How To Use Code Analysis to Analyse and Improve Your Code Quality

Code analysis is a powerful tool to improve your code quality. Follow this guide to learn how to use it effectively and write better code.

Code analysis tools analyze your code and managed assemblies against predefined rules and best practices and provide feedback on areas that need improvement. Code analysis provides information about violations of the programming and design rules outlined in the Microsoft .NET Framework Design Guidelines. They are warning messages to identify relevant programming and design issues, bugs, security vulnerabilities, and performance problems. When possible, code analysis will supply information about how to resolve issues.

You can use the code analysis tools in Visual Studio to discover potential issues in your code, such as non-secure data access, usage violations, and design problems. The Code Analysis window is available in all editions of Visual Studio 2013.

Code Analysis is a static analysis tool that searches for common patterns that may indicate something is wrong in the source code. For example, if an instance of a class which implements IDisposable is not disposed of properly, Code analysis will emit a warning:

private void DoSomething()
{
    var connection = new SqlConnection(...);
    this.ChangeSomeData(connection);
}

This is the correct implementation of the previous piece of code:

private void DoSomething()
{
    using (var connection = new SqlConnection(...))
    {
        this.ChangeSomeData(connection);
    }
}

Code Analysis is intended to find patterns which could be more convenient or tedious to find manually. For instance, in the previous example, it may not be exciting for a developer to check if any class they use implements IDisposable or to remember all .NET Framework classes which implement it.

Although it is subject to false positives, it is usually beneficial to target zero warnings for business-critical code without using suppressions. Within Visual Studio, Code Analysis can be configured to run at compile-time; if project settings also specify that warnings should be treated as errors, violations of Code analysis rules won't stay unnoticed.

Since static analysis can take some time for medium or large projects, moving it from the developer's machines to the TFS build server is often a good idea. While running Code analysis during pre-commit is not a good idea (unlike StyleCop), it can still run on build and fail if warnings are found.

Code analysis may be run manually from Visual Studio or the command line for non-business-critical code. The checks and warnings can be fine-grained in project properties to suit your needs. For instance, globalization warnings can be turned off if your project is not intended to be localized.

As with StyleCop, deciding whether the project will target zero warnings from Code analysis from the beginning of the project is essential. Introducing it in an existing project may be too painful.

After running your code analysis tool, it is important to review the results and address any identified issues carefully. This may involve refactoring code, fixing bugs, or making other changes to improve the quality of your codebase. It is important to prioritize the issues the tool identifies based on their severity and impact on your code. Some problems may be minor and can be addressed quickly, while others may require more significant changes to your code. By regularly analyzing and addressing the results of your code analysis, you can improve your codebase's overall quality and maintainability.

By regularly running code analysis on your code, you can catch potential problems early and improve the overall quality of your codebase.