It can be a little confusing to understand the differences between legacy FxCop (binary analysis) and .NET analyzers (source analysis). This article aims to address some of questions you might have.
What's the difference between legacy FxCop and .NET analyzers?
Legacy FxCop runs post-build analysis on a compiled assembly. It runs as a separate executable called FxCopCmd.exe. FxCopCmd.exe loads the compiled assembly, runs code analysis, and then reports the results (or diagnostics).
.NET analyzers are based on the .NET Compiler Platform ("Roslyn"). You enable them from the .NET SDK or install them as a NuGet package that's referenced by the project or solution. Analyzers run source-code based analysis during compiler execution. Analyzers are hosted within the compiler process, either csc.exe or vbc.exe, and run analysis when the project is built. Analyzer results are reported along with compiler results.
What's the difference between FxCop analyzers and .NET analyzers?
Both FxCop analyzers and .NET analyzers refers to the .NET Compiler Platform ("Roslyn") analyzer implementations of FxCop CA rules. Prior to Visual Studio 2019 16.8 and .NET 5.0, these analyzers shipped as Microsoft.CodeAnalysis.FxCopAnalyzers NuGet package. Starting in Visual Studio 2019 16.8 and .NET 5.0, these analyzers are included with the .NET SDK. They are also available as Microsoft.CodeAnalysis.NetAnalyzers NuGet package. Please consider migrating from FxCop analyzers to .NET analyzers.
Does the Run Code Analysis command run .NET analyzers?
Prior to Visual Studio 2019 16.5 release, when you select Analyze > Run Code Analysis, it executes legacy analysis. Starting Visual Studio 2019 16.5, Run Code Analysis menu option executes Roslyn-based analyzers for the selected project or solution. If you have installed .NET analyzers, they would also be executed. For more information, see How to: Run Code Analysis Manually for Managed Code.
Does the RunCodeAnalysis msbuild project property run analyzers?
No. The RunCodeAnalysis property in a project file (for example, .csproj) is only used to execute legacy FxCop. It runs a post-build msbuild task that invokes FxCopCmd.exe.
So how do I run .NET analyzers then?
To run .NET analyzers, first enable them from the .NET SDK or install them as a NuGet package. Then build your project or solution from Visual Studio or using msbuild. The warnings and errors that the Roslyn analyzers generate will appear in the Error List or the command window.
I get warning CA0507 even after I've installed the .NET analyzers NuGet package
If you've installed .NET analyzers but continue to get warning CA0507 ""Run Code Analysis" has been deprecated in favor of FxCop analyzers, which run during build", you might need to set the RunCodeAnalysis msbuild property in your project file to false. Otherwise, legacy analysis will execute after each build.
<RunCodeAnalysis>false</RunCodeAnalysis>
Which rules have been ported to .NET analyzers?
For information about which legacy analysis rules have been ported to .NET analyzers, see Fxcop rule port status.
Code analysis warnings are treated as errors
If your project uses the build option to treat warnings as errors, analyzer warnings might appear as errors. To prevent code analysis warnings from being treated as errors, follow the steps at Code analysis FAQ.