Add static analysis to find bugs earlier

[mbrukman]

I believe static analysis is a great complement to testing as it finds a different set of issues, faster, and often times, issues not found via unit or system testing because the issues are entirely different, e.g., security issues, or misuse of standard APIs, etc.

There are a number of options, whether open-source, commercial, or SaaS. Here are a sample of static analysis tools to consider:

• Gendarme, from the Mono project
• Coverity Scan is a commercial scanner, which is also offered as a service, and is free for open-source repositories; there are many open-source C# projects already using Coverity Scan
• a discussion about C# static analysis tools on Stack Overflow, with many recommendations
• a list of C# static analysis tools from another GitHub repo
• a list of C# static analysis tools on Wikipedia; doesn't look like there's anything relevant here

FWIW, I think Coverity may be a good one to start with, as it's a hosted SaaS product; integrating other tools may require building a dashboard or some other service to analyze and review the output, track outstanding vs. fixed issues, etc.

Alternatively, manually-run tools can be documented, and folks can run them on occasion, and file bugs that they find via the issue tracker.

Thoughts?

[jskeet]

I'm sure it's worth looking into, although I'm not sure at which point.

We'd definitely need to be able to inform any such scanner about our own tooling and requirements, e.g. GaxPreconditions.CheckNotNull for null parameter checking etc.

Assigning it P2 as it's important but not necessarily urgent.

[jskeet]

Closing for now having added this to the backlog