ci: configure super-linter with SHA pinning and linter configs

.codacy/cli.sh

@@ -37,7 +37,8 @@ version_file="$CODACY_CLI_V2_TMP_FOLDER/version.yaml"
 
 get_version_from_yaml() {
     if [ -f "$version_file" ]; then
-        local version=$(grep -o 'version: *"[^"]*"' "$version_file" | cut -d'"' -f2)
+        local version
+        version=$(grep -o 'version: *"[^"]*"' "$version_file" | cut -d'"' -f2)
         if [ -n "$version" ]; then
             echo "$version"
             return 0
@@ -55,7 +56,8 @@ get_latest_version() {
     fi
 
     handle_rate_limit "$response"
-    local version=$(echo "$response" | grep -m 1 tag_name | cut -d'"' -f4)
+    local version
+    version=$(echo "$response" | grep -m 1 tag_name | cut -d'"' -f4)
     echo "$version"
 }
 

.github/copilot-instructions.md

@@ -3,7 +3,7 @@
 ## 🚩 Quick Reference: Critical Rules for AI Agents
 
 | Rule | Requirement |
-|------|-------------|
+| ------ | ------------- |
 | .NET/C# Target | All C# code must target .NET 9 and C# 13; Analyzers and CodeFix must target .NET Standard 2.0 |
 | No Trial-and-Error | Never guess or use trial-and-error; STOP if unsure |
 | Test Coverage | All changes must be covered by tests (including edge/failure paths) |
@@ -49,7 +49,6 @@ If any of these are missing, the PR will not be reviewed.
 
 ### 1. Pre-Implementation Expertise Validation
 
-
 ---
 
 ## Escalation and Stop Conditions
@@ -65,22 +64,26 @@ If you encounter a diagnostic span test failure, or are unsure about any Roslyn
 ### Symbol-Based Detection (MANDATORY)
 
 **Always prefer symbol-based detection over string matching:**
+
 - ✅ Use `ISymbol` and `SemanticModel.GetSymbolInfo()` for type-safe detection
 - ✅ Register types in `MoqKnownSymbols` using `TypeProvider.GetOrCreateTypeByMetadataName()`
 - ❌ Avoid string-based method name matching (fragile, not refactoring-safe)
 
 **Generic Type Handling:**
+
 - Use backtick notation for generic arity: `"Moq.Language.IRaise\`1"` for `IRaise<T>`
 - Collect method overloads: `GetMembers("MethodName").OfType<IMethodSymbol>().ToImmutableArray()`
 
 **Moq Fluent API Chain Pattern:**
+
 - Moq methods return different interfaces at different chain positions
 - Example: `Setup()` → `ISetup<T>` → `.Raises()` → `IRaise<T>` → `.Returns()` → `IReturns<T>`
 - **Register ALL interfaces in the chain**, not just endpoint types
 
 ### Diagnostic Investigation Pattern
 
 When tests fail after removing string-based detection:
+
 1. Create temporary diagnostic test using `SemanticModel.GetSymbolInfo()`
 2. Capture actual symbol type at runtime
 3. Compare against `MoqKnownSymbols` registry to find missing entries
@@ -89,13 +92,15 @@ When tests fail after removing string-based detection:
 ### Context Preservation
 
 Use appropriate analysis contexts to maintain compilation access:
+
 - `SyntaxNodeAnalysisContext` - For syntax tree analysis with semantic model
 - `SemanticModelAnalysisContext` - For semantic analysis
 - `SyntaxTreeAnalysisContext` - For whole-file analysis
 
 ---
 
 **Implementation:**
+
 - Answer domain-specific technical questions before coding
 - Provide concrete examples of your understanding
 - Request expert guidance if uncertain about any concept
@@ -111,6 +116,7 @@ Use appropriate analysis contexts to maintain compilation access:
 - **Stop progression** if any required step is incomplete
 
 **Implementation:**
+
 - Read and understand project-specific instructions first
 - Follow established patterns and conventions
 - Verify each workflow step was completed successfully
@@ -119,12 +125,14 @@ Use appropriate analysis contexts to maintain compilation access:
 ### 3. Critical Failure Recognition
 
 **You MUST establish clear stop conditions:**
+
 - **Immediate halt** for uncertainty or lack of understanding
 - **Specific criteria** for when to request expert guidance
 - **No trial-and-error tolerance** - require deliberate, correct understanding
 - **Clear escalation paths** when encountering complex situations
 
 **Implementation:**
+
 - Stop immediately if you cannot explain your approach
 - Request expert guidance when uncertain about domain concepts
 - Never attempt to "figure out" solutions through guessing
@@ -133,12 +141,14 @@ Use appropriate analysis contexts to maintain compilation access:
 ### 4. Tool Usage Reliability
 
 **You MUST use available tools consistently and reliably:**
+
 - **Consistent, reliable use** of available tools regardless of platform
 - **Graceful handling** of tool failures and interruptions
 - **Validation** that tools were used correctly and effectively
 - **Retry mechanisms** for interrupted operations
 
