chore(security): InspectCode noise-floor .DotSettings (#361)

ETL-Abstractions.sln.DotSettings

@@ -0,0 +1,165 @@
+<wpf:ResourceDictionary xml:space="preserve" xmlns:x="http://schemas.microsoft.com/winfx/2006/xaml" xmlns:s="clr-namespace:System;assembly=mscorlib" xmlns:ss="urn:shemas-jetbrains-com:settings-storage-xaml" xmlns:wpf="http://schemas.microsoft.com/winfx/2006/xaml/presentation">
+	<!--
+	  ReSharper InspectCode noise-floor (see issue #361).
+
+	  Purpose: silence InspectCode inspections that are either (a) already covered
+	  and gated by the build's Roslyn analyzer stack (Meziantou, SonarAnalyzer,
+	  Roslynator, AsyncFixer, VS.Threading, BannedApiAnalyzers, .NET SDK analyzers,
+	  PublicApiAnalyzers) — double-reporting them here adds no signal — or (b) known
+	  false positives on this repo's multi-TFM layout / example-project scope.
+
+	  ETL-Abstractions is the base library of the ETL fleet, so this file is
+	  intentionally more conservative than a leaf-repo profile: only inspections
+	  with a demonstrable false-positive pattern or a redundant Roslyn-analyzer
+	  equivalent are silenced. Real findings (StaticMemberInGenericType, MA0158,
+	  S6966, S5034, S2699, S6608, S4487, S1994, S3267, RCS1194, InvalidXmlDocComment,
+	  …) stay visible.
+
+	  Only error-severity findings gate merge (pr.yaml `inspectcode` job); these
+	  entries drop the corresponding warnings from Code Scanning entirely.
+	-->
+
+	<!-- PublicAPI false positive: InspectCode runs Roslyn analyzers WITHOUT
+	     PublicAPI.Shipped.txt / PublicAPI.Unshipped.txt as AdditionalFiles, so
+	     the analyzer thinks nothing is declared and flags every public member
+	     with RS0016 ("add to declared API"), RS0036 ("annotate nullability"),
+	     and RS0037 ("enable nullability tracking"). The in-build analyzer gates
+	     these correctly via Directory.Build.props `Exists()` conditions; the
+	     InspectCode fire is pure duplicate. -->
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=RS0016/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=RS0036/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=RS0037/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+
+	<!-- Redundant-code style rules — covered in-build by Roslynator / IDE00xx and
+	     .editorconfig. RedundantUsingDirective in particular is a FALSE POSITIVE:
+	     src projects multi-target net462;netstandard2.0;netstandard2.1;net8.0;
+	     net10.0 with <ImplicitUsings> only enabled for net10.0 (in the
+	     conditional PropertyGroup); explicit System usings are REQUIRED on
+	     net462/netstandard/net8 but look redundant to InspectCode which analyses
+	     a single TFM. -->
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=RedundantUsingDirective/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=RedundantNameQualifier/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=RedundantCast/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=RedundantExtendsListEntry/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=RedundantSuppressNullableWarningExpression/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=RedundantTypeArgumentsOfMethod/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=RedundantNullableDirective/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=RedundantWithCancellation/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=RedundantAssignment/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=RedundantArgumentDefaultValue/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+
+	<!-- Nullability — owned by the Roslyn nullable reference-type analysis, not R#.
+	     The *AccordingTo(Nullable)APIContract rules flag defensive null-checks on
+	     non-null-annotated parameters; those checks are INTENTIONAL in a base
+	     library that is called from nullable-oblivious / older-TFM code where
+	     callers can still pass null despite the annotation. -->
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=ReturnTypeCanBeNotNullable/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=RedundantNullableFlowAttribute/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=NullnessAnnotationConflictWithJetBrainsAnnotations/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=NullCoalescingConditionIsAlwaysNotNullAccordingToAPIContract/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=ConditionIsAlwaysTrueOrFalseAccordingToNullableAPIContract/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=ConditionalAccessQualifierIsNonNullableAccordingToAPIContract/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=AssignNullToNotNullAttribute/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+
+	<!-- Public-API false positive: R# cannot see external consumers of a library's
+	     public auto-properties, so it reports them as unused (.Global variant).
+	     PublicApiAnalyzers governs the actual public surface. Dots in the ID are
+	     escaped as _002E. -->
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=UnusedAutoPropertyAccessor_002EGlobal/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+
+	<!-- Test-project analyzer-policy conflicts. `.editorconfig` sets CA2007=none
+	     under `tests/` (test bodies don't need `.ConfigureAwait(false)`) but the
+	     src stack mandates it; xUnit1030 disagrees with that settled policy. -->
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=xUnit1030/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+
+	<!-- Roslyn / Sonar analyzer diagnostics re-run by InspectCode. These are
+	     already enforced (or the equivalent Roslynator RCSxxxx rule fires) by
+	     the in-build analyzer stack; suppress the InspectCode double-report. -->
