Apply dotnet format and harden autogenerated exclusion (#2927)

* Apply dotnet format and harden autogenerated exclusion

Two related changes:

1. src/.editorconfig: Set generated_code = true on the [/**/Autogenerated/**]
   section. This is the canonical Roslyn signal so analyzers and dotnet format
   skip these files entirely; without it, the existing six 'unset' overrides
   only suppress the base settings (charset, EOL, indent) and the C# style
   rules still cascade in from [*.cs]. With it, dotnet format leaves all 79
   files under src/Sarif/Autogenerated/ and src/Sarif/VersionOne/Autogenerated/
   untouched.

2. Repository-wide dotnet format pass against src/Sarif.Sdk.sln, applied
   under the unmodified existing .editorconfig style rules. 18 hand-written
   files changed. The bulk (647 of 656 whitespace-mode lines) is three files
   whose class members had a real 4-space indentation bug inside an 8-space
   class scope: Sarif/Visitors/InsertOptionalDataVisitor.cs,
   Sarif/Writers/ConsoleLogger.cs, Sarif/EnumeratedArtifact.cs. The
   remaining 15 files are small style-rule fixes the existing .editorconfig
   already enforces at error/warning severity (csharp_style_var_*,
   csharp_prefer_braces, dropping redundant 'public' from interface members,
   removing a single trailing blank line in a test file). No public API
   changes.

Build clean (0 warnings, 0 errors). All tests pass (1679 passed, 5 skipped).

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* CI: modernize check-format job to built-in dotnet format

Replaces the legacy standalone dotnet-format 5.x tool in the check-format
job of .github/workflows/validate.yml with the SDK built-in dotnet format
(added in .NET 6). The two formatters disagree on some C# 12+ constructs,
which caused CI failures that didn't reproduce locally because contributors
use the modern formatter while CI used the legacy one. This closes that gap.

* actions/checkout: v2 -> v4.
* Adds actions/setup-dotnet@v4 with dotnet-version 8.0.x to pin the
  formatter version.
* Replaces dotnet-format --folder --check --exclude .\src\Sarif\Autogenerated\
  with dotnet format whitespace src\Sarif.Sdk.sln --verify-no-changes
  --exclude src/Sarif/Autogenerated/.

The --exclude argument is now belt-and-braces redundant with
generated_code = true in src/.editorconfig (added in the prior commit on
this branch), but keeping it makes the autogen exclusion explicit at the
CI call site for readers of validate.yml.

Subsumes PR #2925.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Small tweaks to remove empty statements

* Fix CI: unused using and trailing whitespace

- SarifEventLogWriterReaderTests.cs: drop unused System.Collections.Generic (became unused when style pass changed List<SarifEvent> to var).

- AggregatingLogger.cs: strip trailing whitespace after 'using (logger as IDisposable)'.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* Emit precise drift diagnostic when CweSample fixture mismatches

On hash mismatch the test now prints: total sizes, CRLF/LF-only counts on each side, first divergent byte offset with a hex+ASCII window of context (32B before / 32B after), and the first 5 diverging line pairs after UTF-8 decode. Designed to surface cross-platform fixture drift causes (line endings, Unicode escapes, property-order swaps) directly in the xUnit log so we do not have to spin up a Linux repro to find them.

ComputeSha256 now takes byte[] (we already have the bytes in memory) instead of re-reading the file.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

* CweGenerateSample.ps1: switch JSON-bearing hashtables to [ordered]

Bare PowerShell @{} is a .NET Hashtable whose key enumeration order varies across process startups (per-process hash seed). When ConvertTo-Json serialized those hashtables, the resulting JSON property order changed between platforms / runs, which broke the CweGeneratedSampleTests determinism gate on macOS and Ubuntu (the fixture in main was originally generated on Windows where Hashtable happened to enumerate in insertion order).

[ordered]@{} (an OrderedDictionary) preserves insertion order on all platforms, so the script now produces byte-identical CweSample.sarif everywhere. The internal $events array hashtables are NOT serialized to JSON, so they're left as bare @{}; the [pscustomobject]@{} usages in the post-finalize patch block already preserve order natively.

