Verifying C# changes

• Security scanning Injection, unsafe APIs and tainted data reaching a sink.
  codeql 50% · 2 of 4 repos

  runs via GitHub Action github/codeql-action/analyze

  exit codes, docs, alternatives, where it runs

  • Runs inci
  • Seen inAzure/azure-powershell, octokit/octokit.net
  • Docshttps://github.com/github/codeql
• Secret scanning Credentials and tokens committed to the repository.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Dependency audit Known-vulnerable or disallowed dependencies and licenses.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Validate Security InputsApply security validation and gating at the boundaries of security-sensitive behavior: - Validate identifiers and API-version-like parame...

  Azure/azure-powershell Security C# cloud-infra 2026-07-27

  copy raw open
• Secure permission modelingWhen implementing security-related models such as permissions, carefully design the properties to prevent unauthorized modifications and ...

  octokit/octokit.net Security C# devtools 2023-01-06

  copy raw open
• Constant-time cryptographic validationAlways use constant-time comparison methods when validating cryptographic values to prevent timing side-channel attacks. Operations like ...

  dotnet/runtime Security C# runtimes 2025-07-01

  copy raw open
• Complete authentication testingAlways verify both positive and negative authentication scenarios in your security tests. For each authentication mechanism, test that cr...

  Azure/azure-sdk-for-net Security C# cloud-infra 2025-06-17

  copy raw open

• Type checking Wrong types, unhandled null or None, call signatures broken across modules.

  The compiler type-checks on every build and test run; a failing build is this check failing.

• Unit and integration tests Behaviour regressions on the paths the tests exercise.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Property-based tests Edge-case inputs nobody wrote a test for; invariants over generated data.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Specific exceptions with contextAlways throw the most specific exception type appropriate for the error condition and include contextual information in the error message...

  dotnet/runtime Error Handling C# runtimes 2025-07-02

  copy raw open
• Check before dereferencingAlways verify objects are not null before dereferencing them, particularly when using methods that might return null like FirstOrDefault(...

  Azure/azure-sdk-for-net Null Handling C# cloud-infra 2025-06-30

  copy raw open
• Use nullable for optionalsWhen a property or parameter represents an optional value that might be absent in requests or responses, use nullable types rather than n...

  octokit/octokit.net Null Handling C# devtools 2018-11-07

  copy raw open
• Null-Safe Inputs And MappingWhen a value is optional (or can differ by feature/region/constructor), never assume it’s present or non-empty. Apply consistent null/emp...

  Azure/azure-powershell Null Handling C# cloud-infra 2026-07-27

  copy raw open
• API versioning and client methodsWhen changing API clients, keep API versioning and HTTP operation semantics explicit and isolated. **Do** - **Scope ApiVersion changes** ...

  Azure/azure-powershell API C# cloud-infra 2026-07-16

  copy raw open

8 more in API, Error Handling, Null Handling — the playbook lists the top 12.

• Unit and integration tests Behaviour regressions on the paths the tests exercise.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Version and platform matrix Breakage on a runtime version, OS or feature combination you did not run locally.
  ci-matrix 25% · 1 of 4 repos

  analyze (language: 1)copy

  exit codes, docs, alternatives, where it runs

  • Runs inci
  • Seen inoctokit/octokit.net
  • Docshttps://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations

• Property-based tests Edge-case inputs nobody wrote a test for; invariants over generated data.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Fuzzing Crashes, panics and hangs on malformed input, especially in parsers and decoders.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Mutation testing Tests that keep passing whatever the code does.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Proofs and specifications Design-level bugs in protocols and algorithms, checked against a specification.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Optimize memory accessWhen implementing performance-critical algorithms, carefully consider memory access patterns. Document alignment assumptions when using l...

  dotnet/runtime Algorithms C# runtimes 2025-06-26

  copy raw open

• Concurrency model checking Races and orderings that fail only under specific interleavings.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Undefined-behaviour detection Memory-safety and aliasing violations in unsafe code.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Property-based tests Edge-case inputs nobody wrote a test for; invariants over generated data.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Avoid busy waitingWhen implementing concurrent code that waits for conditions to be met, avoid busy-wait loops that continuously consume CPU resources. Bus...

  dotnet/runtime Concurrency C# runtimes 2025-07-02

  copy raw open

• Unit and integration tests Behaviour regressions on the paths the tests exercise.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Fuzzing Crashes, panics and hangs on malformed input, especially in parsers and decoders.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• End-to-end browser tests User flows broken across components, routing and the network.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Linting Bug-prone patterns, unused code and conventions the formatter does not cover.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Unit and integration tests Behaviour regressions on the paths the tests exercise.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Version and platform matrix Breakage on a runtime version, OS or feature combination you did not run locally.
  ci-matrix 25% · 1 of 4 repos

  analyze (language: 1)copy

  exit codes, docs, alternatives, where it runs

  • Runs inci
  • Seen inoctokit/octokit.net
  • Docshttps://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations

No tool-based check applies. The review prompts below are the verification.

