Skip to content

Fix analyzer false-positive regressions - #148

Merged
github-actions[bot] merged 1 commit into
mainfrom
dev/fix-red-r2-false-positives
May 13, 2026
Merged

Fix analyzer false-positive regressions#148
github-actions[bot] merged 1 commit into
mainfrom
dev/fix-red-r2-false-positives

Conversation

@ANcpLua

@ANcpLua ANcpLua commented May 13, 2026

Copy link
Copy Markdown
Owner

Summary

  • Narrowed analyzer and code-fix behavior across the validated false-positive set from the agent tournament.
  • Added regression coverage for AL0004, AL0007-AL0009, AL0014, AL0015, AL0027, AL0029-AL0031, AL0037, AL0040, AL0048-AL0051, AL0111, AL0114, AL0117, AL0118, AL0121, AL0127, AL0138, and AL0139-AL0140.
  • Follow-up verifier blockers were fixed: AL0029 no longer reports GetAttributes().Any() without a predicate, AL0031 pairs ConstantValue.HasValue/.Value by source operation, and AL0040 no longer offers unsafe <object> fixes.

Validation

  • dotnet build ANcpLua.Analyzers.slnx -c Release --no-restore
  • dotnet test --project tests/ANcpLua.Analyzers.Tests/ANcpLua.Analyzers.Tests.csproj -c Release --no-build
  • git diff --check HEAD~1..HEAD
  • Codex-Spark verifier pass after blocker fixes: approved

Summary by CodeRabbit

Release Notes

  • Bug Fixes

    • AL0138: Changed Math.Round fix to use MidpointRounding.ToEven instead of AwayFromZero for more accurate default behavior.
    • Multiple analyzers improved with stricter pattern detection for reduced false positives in AL0007-AL0009, AL0014, AL0027, AL0029, AL0031, AL0037, AL0040, AL0048-AL0051, AL0111, AL0114, AL0117-AL0118, and AL0121.
    • AL0015: Added validation for assignable identifiers in portable null-guard style.
    • AL0030: Enhanced type-hierarchy loop detection accuracy.
    • AL0127: Fixed semantic version prerelease comparison logic.
  • Documentation

    • Updated AL0138 guidance to reflect ToEven rounding behavior.

@github-actions

Copy link
Copy Markdown

@coderabbitai autofix

@github-actions
github-actions Bot enabled auto-merge (squash) May 13, 2026 03:26
@coderabbitai

coderabbitai Bot commented May 13, 2026

Copy link
Copy Markdown
Contributor

Caution

Review failed

Pull request was closed or merged during review

📝 Walkthrough

Walkthrough

This pull request updates 39 analyzer and code-fix source files plus 18 test files. Changes include: shifting AL0138 midpoint rounding guidance from AwayFromZero to ToEven (resources, code fixes, tests); tightening semantic pattern matching across multiple analyzers via stricter symbol resolution and invocation validation; refactoring diagnostic property keys and extraction logic in guard-related code fixes (AL0048–AL0051); expanding AL0031 to require containing-type context alongside method names; improving AL0111, AL0114, AL0117, AL0118, and AL0121 with semantic/control-flow aware suppression and mutation detection; and adding extensive test coverage for edge cases and new validation rules. Helpers for zero-literal detection, out-parameter extraction, expression parsing, and connection-based transaction tracking are introduced.

@coderabbitai

coderabbitai Bot commented May 13, 2026

Copy link
Copy Markdown
Contributor

Note

Autofix is a beta feature. Expect some limitations and changes as we gather feedback and continue to improve it.

Autofix skipped. No unresolved CodeRabbit review comments with fix instructions found.

@claude

claude Bot commented May 13, 2026

Copy link
Copy Markdown

Claude encountered an error —— View job


I'll analyze this and get back to you.

@github-actions
github-actions Bot merged commit 1272fbc into main May 13, 2026
9 checks passed

@chatgpt-codex-connector chatgpt-codex-connector Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f54a11a183

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

  • Open a pull request for review
  • Mark a draft as ready
  • Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

if (IsSymbolEqualityComparerEquals(invocation, cache)) {
return true;
}
return IsSupportedComparisonInvocation(invocation, iteratorName, cache);

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Continue scanning descendants for valid equality invocations

In ContainsSymbolEqualityComparison, the loop now returns on the first IInvocationOperation it encounters, even when that invocation is unrelated to symbol equality. This causes false negatives whenever the first invocation in the loop body/condition is something else (e.g., logging/helper call) and the actual SymbolEqualityComparer.Equals/IsEqualTo check appears later, so AL0030 can silently stop reporting valid AllInterfaces/BaseType patterns.

Useful? React with 👍 / 👎.

Comment on lines +95 to +99
case "CreateCommand":
if (receiver is not null
&& TryGetAssignedSymbol(context.SemanticModel, invocation) is { } commandSymbol) {
commandConnections[commandSymbol] = receiver;
}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Correlate transaction protection beyond CreateCommand-only mapping

The new correlation logic only records command-to-connection relationships for CreateCommand assignments, and IsProtectedByTransaction relies exclusively on that map (or transactions invoked on the command symbol itself). This means a read/modify/write command created via constructor/factory patterns (or later Connection assignment) can still be transaction-protected but will be flagged as unprotected, introducing false positives in common ADO.NET usage outside the CreateCommand path.

Useful? React with 👍 / 👎.

return false;
}

source = sourceSyntax.ToString();

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Track ConstantValue source by symbol, not syntax text

TryGetConstantValueSource keys HasValue/Value pairing by sourceSyntax.ToString(), so different symbols with identical text can be conflated (for example, shadowed operation names across nested scopes/lambdas inside the same binary expression). In those cases AL0031 can still suggest TryGetConstantValue even though the HasValue and Value accesses are on different operations, which reintroduces the mismatched-source false positive this change was meant to avoid.

Useful? React with 👍 / 👎.

Comment on lines +77 to +80
case var name when s_readMethods.Contains(name):
if (receiver is null) {
hasUnknownCorrelation = true;
}

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

P2 Badge Avoid suppressing AL0118 on any unqualified name collision

The new hasUnknownCorrelation gate suppresses the entire diagnostic when a read/write method name is seen without a resolvable receiver symbol. Because GetInvokedMethodName matches by name only, an unrelated local/static call like ExecuteReader() now turns off AL0118 even when the method also contains a real untransactional DbCommand read/modify/write sequence, creating a broad false-negative path.

Useful? React with 👍 / 👎.

@ANcpLua
ANcpLua deleted the dev/fix-red-r2-false-positives branch May 16, 2026 10:54
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant