Integrate Roslyn Analyzers with Vulnetix. Use the .NET SDK to run compiler-integrated analysis and produce SARIF output via MSBuild.
Install & scan
$ # Add the analyzer NuGet package dotnet add package Microsoft.CodeAnalysis.NetAnalyzers $ dotnet build /p:ErrorLog=roslyn.sarif,version=2
Run Roslyn Analyzers in CI
Scan on every push and upload the report as a workflow artifact:
- name: Build with analysis
run: dotnet build /p:ErrorLog=roslyn.sarif,version=2
- name: Upload report
uses: actions/upload-artifact@v6
with:
name: roslyn
path: roslyn.sarif
if-no-files-found: warnThen one publish job hands every artifact in the run to Vulnetix, recorded under Roslyn Analyzers's own name and version. Written once per workflow, however many scanners you run:
publish:
name: Publish to Vulnetix
runs-on: ubuntu-latest
needs: [scan] # every scanner job, or its report is never published
if: always() # or one failing scanner suppresses all the others
permissions:
contents: read
actions: read # required to list the run's artifacts
env:
VULNETIX_ORG_ID: ${{ secrets.VULNETIX_ORG_ID }}
VULNETIX_API_KEY: ${{ secrets.VULNETIX_API_KEY }}
steps:
- uses: actions/checkout@v5
- name: Install Vulnetix CLI
run: |
curl -fsSL https://cli.vulnetix.com/install.sh | sh -s -- --install-dir "$HOME/.local/bin"
echo "$HOME/.local/bin" >> "$GITHUB_PATH"
- name: Publish scanner reports
env:
GITHUB_TOKEN: ${{ github.token }}
run: vulnetix gha upload --org-id "$VULNETIX_ORG_ID" --jsonAfter the run, vulnetix gha status reports what was actually recorded.
How Vulnetix compares: better together
Vulnetix does not replace Roslyn Analyzers. Keep running it. Vulnetix sits on top of Roslyn Analyzers (and every other scanner you already own) turning disconnected tool outputs into one prioritised, fixable queue.
Roslyn Analyzers is strongest at its core category and also carries features in Compilers, Linters & Code Quality, just as Vulnetix spans categories.
| Capability | Vulnetix | Roslyn Analyzers |
|---|---|---|
| Security coverage | ||
| SAST (static code analysis) | ✓ Built-in rules + Semgrep augmentation | ✓ Core: compile-time C#/VB analysis; CA security rules cover SQLi, weak crypto, insecure deserialization, taint dataflow |
| SCA / dependencies | ✓ 40+ ecosystems, transitive graph | ✗ |
| DAST (dynamic testing) | ~ Ingests DAST results; no native dynamic engine | ✗ |
| Container & image | ✓ Image CVEs, base image, Dockerfile | ✗ |
| IaC / misconfiguration | ✓ Terraform, k8s, CloudFormation | ✗ |
| Secret scanning | ✓ 1,000+ rules, source + binary + git history | ✗ |
| Cloud / CSPM | ✓ Cloud-posture findings, compliance tab | ✗ |
| Mobile (MAST) | ~ Ingests mobile scanner output; no native mobile engine | ✗ |
| License compliance | ✓ SPDX, copyleft/AGPL/SSPL policy | ✗ |
| SBOM generation | ✓ CycloneDX 1.7 + SPDX 2.3, cosign-signable | ✗ |
| Malware / supply-chain | ✓ De-duplicated corpus + install-time firewall (25+ registries) | ✗ |
| Network / infra vuln | ~ Ingests network scanner output; no native network scanner | ✗ |
| Fuzzing | ✗ Ingests fuzzing crashes; no native fuzzer | ✗ |
| Pentest / bug bounty | ✗ Ingests pentest/bug-bounty findings; not a testing service | ✗ |
| The Vulnetix orchestration layer | ||
| Cross-scanner dedup & one queue (ASPM) | ✓ Correlates every scanner into one prioritised queue with ownership routing | ✗ |
| Exploit-intel prioritisation | ✓ EPSS, CISA KEV, Coalition ESS, CWSS, Vulnetix LEV | ✗ |
| Reachability analysis | ✓ Tree-sitter + CVEAffected; direct/transitive/semantic | ✗ |
| Versioned VEX + audit trail | ✓ Immutable OpenVEX/CycloneDX, cosign-signable | ✗ |
| Safe Harbour autofix | ✓ Resolves + applies the nearest safe version | ~ Many diagnostics ship associated code fixes / Quick Actions applied in-IDE |
| End-of-life policy | ✓ Flags/blocks past-EOL runtimes & packages | ✗ |
| SSVC / risk-based policy | ✓ SSVC v2 + CISA/FedRAMP/Essential-8 presets | ✗ |
✓ full · ~ partial · ✗ not covered
What Roslyn Analyzers does well
- Runs inside the .NET compiler at every build and as-you-type, so analysis is exact against the compiled semantic model with near-zero setup
- Ships hundreds of CA rules including a security family (CA2100 SQL injection, CA5350/CA5351 weak crypto, CA2300-series insecure deserialization, CA3xxx data-flow taint)
- Deep code-fix integration: many diagnostics come with one-click Quick Action auto-fixes in Visual Studio
- Extensible ecosystem (StyleCop, Roslynator, SonarAnalyzer) and EditorConfig-driven per-rule severity for build-gating
Where Vulnetix adds to it: Roslyn analyzers are .NET-only and compiler-bound; Vulnetix ingests their SARIF and unifies them with SCA, secrets, IaC, container and cloud findings across all languages, then adds EPSS/KEV exploit-intel, reachability and versioned VEX, orchestrating Roslyn rather than replacing its in-compiler checks.
No migration, no rip-and-replace. Roslyn Analyzers keeps doing what it does best; Vulnetix adds the orchestration, exploit-intelligence prioritisation and remediation layer built for the way AppSec works today.
Centralise Roslyn Analyzers results in Vulnetix
Upload Roslyn Analyzers SARIF output to the Vulnetix platform to deduplicate findings, prioritise them with EPSS, CISA KEV and Coalition ESS exploit intelligence, and track remediation across every scanner in a single queue.