: Package '{current}' was not found in the available packages.") | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | eng/common/cross/install-debs.py | 49 | async def download_deb_files_parallel(mirror, packages, tmp_dir): | CODE |
| LOW | eng/common/cross/install-debs.py | 65 | async def download_package_index_parallel(mirror, arch, suites, check_sig, keyring): | CODE |
| LOW | eng/common/cross/install-debs.py | 337 | def _rootfs_extraction_filter(member, dest_path): | CODE |
| Severity | File | Line | Snippet | Context |
|---|---|---|---|---|
| LOW | eng/common/cross/install-debs.py | 18 | CODE |