 **Implementation:**
+
 - Use tools systematically and consistently
 - Handle tool failures gracefully with clear error messages
 - Validate tool outputs before proceeding
@@ -147,12 +157,14 @@ Use appropriate analysis contexts to maintain compilation access:
 ### 5. Context and State Management
 
 **You MUST preserve context and maintain state:**
+
 - **Preserve context** across task interruptions or resumptions
 - **Maintain state** during complex multi-step operations
 - **Automatic recovery** of context after interruptions
 - **Clear state transitions** between different phases of work
 
 **Implementation:**
+
 - Maintain clear state throughout complex operations
 - Recover context automatically after interruptions
 - Document state transitions clearly
@@ -161,12 +173,14 @@ Use appropriate analysis contexts to maintain compilation access:
 ### 6. Documentation and Configuration Awareness
 
 **You MUST check and understand project context:**
+
 - **Check relevant files** before making changes
 - **Read and understand** project-specific instructions
 - **Follow established patterns** and conventions
 - **Respect existing architecture** and design decisions
 
 **Implementation:**
+
 - Always read configuration files and documentation first
 - Understand project structure and conventions
 - Follow established naming and architectural patterns
@@ -175,12 +189,14 @@ Use appropriate analysis contexts to maintain compilation access:
 ### 7. Validation and Verification
 
 **You MUST verify work through appropriate means:**
+
 - **Verify work** through appropriate means (tests, analysis, etc.)
 - **Confirm changes** meet requirements before considering tasks complete
 - **Run validation checks** after modifications
 - **Ensure quality** through systematic verification
 
 **Implementation:**
+
 - Run tests and validation checks after changes
 - Verify that modifications meet stated requirements
 - Use appropriate verification methods for the domain
@@ -189,12 +205,14 @@ Use appropriate analysis contexts to maintain compilation access:
 ### 8. No Trial-and-Error Tolerance
 
 **You MUST require deliberate understanding:**
+
 - **Require deliberate understanding** before implementation
 - **No guessing** at solutions or approaches
 - **Clear escalation paths** when uncertain
 - **Expert guidance triggers** for complex or unclear situations
 
 **Implementation:**
+
 - Never implement solutions you don't fully understand
 - Stop and request clarification when uncertain
 - Establish clear criteria for when to seek expert guidance
@@ -279,7 +297,6 @@ When working with task lists, the AI must:
 5. **Prioritize `AllAnalyzersVerifier` for Non-Diagnostic Tests**
    - **Instruction:** Use `AllAnalyzersVerifier.VerifyAllAnalyzersAsync()` for "no diagnostics" tests.
 
-
 ### AI Agent Workflow
 
 When making changes, follow this workflow:
@@ -304,7 +321,6 @@ All formatting, linting, and static analysis feedback from bots must be addresse
 
 ---
 
-
 ### AI Agent Specific Output Checklist
 
 - Output only complete, compiling code (classes or methods) with all required `using` directives.
@@ -320,7 +336,7 @@ All formatting, linting, and static analysis feedback from bots must be addresse
 
 All commits must use the [Conventional Commits](https://www.conventionalcommits.org/) format:
 
-```
+```text
 <type>[optional scope]: <description>
 
 [optional body]
@@ -335,6 +351,7 @@ All commits must use the [Conventional Commits](https://www.conventionalcommits.
 - `docs(readme): update installation instructions`
 
 **Bad:**
+
 - `fixed bug on landing page`
 - `oops`
 - `I think I fixed it this time?`
@@ -356,6 +373,7 @@ All commits must use the [Conventional Commits](https://www.conventionalcommits.
 Before writing a single line of code, you must internally verify you can make the following declaration. If not, you must halt immediately.
 
 > "I declare that I have expert-level, demonstrable expertise in:
+>
 > - Roslyn syntax tree navigation from `SyntaxNode` down to `SyntaxToken` and `SyntaxTrivia`.
 > - Precise, character-level diagnostic span calculation and verification.
 > - The distinction and correct application of `IOperation` vs. `ISyntaxNode` analysis.
@@ -435,31 +453,33 @@ If you encounter:
 
 ---
 
-
 ## AI Agent Code Review
 
 I need your help tracking down and fixing some bugs that have been reported in this codebase.
 
