Enable SDL Roslyn analysis (incl. internal IA* analyzers) in the OneBranch build

Directory.Packages.props

@@ -106,6 +106,24 @@
     <PackageVersion Include="Microsoft.Extensions.Caching.Memory" Version="8.0.1" />
   </ItemGroup>
 
+  <!-- ===================================================================== -->
+  <!-- Internal SDL analyzers (private ADO.Net pipelines only) -->
+  <!--
+    Microsoft.Internal.Analyzers provides the internal "IA*" SDL Roslyn rules. The package is
+    Microsoft-internal and confidential: it is restored ONLY from an internal NuGet feed, ONLY by
+    the private ADO.Net project pipelines, and ONLY when EnableAnalyzers and InternalAnalyzers are
+    both true (see the InternalAnalyzers block in src/Directory.Build.props). Public builds and
+    public CI never set those flags, so the version below is only declared for the private analysis
+    pass and is never seen by a public build.
+
+    The version is supplied by the private pipeline via the InternalAnalyzersVersion
+    property. There is intentionally NO default: the pipeline pins the exact version, and an
+    unset value fails restore rather than silently drifting.
+  -->
+  <ItemGroup Condition="'$(EnableAnalyzers)' == 'true' AND '$(InternalAnalyzers)' == 'true'">
+    <PackageVersion Include="Microsoft.Internal.Analyzers" Version="$(InternalAnalyzersVersion)" />
+  </ItemGroup>
+
   <!-- ===================================================================== -->
   <!-- SqlServer Dependencies -->
 

NuGet.analysis.config

@@ -0,0 +1,40 @@
+<?xml version="1.0" encoding="utf-8"?>
+<configuration>
+  <!-- Analysis builds select this file explicitly. Keep governed and local in sync with NuGet.config. -->
+  <packageSources>
+    <clear />
+    <add key="governed" value="https://sqlclientdrivers.pkgs.visualstudio.com/public/_packaging/sqlclient/nuget/v3/index.json" />
+    <add key="local" value="packages/" />
+    <!-- NuGet expands this environment variable before restoring internal analyzer packages. -->
+    <add key="internal-analyzers" value="%INTERNAL_ANALYZERS_FEED%" />
+  </packageSources>
+  <packageSourceMapping>
+    <packageSource key="governed">
+      <package pattern="*" />
+      <!-- Repeat the exact local patterns so these packages remain eligible from governed. -->
+      <package pattern="Microsoft.Data.SqlClient" />
+      <package pattern="Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider" />
+      <package pattern="Microsoft.Data.SqlClient.Extensions.Abstractions" />
+      <package pattern="Microsoft.Data.SqlClient.Extensions.Azure" />
+      <package pattern="Microsoft.Data.SqlClient.Internal.Logging" />
+      <package pattern="Microsoft.SqlServer.Server" />
+    </packageSource>
+    <!-- Only packages produced by this repository may be restored from the local feed. -->
+    <packageSource key="local">
+      <package pattern="Microsoft.Data.SqlClient" />
+      <package pattern="Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider" />
+      <package pattern="Microsoft.Data.SqlClient.Extensions.Abstractions" />
+      <package pattern="Microsoft.Data.SqlClient.Extensions.Azure" />
+      <package pattern="Microsoft.Data.SqlClient.Internal.Logging" />
+      <package pattern="Microsoft.SqlServer.Server" />
+    </packageSource>
+    <!--
+      Use the Microsoft.Internal.* prefix instead of only Microsoft.Internal.Analyzers so companion
+      or transitive packages in the same internal namespace also restore from this feed. This prefix
+      is more specific than the governed/local "*" patterns, so NuGet gives it precedence.
+    -->
+    <packageSource key="internal-analyzers">
+      <package pattern="Microsoft.Internal.*" />
+    </packageSource>
+  </packageSourceMapping>
+</configuration>

