What are Roslyn analysers and how do you use them to enforce rules in a team? Explain the compiler-as-a-platform idea (syntax trees, semantic model, operations), how built-in .NET analysers and code style rules are configured, BannedApiAnalyzers, and walk through writing and packaging a small custom DiagnosticAnalyzer.

How I would answer this in an interview

Roslyn analysers are compiler plug-ins that inspect code during compilation and report diagnostics (errors, warnings, suggestions), optionally with code fixes. They let a team turn conventions into automatic, enforced rules in the IDE and CI. I'd explain the compiler-as-a-platform idea, how built-in analysers and code style rules are configured, BannedApiAnalyzers, and how to write and package a small custom analyser.

1. Compiler as a platform

Roslyn exposes the compiler's internal models through public APIs:

• Syntax trees: the exact structure of source code (nodes, tokens, trivia like whitespace/comments). Immutable, full-fidelity.
• Semantic model: meaning — which symbol an identifier binds to, types of expressions, overload chosen, constant values, nullability.
• Symbols: INamedTypeSymbol, IMethodSymbol, IPropertySymbol… — declarations and references across the compilation (including referenced assemblies).
• Operations (IOperation): a language-neutral, semantic tree of what the code does (invocations, assignments, conversions) — the best level for most analysers because it's simpler than syntax and works for C# and VB.

Analysers register callbacks for syntax nodes, symbols, operations or whole compilations, and report Diagnostics. Code fix providers offer automatic rewrites. Source generators use the same APIs.

2. Built-in analysers and code style

The .NET SDK ships analysers (Microsoft.CodeAnalysis.NetAnalyzers) enabled by default:

• CAxxxx quality rules: e.g. CA1305 (culture), CA1848 (LoggerMessage), CA2000 (dispose), CA2007 (ConfigureAwait), CA2016 (forward CancellationToken), CA2200 (throw ex), CA1852 (seal internal types).
• IDExxxx code style rules: var preferences, expression bodies, naming, using placement, file-scoped namespaces.

Configuration:

<PropertyGroup>
  <AnalysisLevel>latest-recommended</AnalysisLevel>      <!-- none, default, minimum, recommended, all -->
  <EnforceCodeStyleInBuild>true</EnforceCodeStyleInBuild> <!-- IDE rules also run in dotnet build -->
  <TreatWarningsAsErrors>true</TreatWarningsAsErrors>
</PropertyGroup>

# .editorconfig
[*.cs]
dotnet_diagnostic.CA2016.severity = error
dotnet_diagnostic.CA1848.severity = warning
csharp_style_namespace_declarations = file_scoped:error
dotnet_style_qualification_for_field = false:warning

• .editorconfig (hierarchical, per folder) or .globalconfig for solution-wide severities.
• Directory.Build.props to apply MSBuild settings to all projects.
• #pragma warning disable / [SuppressMessage] for justified exceptions (with a justification).

Third-party packs: StyleCop.Analyzers, Roslynator, SonarAnalyzer, Meziantou.Analyzer, Microsoft.VisualStudio.Threading.Analyzers (async rules).

3. BannedApiAnalyzers

Microsoft.CodeAnalysis.BannedApiAnalyzers bans specific APIs with a message:

# BannedSymbols.txt (AdditionalFiles)
P:System.DateTime.Now;Use TimeProvider.GetLocalNow() so time can be tested.
M:System.Threading.Tasks.Task.Wait;Avoid blocking on tasks.
T:System.Net.WebClient;Use IHttpClientFactory.
M:Newtonsoft.Json.JsonConvert.SerializeObject(System.Object);Use System.Text.Json.

Using a banned symbol produces RS0030 with your message. It's the cheapest way to encode "we don't use X here" without writing an analyser.

4. Writing a small custom analyser

Example rule: "Don't call DbContext.SaveChanges() synchronously in async methods."

[DiagnosticAnalyzer(LanguageNames.CSharp)]
public sealed class SyncSaveChangesAnalyzer : DiagnosticAnalyzer
{
    public static readonly DiagnosticDescriptor Rule = new(
        id: "ORD001", title: "Use SaveChangesAsync in async methods",
        messageFormat: "Call SaveChangesAsync instead of SaveChanges inside async method '{0}'",
        category: "Usage", defaultSeverity: DiagnosticSeverity.Warning, isEnabledByDefault: true);

    public override ImmutableArray<DiagnosticDescriptor> SupportedDiagnostics => [Rule];

    public override void Initialize(AnalysisContext context)
    {
        context.ConfigureGeneratedCodeAnalysis(GeneratedCodeAnalysisFlags.None);
        context.EnableConcurrentExecution();
        context.RegisterOperationAction(ctx =>
        {
            var call = (IInvocationOperation)ctx.Operation;
            if (call.TargetMethod.Name != "SaveChanges") return;
            var dbContext = ctx.Compilation.GetTypeByMetadataName("Microsoft.EntityFrameworkCore.DbContext");
            if (dbContext is null || !InheritsFrom(call.TargetMethod.ContainingType, dbContext)) return;
            if (ctx.ContainingSymbol is IMethodSymbol { IsAsync: true } method)
                ctx.ReportDiagnostic(Diagnostic.Create(Rule, call.Syntax.GetLocation(), method.Name));
        }, OperationKind.Invocation);
    }

    private static bool InheritsFrom(ITypeSymbol? type, INamedTypeSymbol baseType)
    {
        for (; type is not null; type = type.BaseType)
            if (SymbolEqualityComparer.Default.Equals(type, baseType)) return true;
        return false;
    }
}

Then:

• Add a code fix provider that rewrites to await SaveChangesAsync(ct).
• Test with Microsoft.CodeAnalysis.Testing (CSharpAnalyzerTest<TAnalyzer, DefaultVerifier>) using markup like {|ORD001:db.SaveChanges()|}.
• Package: target netstandard2.0, reference Microsoft.CodeAnalysis.CSharp (matching the minimum Roslyn version you support) with PrivateAssets="all", and pack the DLL into analyzers/dotnet/cs in the NuGet package (<IncludeBuildOutput>false</IncludeBuildOutput> + a None item with PackagePath). Publish to your internal feed (Azure Artifacts) and reference it from Directory.Build.props.

5. A production example

Repeated production incidents came from missing cancellation tokens and synchronous EF calls in async code. We raised CA2016 to error, added Microsoft.VisualStudio.Threading.Analyzers (VSTHRD002/VSTHRD103), banned DateTime.Now and Task.Wait via BannedApiAnalyzers, and wrote a small ORD001 analyser for SaveChanges in async methods — all applied from Directory.Build.props and enforced in CI. Over a sprint the fixers resolved hundreds of findings automatically, and that class of incident stopped recurring.