Diagnosed in PR #2926; the script-level fix lands here in PR #2927 so the CweGeneratedSampleTests gate goes green on Linux/macOS without waiting on #2926's validation-rule changes.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

Author: michaelcfanning

.github/workflows/validate.yml

@@ -47,10 +47,12 @@ jobs:
     runs-on: windows-latest
     steps:
     - name: Check out code
-      uses: actions/checkout@v2
+      uses: actions/checkout@v4
 
-    - name: Install format tool
-      run: dotnet tool install -g dotnet-format
+    - name: Setup .NET
+      uses: actions/setup-dotnet@v4
+      with:
+        dotnet-version: 8.0.x
 
-    - name: dotnet format
-      run: dotnet-format --folder --check --exclude .\src\Sarif\Autogenerated\
+    - name: dotnet format (built-in)
+      run: dotnet format whitespace src\Sarif.Sdk.sln --verify-no-changes --exclude src/Sarif/Autogenerated/

src/.editorconfig

@@ -1,8 +1,11 @@
 # Remove the line below if you want to inherit .editorconfig settings from higher directories
 root = true
 
-# Ignore paths
+# Autogenerated source files: opt out of all analyzer/style/formatter enforcement.
+# generated_code = true is the canonical Roslyn signal so analyzers and dotnet format
+# skip these files. The unset overrides also disable the inherited core settings.
 [/**/Autogenerated/**]
+generated_code = true
 charset = unset
 end_of_line = unset
 insert_final_newline = unset

src/Sarif.Converters/PylintConverter.cs

@@ -61,7 +61,7 @@ internal Result CreateResult(PylintLogEntry defect)
                 default:
                     result.Level = FailureLevel.Note;
                     break;
-            };
+            }
 
             var region = new Region
             {

src/Sarif.Driver/Sdk/AggregatingLogger.cs

@@ -25,7 +25,9 @@ public void Dispose()
         {
             foreach (IAnalysisLogger logger in Loggers)
             {
-                using (logger as IDisposable) { };
+                using (logger as IDisposable)
+                {
+                }
             }
         }
 

src/Sarif.Driver/Sdk/MultithreadedAnalyzeCommandBase.cs

@@ -1546,7 +1546,8 @@ protected static void LogTrace(
 
         internal static bool IsTargetWithinFileSizeLimit(long size, long maxFileSizeInKB)
         {
-            if (size == 0) { return false; };
+            if (size == 0) { return false; }
+            ;
             size = Math.Min(long.MaxValue - 1023, size);
             long fileSizeInKb = (size + 1023) / 1024;
             return fileSizeInKb <= maxFileSizeInKB;

src/Sarif.Multitool.Library/IEnvironmentVariableGetter.cs

@@ -5,6 +5,6 @@ namespace Microsoft.CodeAnalysis.Sarif.Multitool
 {
     public interface IEnvironmentVariableGetter
     {
-        public string GetEnvironmentVariable(string variable);
+        string GetEnvironmentVariable(string variable);
     }
 }

src/Sarif.Multitool.Library/Rules/SARIF2004.OptimizeFileSize.cs

@@ -120,7 +120,7 @@ private void CheckSentinelIndex(int actualValue, string objectPointer, string pr
             // on deserialization) from "the producer literally wrote 'index: -1' in
             // the JSON" (the bloat case we want to flag). We only fire when the
             // property is physically present in the input log token.
-            JToken objectToken = objectPointer.ToJToken(Context.InputLogToken);
+            var objectToken = objectPointer.ToJToken(Context.InputLogToken);
             if (objectToken is JObject obj && obj.ContainsKey(propertyName))
             {
                 LogResult(

src/Sarif.WorkItems/SarifWorkItemFiler.cs

@@ -44,7 +44,7 @@ public SarifWorkItemFiler(Uri filingUri = null, SarifWorkItemContext filingConte
             this.FilingContext = filingContext ?? new SarifWorkItemContext { HostUri = filingUri };
             filingUri = filingUri ?? this.FilingContext.HostUri;
 
-            if (filingUri == null) { throw new ArgumentNullException(nameof(filingUri)); };
+            if (filingUri == null) { throw new ArgumentNullException(nameof(filingUri)); }
 
             if (filingUri != this.FilingContext.HostUri)
             {