NuGet.config

@@ -20,4 +20,25 @@
     -->
     <add key="local" value="packages/" />
   </packageSources>
+  <packageSourceMapping>
+    <packageSource key="governed">
+      <package pattern="*" />
+      <!-- Repeat the exact local patterns so these packages remain eligible from governed. -->
+      <package pattern="Microsoft.Data.SqlClient" />
+      <package pattern="Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider" />
+      <package pattern="Microsoft.Data.SqlClient.Extensions.Abstractions" />
+      <package pattern="Microsoft.Data.SqlClient.Extensions.Azure" />
+      <package pattern="Microsoft.Data.SqlClient.Internal.Logging" />
+      <package pattern="Microsoft.SqlServer.Server" />
+    </packageSource>
+    <!-- Only packages produced by this repository may be restored from the local feed. -->
+    <packageSource key="local">
+      <package pattern="Microsoft.Data.SqlClient" />
+      <package pattern="Microsoft.Data.SqlClient.AlwaysEncrypted.AzureKeyVaultProvider" />
+      <package pattern="Microsoft.Data.SqlClient.Extensions.Abstractions" />
+      <package pattern="Microsoft.Data.SqlClient.Extensions.Azure" />
+      <package pattern="Microsoft.Data.SqlClient.Internal.Logging" />
+      <package pattern="Microsoft.SqlServer.Server" />
+    </packageSource>
+  </packageSourceMapping>
 </configuration>

build.proj

@@ -243,6 +243,112 @@
     -->
     <SkipDependencyPack Condition="'$(SkipDependencyPack)' == ''">false</SkipDependencyPack>
 