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=MA0009/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=S1939/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=S3220/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=S2068/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+
+	<!-- Example / demo projects intentionally use patterns that InspectCode
+	     dislikes but are pedagogically correct or not worth polishing on demo
+	     code. AccessToModifiedClosure: examples read a counter from a Timer
+	     callback via Volatile.Read(ref count) — the correct pattern for reading
+	     a modified captured variable. RCS1102 ("Make class static") fires on
+	     entry-point Program classes. S125 flags illustrative `// ...` comments
+	     showing alternative patterns. S2930 flags short-lived CancellationTokenSource
+	     in demo Program.cs cleanup that runs to process exit. S4456 asks
+	     iterator methods to split arg validation — pedantic in library code
+	     and unnecessary in examples. S108 flags nested blocks that clarify
+	     lexical scope in the tutorial code. -->
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=AccessToModifiedClosure/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=RCS1102/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=S125/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=S2930/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=S4456/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=S108/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=S2326/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+
+	<!-- Test-code intentional patterns. FinalizationSuppressionTests deliberately
+	     defines types with finalizers to exercise Dispose/finalizer suppression
+	     (MA0055). DisposeStagesTests uses throwing test doubles to exercise
+	     pipeline error handling (S3877). WrongOverloadCalledException is an
+	     internal test-only exception whose visibility is deliberate (S3871).
+	     S4487 flags an unread private field that is a documentation seam in a
+	     timer test. -->
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=MA0055/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=S3877/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=S3871/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+
+	<!-- Roslynator / IDE00xx also fires on unused-variable patterns; suppress
+	     the InspectCode duplicate. Dots escape as _002E. -->
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=UnusedVariable/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=NotAccessedVariable/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=NotAccessedField_002ELocal/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+
+	<!-- Recurring TestKit / Abstractions patterns that Sonar flags but are
+	     deliberate on this codebase. All confirmed against src/ as intentional
+	     designs, not defects. -->
+
+	<!-- S1994: "for loop stop condition doesn't test the incrementer variable".
+	     Fires on the intentional `for (var i = 0; ; i++)` infinite-generator
+	     pattern in TestExtractor.Generate*, and on the `for (var attempt = 1; ;
+	     attempt++)` retry loops in RetryingExtractor and RetrySeamTests — those
+	     loops break internally on the retry-policy verdict, not on the counter. -->
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=S1994/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+
+	<!-- S1215: "avoid GC.Collect". AllocationBudgetContractTests calls
+	     GC.Collect + WaitForPendingFinalizers as a settle-the-heap primitive
+	     before measuring hot-path allocations — the whole point of the test is
+	     that the measurement is precise. -->
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=S1215/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+
+	<!-- MA0158: "use System.Threading.Lock". The type only exists on net9.0+.
+	     The library multi-targets net462;netstandard2.0;netstandard2.1;net8.0;
+	     net10.0, so `new object()` for a lock is required on 4 of the 5 TFMs
+	     and would need a #if NET9_0_OR_GREATER split for a micro-perf gain
+	     that isn't worth the ceremony in a progress-capture test double. -->
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=MA0158/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+
+	<!-- S3267: "loop over Where would simplify". MiddlewareExtensions validates
+	     the middleware chain by iterating and throwing ArgumentNullException
+	     on the FIRST null with the right paramName/message — LINQ Where +
+	     Any() would lose the enumeration-position semantics and require two
+	     passes. The loop is the clearer expression here. -->
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=S3267/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+
+	<!-- S5034: "consume ValueTask only once". Fires on TestKitFuzzTests.Drain,
+	     which sync-drains an IAsyncEnumerable inside a synchronous CsCheck
+	     sampler — the .AsTask().GetAwaiter().GetResult() bridge is the
+	     deliberate sync-over-async pattern for that constraint. -->
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=S5034/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+
+	<!-- S6966: "await CancelAsync instead of Cancel". Fires inside
+	     ExtractorBaseContractTests and TransformerBaseContractTests where
+	     `cts.Cancel()` is called from INSIDE an `await foreach` loop as the
+	     mid-stream cancellation trigger. CancelAsync() would suspend the loop
+	     while token callbacks complete, which races the assertion that the
+	     enumerator sees the cancellation on the very next MoveNextAsync. Sync
+	     Cancel() is the correct primitive for this scenario (the surrounding
+	     #pragma already disables CA1849/VSTHRD103; add S6966 to the family). -->
+	<s:String x:Key="/Default/CodeInspection/Highlighting/InspectionSeverities/=S6966/@EntryIndexedValue">DO_NOT_SHOW</s:String>
+</wpf:ResourceDictionary>