 I suspect the bugs are related to:
-- Incorrect handling of edge cases 
+
+- Incorrect handling of edge cases
 - Off-by-one errors in loops or array indexing
 - Unexpected data types
 - Uncaught exceptions
 - Concurrency issues
 - Improper configuration settings
 
 To diagnose:
-1. Review the code carefully and systematically 
-2. Trace the relevant code paths 
+
+1. Review the code carefully and systematically
+2. Trace the relevant code paths
 3. Consider boundary conditions and potential error states
 4. Look for antipatterns that tend to cause bugs
-5. Run the code mentally with example inputs 
+5. Run the code mentally with example inputs
 6. Think about interactions between components
 
 When you find potential bugs, for each one provide:
+
 1. File path and line number(s)
 2. Description of the issue and why it's a bug
-3. Example input that would trigger the bug 
+3. Example input that would trigger the bug
 4. Suggestions for how to fix it
 
 After analysis, please update the code with your proposed fixes. Try to match the existing code style. Add regression tests if possible, to prevent the bugs from recurring.
@@ -527,6 +547,7 @@ The following instruction files provide comprehensive, self-contained guidance f
 5. **Test coverage** - Ensure all file types have appropriate instruction coverage
 
 **Common areas requiring updates across multiple files:**
+
 - Git commit message guidelines
 - Pull request requirements
 - Code quality standards
@@ -543,6 +564,7 @@ The following instruction files provide comprehensive, self-contained guidance f
 ## Reference to General Guidelines
 
 For comprehensive contributor guidance including:
+
 - Development workflow requirements
 - Code quality standards
 - Testing requirements and patterns

.github/dependabot.yml

@@ -10,10 +10,10 @@ updates:
     reviewers:
       - "rjmurillo"
       - "mattkotsenas"
-  # NuGet dependency management is handled by Renovate (see renovate.json).
-  # Dependabot NuGet PRs were disabled because:
-  #   1. PR titles use "Bump X from A to B" format, which fails the required
-  #      "Validate PR title" check (conventional commits required).
-  #   2. Both bots created duplicate PRs for every package update.
-  #   3. Renovate supports better grouping, automerge rules, and conventional
-  #      commit formatting out of the box.
+# NuGet dependency management is handled by Renovate (see renovate.json).
+# Dependabot NuGet PRs were disabled because:
+#   1. PR titles use "Bump X from A to B" format, which fails the required
+#      "Validate PR title" check (conventional commits required).
+#   2. Both bots created duplicate PRs for every package update.
+#   3. Renovate supports better grouping, automerge rules, and conventional
+#      commit formatting out of the box.

.github/instructions/README.md

@@ -2,19 +2,19 @@
 
 This table maps file patterns in the repository to their corresponding instruction files. Use this as a quick reference to ensure you are following the correct guidance for each file type. If a file type is not listed, refer to `generic.instructions.md`.
 
-| File Pattern            | Instruction File                                   | Description/Notes                       |
-|------------------------|----------------------------------------------------|-----------------------------------------|
-| `*.cs`                 | `csharp.instructions.md`                           | C# source files                         |
-| `*.csproj`, `*.sln`    | `project.instructions.md`                          | Project/solution files                  |
-| `*.md`                 | `markdown.instructions.md`                         | Markdown documentation                  |
-| `*.json`               | `json.instructions.md`                             | JSON config                             |
-| `*.yml`, `*.yaml`      | `yaml.instructions.md`                             | CI/CD workflows                         |
-| `*.sh`, `*.ps1`        | `shell.instructions.md`                            | Shell/PowerShell scripts                |
-| `*.xml`                | `xml.instructions.md`                              | XML config/docs                         |
-| `*.txt`                | `text.instructions.md`                             | Text files                              |
-| `.editorconfig`        | `editorconfig.instructions.md`                     | EditorConfig rules                      |
-| `.gitignore`           | `gitignore.instructions.md`                        | Git ignore rules                        |
-| `*.props`, `*.targets` | `msbuild.instructions.md`                          | MSBuild property/target files           |
-| _Other_                | `generic.instructions.md`                          | Fallback for unknown file types         |
+| File Pattern | Instruction File | Description/Notes |
+| --- | --- | --- |
+| `*.cs` | `csharp.instructions.md` | C# source files |
+| `*.csproj`, `*.sln` | `project.instructions.md` | Project/solution files |
+| `*.md` | `markdown.instructions.md` | Markdown documentation |
+| `*.json` | `json.instructions.md` | JSON config |
+| `*.yml`, `*.yaml` | `yaml.instructions.md` | CI/CD workflows |
+| `*.sh`, `*.ps1` | `shell.instructions.md` | Shell/PowerShell scripts |
+| `*.xml` | `xml.instructions.md` | XML config/docs |
+| `*.txt` | `text.instructions.md` | Text files |
+| `.editorconfig` | `editorconfig.instructions.md` | EditorConfig rules |
+| `.gitignore` | `gitignore.instructions.md` | Git ignore rules |
+| `*.props`, `*.targets` | `msbuild.instructions.md` | MSBuild property/target files |
+| _Other_ | `generic.instructions.md` | Fallback for unknown file types |
 
-**Note:** If you are editing a file type not listed above, always check for a matching instruction file in this directory or use the generic fallback. When in doubt, escalate by tagging `@repo-maintainers` in your PR. 
+**Note:** If you are editing a file type not listed above, always check for a matching instruction file in this directory or use the generic fallback. When in doubt, escalate by tagging `@repo-maintainers` in your PR.