+    <!--
+      IsolatedBuildPath
+      Applies to:     Build* targets (driver and extension projects)
+      Description:    When set, redirects each project's binary output (bin) to an isolated
+                      location instead of the repo's artifacts/ folder, and forces a full
+                      (non-incremental) compile. This lets a build run at any time without
+                      clobbering existing real build output - for example, an analysis pass that
+                      only needs to compile the code and must not disturb a real build's output.
+
+                      * bin is redirected under "$(IsolatedBuildPath)/bin/" via ArtifactPath. Each
+                        project's OutputPath already appends a project-specific subfolder, so the
+                        projects do not collide and the real artifacts/ folder is left untouched.
+                      * The intermediate (obj) directory is intentionally left at its default,
+                        per-project location. MSBuild resolves the default relative obj/ against
+                        each project's own directory, which keeps intermediates separate for the
+                        multiple projects that make up a package (for example the ref, src, and
+                        notsupported projects of the driver). Pointing every project at a single
+                        shared obj/ under the isolated path makes those projects overwrite each
+                        other's restore assets and fail. The non-incremental switch guarantees a
+                        full recompile regardless of any pre-existing intermediate output.
+
+                      NOTE: Even though an isolated build shares the default obj/ with a prior real
+                      build, it does not perturb that real build's output. The non-incremental switch
+                      does not run Clean or delete anything; it disables the incremental/up-to-date
+                      checks and forces a full recompile so the analyzers see every source file. Real
+                      output is safe because bin is redirected to $(IsolatedBuildPath): the isolated
+                      build only ever writes to the isolated bin, never to the real artifacts/ bin.
+                      The recompile just rewrites the shared obj/ intermediates, which is harmless
+                      because nothing downstream consumes obj/.
+      Default value:  [blank] (normal artifacts/ location and incremental build are used)
+      Example:        C:\agent\_temp\isolated-build
+    -->
+    <IsolatedBuildPath Condition="'$(IsolatedBuildPath)' == ''" />
+    <IsolatedBuildArgument Condition="'$(IsolatedBuildPath)' != ''">
+      --no-incremental
+      -p:ArtifactPath="$(IsolatedBuildPath)/bin/"
+    </IsolatedBuildArgument>
+
+    <!--
+      EnableAnalyzers
+      Applies to:     Build* targets (driver and extension projects)
+      Description:    When true, turns on the full set of Roslyn analyzers for every project that is
+                      compiled and makes each project emit a per-project SARIF v1 log (see the
+                      EnableAnalyzers block in src/Directory.Build.props).
+
+                      The flag is forwarded to each project's own "dotnet build" invocation via
+                      EnableAnalyzersArgument. This forwarding is required because .NET [Roslyn]
+                      analyzers are compiler-integrated: they must run in the leaf compile, and each
+                      leaf compile is a separate "dotnet build" process that build.proj launches with
+                      an <Exec> - it does not inherit properties from this orchestrating build.
+
+                      Independent of IsolatedBuildPath. Analysis is normally run together with
+                      IsolatedBuildPath so the analyzer build does not disturb real build output, but
+                      the two properties can be set independently.
+      Default value:  false
+      Allowed values: (true|false)
+    -->
+    <EnableAnalyzers Condition="'$(EnableAnalyzers)' == ''">false</EnableAnalyzers>
+    <EnableAnalyzersArgument Condition="'$(EnableAnalyzers.ToLower())' == 'true'">
+      -p:EnableAnalyzers=true
+    </EnableAnalyzersArgument>
+
+    <!--
+      InternalAnalyzers
+      Applies to:     Build* targets (driver and extension projects)
+      Description:    When true (and EnableAnalyzers is also true), additionally runs the internal
+                      Microsoft.Internal.Analyzers ("IA*") Roslyn rules (see the InternalAnalyzers
+                      block in src/Directory.Build.props). The Microsoft.Internal.Analyzers package
+                      is Microsoft-internal and confidential, so this flag is set ONLY by the private
+                      ADO.Net project pipelines, which have access to an internal NuGet feed. The
+                      public build and public CI never set it.
+
+                      Like EnableAnalyzers, it is forwarded into each leaf "dotnet build" (it is
+                      appended to EnableAnalyzersArgument) because the analyzers are
+                      compiler-integrated and must run in the leaf compile.
+      Default value:  false
+      Allowed values: (true|false)
+    -->
+    <InternalAnalyzers Condition="'$(InternalAnalyzers)' == ''">false</InternalAnalyzers>
+    <EnableAnalyzersArgument Condition="'$(EnableAnalyzers.ToLower())' == 'true' AND '$(InternalAnalyzers.ToLower())' == 'true'">$(EnableAnalyzersArgument)
+      -p:InternalAnalyzers=true
+    </EnableAnalyzersArgument>
+
+    <!--
+      InternalAnalyzersNugetConfig
+      Applies to:     Build* targets, only when InternalAnalyzers is true
+      Description:    Path to the analysis NuGet.config that adds the internal feed hosting
+                      Microsoft.Internal.Analyzers. It is forwarded into each leaf "dotnet build"
+                      as -p:RestoreConfigFile.
+      Default value:  [blank]
+    -->
+    <EnableAnalyzersArgument Condition="'$(EnableAnalyzers.ToLower())' == 'true' AND '$(InternalAnalyzers.ToLower())' == 'true' AND '$(InternalAnalyzersNugetConfig)' != ''">$(EnableAnalyzersArgument)
+      -p:RestoreConfigFile="$(InternalAnalyzersNugetConfig)"
+    </EnableAnalyzersArgument>
+
+    <!--
+      InternalAnalyzersVersion
+      Applies to:     Build* targets, only when InternalAnalyzers is true
+      Description:    Version of the Microsoft.Internal.Analyzers package to restore. It has no
+                      default (see Directory.Packages.props); the private ADO.Net pipeline pins it.
+      Default value:  [blank]
+    -->
+    <EnableAnalyzersArgument Condition="'$(EnableAnalyzers.ToLower())' == 'true' AND '$(InternalAnalyzers.ToLower())' == 'true' AND '$(InternalAnalyzersVersion)' != ''">$(EnableAnalyzersArgument)
+      -p:InternalAnalyzersVersion=$(InternalAnalyzersVersion)
+    </EnableAnalyzersArgument>
+
     <!--
       SigningKeyPath
       Applies to:     Build*, Pack* (driver targets only)
@@ -461,6 +567,8 @@
       <DotnetCommand>
         "$(DotnetPath)dotnet" build "$(SqlClientNotSupportedProjectPath)"
         -p:Configuration=$(Configuration)
+        $(IsolatedBuildArgument)
+        $(EnableAnalyzersArgument)
         -p:GenApiPath="@(GenApiArtifactPath->'%(FullPath)')"
         $(SigningKeyPathArgument)
 