benchmarks/Wolfgang.Etl.Abstractions.Benchmarks/PipelineBenchmarks.cs

@@ -1,3 +1,4 @@
+using System.Collections.Generic;
 using System.Threading.Tasks;
 using BenchmarkDotNet.Attributes;
 using Wolfgang.Etl.Abstractions;

tests/Wolfgang.Etl.Abstractions.Tests.Unit/BaseClassTests/SystemProgressTimerTests.cs

@@ -242,7 +242,6 @@ private static async Task<int> WaitUntilStable(
     private sealed class CapturingExtractor : ExtractorBase<int, EtlProgress>
     {
         private readonly Action<IProgressTimer> _onTimerCreated;
-        private readonly int _intervalMs;
         private readonly int _workerDelayMs;
 
         public CapturingExtractor(
@@ -251,7 +250,6 @@ public CapturingExtractor(
             int workerDelayMs = 0)
         {
             _onTimerCreated = onTimerCreated;
-            _intervalMs = intervalMs;
             _workerDelayMs = workerDelayMs > 0 ? workerDelayMs : intervalMs * 2;
             ReportingInterval = intervalMs;
         }

tests/Wolfgang.Etl.Abstractions.Tests.Unit/EtlPipelineTests/EtlPipelineTests.cs

@@ -288,7 +288,7 @@ await EtlPipeline
             .To(loader)
             .RunAsync(progress);
 
-        var final = reports.Last();
+        var final = reports[reports.Count - 1];
         Assert.Equal(5, final.ExtractedItemCount);
         Assert.Equal(5, final.LoadedItemCount);
 

tests/Wolfgang.Etl.Abstractions.Tests.Unit/PipelineTests/TestDoubles/WrongOverloadCalledException.cs

@@ -9,8 +9,19 @@ namespace Wolfgang.Etl.Abstractions.Tests.Unit.PipelineTests.TestDoubles;
 /// </summary>
 internal sealed class WrongOverloadCalledException : Exception
 {
+    public WrongOverloadCalledException()
+    {
+    }
+
+
     public WrongOverloadCalledException(string overloadSignature)
         : base($"Unexpected call to {overloadSignature}. The pipeline routed through the wrong overload.")
     {
     }
+
+
+    public WrongOverloadCalledException(string message, Exception innerException)
+        : base(message, innerException)
+    {
+    }
 }