Scanner

Scan a real .NET solution with `di-scan`

Build any solution with DependencyInjection.Lifetime.Analyzers injected, without editing its project files. Get ruleId path:line:column, the surrounding source, SARIF, Markdown, and HTML reports, baselines, and CI-friendly severity gates.

Install di-scan from NuGet Browse 37 rules

DI Scan HTML report showing DI003, DI006, DI009, DI016, DI019, and DI012b findings with source context — The self-contained HTML report groups findings by rule and shows the source around every hit.

Install

No project changes

With the .NET 10 SDK, run it without installing:

dnx DependencyInjection.Lifetime.Analyzers.Scan -- MyApp.slnx

With the .NET 8 or 9 SDK, install the tool:

dotnet tool install -g DependencyInjection.Lifetime.Analyzers.Scan --version 3.10.1

di-scan MyApp.slnx

The scanner builds the target with the analyzer injected, then removes the injection. Your repository is not modified.

What it reports

Actionable findings, not a wall of warnings

Rule ID, severity, title, and count for every rule that fired.
path:line:column, the diagnostic message, and the surrounding source.
A direct link to the rule page under docs/rules/.
SARIF 2.1.0 for GitHub code scanning or any SARIF viewer.
Self-contained HTML and Markdown for triage and pull-request comments.
Suppressed diagnostics are omitted, just like a normal build.

Outputs

Choose the surface for the job

Output	Use it for
Terminal	Immediate review of the rules, locations, messages, and source lines.
SARIF	GitHub code scanning, IDE ingestion, and fingerprint-based baselines.
Markdown	Pull-request comments, job summaries, and release reports.
HTML	False-positive triage with search, severity filters, and code context.

Baselines

Fail only on new findings

Generate a baseline once, commit it, and let CI fail only when a new finding appears. SARIF baselines match by fingerprint, so a finding that moves down a file stays known. Text baselines match by rule and exact location. Use --update-baseline di.baseline to write one.

di-scan ./MyApp.slnx --fail-on warning --sarif di.sarif
di-scan ./MyApp.slnx --fail-on warning --baseline di.sarif --sarif di-new.sarif

Review what the build would miss

Apply the safe code fixes with --fix before reviewing the rest. Use the scanner before adding the package, compare two analyzer releases, or keep a scheduled precision check on a pinned public corpus. In GitHub Actions it also writes the job summary and annotates the most severe findings.

dnx DependencyInjection.Lifetime.Analyzers.Scan -- ./MyApp.slnx   --fail-on warning --sarif di.sarif --summary di.md

Proof

Tested against real repositories

The scanner and rules are regression-tested against 14 pinned public repositories and 471 findings, including ASP.NET Core apps, framework libraries, workers, open generics, keyed services, and alternate containers. The corpus has already driven precision fixes in DI001, DI006, DI015, and DI019.

Install di-scan Corpus and triage notes

Keep going

Install the analyzer after the scan

The scanner is a try-before-you-install tool. When the results are clean enough for your policy, add the analyzer package so the same rules run in the editor and every build.

dotnet add package DependencyInjection.Lifetime.Analyzers --version 3.10.1

Scan a real .NET solution with di-scan