@@ -493,6 +601,8 @@
       <DotnetCommand>
         "$(DotnetPath)dotnet" build $(SqlClientRefProjectPath)
         -p:Configuration=$(Configuration)
+        $(IsolatedBuildArgument)
+        $(EnableAnalyzersArgument)
         $(SigningKeyPathArgument)
 
         <!-- Versioning arguments -->
@@ -524,6 +634,8 @@
         "$(DotnetPath)dotnet" build $(SqlClientProjectPath)
         -p:Configuration=$(Configuration)
         -p:TargetOs=Unix
+        $(IsolatedBuildArgument)
+        $(EnableAnalyzersArgument)
         $(SigningKeyPathArgument)
 
         <!-- Versioning arguments -->
@@ -556,6 +668,8 @@
         "$(DotnetPath)dotnet" build $(SqlClientProjectPath)
         -p:Configuration=$(Configuration)
         -p:TargetOs=Windows_NT
+        $(IsolatedBuildArgument)
+        $(EnableAnalyzersArgument)
         $(SigningKeyPathArgument)
 
         <!-- Versioning Arguments -->
@@ -714,7 +828,7 @@
     </PropertyGroup>
     <Message Importance="High" Text=">>> Running manual tests for SqlClient"/>
     <Message Text="    Command: $(DotnetCommand)"/>
     <Exec ConsoleToMsBuild="true" Command="$(DotnetCommand)" />
   </Target>
 
   <!-- TestSqlClientUnit: Runs unit tests for SqlClient -->
@@ -743,7 +857,7 @@
     </PropertyGroup>
     <Message Importance="High" Text=">>> Running unit tests for SqlClient"/>
     <Message Text="    Command: $(DotnetCommand)"/>
     <Exec ConsoleToMsBuild="true" Command="$(DotnetCommand)" />
   </Target>
 
   <!-- ================================================================= -->
@@ -763,6 +877,8 @@
       <DotnetCommand>
         "$(DotnetPath)dotnet" build "$(AkvProviderProjectPath)"
         -p:Configuration=$(Configuration)
+        $(IsolatedBuildArgument)
+        $(EnableAnalyzersArgument)
         $(SigningKeyPathArgument)
 
         <!--Versioning arguments -->
@@ -846,6 +962,8 @@
       <DotnetCommand>
         "$(DotnetPath)dotnet" build "$(AbstractionsProjectPath)"
         -p:Configuration=$(Configuration)
+        $(IsolatedBuildArgument)
+        $(EnableAnalyzersArgument)
         $(SigningKeyPathArgument)
 
         <!-- Versioning arguments -->
@@ -951,6 +1069,8 @@
       <DotnetCommand>
         "$(DotnetPath)dotnet" build "$(AzureProjectPath)"
         -p:Configuration=$(Configuration)
+        $(IsolatedBuildArgument)
+        $(EnableAnalyzersArgument)
         $(SigningKeyPathArgument)
 
         <!-- Versioning arguments -->
@@ -1055,6 +1175,8 @@
       <DotnetCommand>
         "$(DotnetPath)dotnet" build $(LoggingProjectPath)
         -p:Configuration=$(Configuration)
+        $(IsolatedBuildArgument)
+        $(EnableAnalyzersArgument)
         $(SigningKeyPathArgument)
 
         <!-- Versioning arguments -->
@@ -1119,6 +1241,8 @@
       <DotnetCommand>
         "$(DotnetPath)dotnet" build $(SqlServerProjectPath)
         -p:Configuration=$(Configuration)
+        $(IsolatedBuildArgument)
+        $(EnableAnalyzersArgument)
         $(SigningKeyPathArgument)
 
         <!--Versioning arguments -->

eng/pipelines/common/templates/steps/override-sni-version.yml

@@ -42,6 +42,19 @@ steps:
       # add the new package source
       $packageSources.AppendChild($newSource)
 