• Minimize memory allocationsReduce garbage collection pressure and improve application performance by avoiding unnecessary memory allocations. This significantly imp...

  Azure/azure-sdk-for-net Performance Optimization C# cloud-infra 2025-07-02

  copy raw open
• Cache expensive computationsAvoid recomputing expensive operations by caching results when they will be used multiple times. This applies to method calls, property a...

  dotnet/runtime Performance Optimization C# runtimes 2025-07-01

  copy raw open

• Unit and integration tests Behaviour regressions on the paths the tests exercise.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• CI workflow linting Broken GitHub Actions syntax, script injection, over-broad token permissions.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• File hygiene Invalid JSON, YAML or TOML, merge markers, trailing whitespace, oversized files.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Standardize environment variablesEnsure environment variable names are consistently spelled, properly referenced, and follow established naming conventions across test fi...

  Azure/azure-sdk-for-net Configurations C# cloud-infra 2025-06-25

  copy raw open
• Avoid manual SDK editsWhen working on CI/CD pipelines, treat anything under `*Management.Sdk/Generated/*` (or similarly generated folders) as read-only. **Stan...

  Azure/azure-powershell CI/CD C# cloud-infra 2026-07-14

  copy raw open
• Abstract configuration accessUse abstraction layers to access configuration settings rather than accessing environment variables, feature flags, or other configuratio...

  octokit/octokit.net Configurations C# devtools 2016-12-23

  copy raw open
• Feature flag implementationWhen implementing feature flags, ensure consistency between runtime and compiled scenarios. Feature switches marked with `FeatureSwitchDe...

  dotnet/runtime Configurations C# runtimes

  copy raw open

• Dependency audit Known-vulnerable or disallowed dependencies and licenses.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Lockfile consistency A lockfile that no longer matches its manifest.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Version and platform matrix Breakage on a runtime version, OS or feature combination you did not run locally.
  ci-matrix 25% · 1 of 4 repos

  analyze (language: 1)copy

  exit codes, docs, alternatives, where it runs

  • Runs inci
  • Seen inoctokit/octokit.net
  • Docshttps://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations

• Mutation testing Tests that keep passing whatever the code does.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Version and platform matrix Breakage on a runtime version, OS or feature combination you did not run locally.
  ci-matrix 25% · 1 of 4 repos

  analyze (language: 1)copy

  exit codes, docs, alternatives, where it runs

  • Runs inci
  • Seen inoctokit/octokit.net
  • Docshttps://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/run-job-variations

• Use specific assertionsAlways write assertions that verify specific, expected values rather than simple existence or boolean checks. This ensures tests validate...

  octokit/octokit.net Testing C# devtools 2018-06-20

  copy raw open
• Maintainable test structureWrite tests that are maintainable, self-documenting, and that promote good testing practices: 1. **Use proper assertion mechanisms**: Pre...

  dotnet/runtime Testing C# runtimes 2025-07-02

  copy raw open
• Write deterministic testsTests should be deterministic, reliable, and isolated from external dependencies to ensure consistent results across environments. To ach...

  Azure/azure-sdk-for-net Testing C# cloud-infra 2025-06-19

  copy raw open
• Unit tests for cmdlet pathsAdd isolated unit tests for cmdlet production paths using mocked client operations. Tests must validate more than a “happy path” scenario...

  Azure/azure-powershell Testing C# cloud-infra 2026-07-16

  copy raw open

• Docs build Broken cross-references, links and markup in documentation.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Spelling Typos in identifiers, comments and docs.

  No scanned repository in this language runs a tool for this. Lean on the review prompts.

• Document public API elementsEvery public API element (classes, methods, properties, constructors) must have XML documentation comments that clearly describe its purp...

  octokit/octokit.net Documentation C# devtools 2023-07-24

  copy raw open
• Document code reasoningAdd clear, concise comments that explain the "why" behind complex logic, non-obvious decisions, and implicit behaviors. Focus on document...

  Azure/azure-sdk-for-net Documentation C# cloud-infra 2025-06-25

  copy raw open
• Document code meaningfullyProvide meaningful documentation that enhances code maintainability and understanding. Follow these practices: 1. **Explain the "why"** -...

  dotnet/runtime Documentation C# runtimes 2025-06-27

  copy raw open
• Documentation Source And ToneWhen updating documentation (assembly metadata, cmdlet HelpMessage, generated stubs, etc.), ensure (1) you change the correct source of t...

  Azure/azure-powershell Documentation C# cloud-infra 2026-04-24

  copy raw open