Some rules not activated for .NET Framework but only for .NET Core

[skrysmanski]

Analyzer

Diagnostic ID: various

Analyzer source

NuGet Package: Microsoft.CodeAnalysis.NetAnalyzers

Version: 8.0.0

Describe the bug

Even with <AnalysisMode>All</AnalysisMode> and dotnet_analyzer_diagnostic.severity = error, some rules (e.g. CA1031, CA2000) are not enabled for projects that target .NET Framework (but only for projects that target .NET Core).

Steps To Reproduce

1. Clone https://github.com/skrysmanski/reproducers
2. Open dotnet/ca-rules-not-applied/Reproducer.sln
3. Build solution

Expected behavior

The build process should report both CA1031 and CA2000 also for the .NET Framework target, not just for the .NET Core target.

Actual behavior

The build process reports CA1031 and CA2000 (and possibly many others as well) only for the .NET Core target.

Additional context

In the reproducer, I setup the C# project so that it builds to both net48 and net8.0. This is just to show the problem more easily and to show that the rules CA1031 and CA2000 should be enabled (as they're checked for net8.0).

In our actual code base, we only have net48 and so violations of CA1031 and CA2000 have gone completely unnoticed for quite some time (at least CA1031 used to work at some point in the past).

I'm using Visual Studio 2022 17.11.2, if that matters.

There's also some confusion (for me) regarding dotnet_analyzer_diagnostic.severity. The documentation states:

When you configure the severity level for multiple rules with a single entry, either for a category of rules or for all rules, the severity only applies to rules that are enabled by default. And if you enable all rules by using the MSBuild properties or , any bulk dotnet_analyzer_diagnostic options are ignored.

However, this seems to be wrong and also wouldn't make sense. As far as I understand it, using <AnalysisMode>All</AnalysisMode> simply enabled all rules - but keeps their severities as default (e.g. some info, some warn). And then, by additionally using dotnet_analyzer_diagnostic.severity = error, all of these rules get their severities changed to "error".

You can also see this in the reproducer. By commenting out dotnet_analyzer_diagnostic.severity = error, IDE0160 is no longer reported. So it seems that the documentation is wrong here.