+      # Exact mappings take precedence over the governed feed's wildcard, ensuring validation SNI
+      # packages are restored from this source. Both package IDs are externally produced and are
+      # therefore intentionally not eligible for the repository's local feed.
+      $packageSourceMapping = $xml.SelectSingleNode('//ns:packageSourceMapping', $nsm)
+      $newMapping = $xml.CreateElement("packageSource")
+      $newMapping.SetAttribute("key","SNIValidation")
+      foreach ($packageId in @("Microsoft.Data.SqlClient.SNI", "Microsoft.Data.SqlClient.SNI.runtime")) {
+        $package = $xml.CreateElement("package")
+        $package.SetAttribute("pattern", $packageId)
+        $newMapping.AppendChild($package)
+      }
+      $packageSourceMapping.AppendChild($newMapping)
+
       # save the xml file
       $xml.Save($NugetCfg)
       type $NugetCfg

eng/pipelines/onebranch/jobs/build-buildproj-job.yml

@@ -131,12 +131,13 @@ jobs:
       # such as _CheckPwshToolRestored that run during RoslynAnalyzers and Build.
       - template: /eng/pipelines/common/steps/restore-dotnet-tools.yml@self
 
-      # Perform Roslyn analysis before building, since this step will clobber build output.
+      # Run Roslyn analysis. This step is self-contained: it performs its own build into an
+      # isolated output location, so it can run at any point in the job without clobbering the
+      # real build output below.
       - template: /eng/pipelines/onebranch/steps/roslyn-analyzers-buildproj-step.yml@self
         parameters:
           dependencyArguments: $(dependencyPackageArguments)
           packageShortName: ${{ parameters.packageShortName }}
-          packageVersion: ${{ parameters.packageVersion }}
 
       # Build the package, producing DLLs only (no NuGet package yet).
       - template: /eng/pipelines/onebranch/steps/build-buildproj-step.yml@self

eng/pipelines/onebranch/sqlclient-non-official.yml

@@ -126,8 +126,29 @@ extends:
 
   parameters:
     featureFlags:
+      # WindowsHostVersion selects the Windows *host VM* that our Windows build container runs on.
+      # This is a separate layer from the container image itself (WindowsContainerImage in
+      # onebranch-variables.yml): the host is the outer machine running the Docker engine, and the
+      # container is where our build steps actually execute.
+      #
+      # These two must be kept compatible.  Windows containers can only run on a host whose OS
+      # version is compatible with the container's base image.  A mismatch (e.g. a 2025 container on
+      # a 2022 host) fails to start the container unless Hyper-V isolation is forced.
+      WindowsHostVersion:
+        Version: 2025
+
+      # We do NOT set a LinuxHostVersion.  Unlike Windows, Linux containers share the host kernel,
+      # so there is no host/container OS-version compatibility requirement to satisfy -- our Linux
+      # build image (LinuxContainerImage in onebranch-variables.yml) runs on the default OneBranch
+      # Linux host regardless of its distribution.
+
+      # CDPx is OneBranch's predecessor build system.  When EnableCDPxPAT is true (the OneBranch
+      # default), the governed templates inject a legacy CDPx Personal Access Token and its
+      # associated NuGet / Azure Artifacts authentication variables (CDP_DEFAULT_CLIENT_PAT,
+      # VSS_NUGET_ACCESSTOKEN, VSS_NUGET_URI_PREFIXES, etc.) into the build and Docker jobs so
+      # package restore against Azure DevOps feeds works without explicit auth.  We don't rely on
+      # that legacy CDPx package-authentication path, so we disable it.
       EnableCDPxPAT: false
-      WindowsHostVersion: 1ESWindows2022
 
     release:
       # This indicates the pipeline category to deploy Box products.  See:
@@ -231,6 +252,10 @@ extends:
 
       roslyn:
         # Note, requires RoslynAnalyzers task to be added as a separate step
+        # The Roslyn-specific Guardian collector/sanitizer requires SARIF v1, so our analysis build
+        # deliberately emits v1. Other, generic Guardian tooling expects SARIF v2 and may log
+        # processing errors (for example, Post Analysis's SDL artifact report) even though Roslyn
+        # collection and Guardian policy ingestion succeed.
         enabled: true
         break: ${{ parameters.breakOnSdlError }}
 
@@ -267,6 +292,7 @@ extends:
         #   TSA here does not by itself force breaking -- breakOnSdlError is what controls whether
         #   findings fail the build.
         enabled: false
+        # Keep this in sync with Official even though TSA is disabled here.
         configFile: '$(REPO_ROOT)/.config/tsaoptions.json'
 
     stages: