Add DiagnosticSuppressor (VSMEF013) for IDE0044 on MEF [Import]/[ImportMany] fields

[Copilot]

IDE0044 ("Make field readonly") fires false positives on fields injected by MEF at runtime via reflection. This adds a DiagnosticSuppressor — the Roslyn-recommended cross-package suppression mechanism — to silence IDE0044 on such fields.

Changes

• IDE0044ImportFieldSuppressor.cs — new DiagnosticSuppressor (ID: VSMEF013) that suppresses IDE0044 for fields bearing any [Import] or [ImportMany] attribute from the MEFv1 namespace. Walks the syntax tree from the diagnostic location to resolve the field symbol, then delegates attribute detection to a new Utils.IsImportFieldAttribute() (which handles only MEFv1 and derived custom attributes, since only MEFv1 supports importing fields).

• Strings.resx — adds VSMEF013_Justification suppression justification string.

• IDE0044ImportFieldSuppressorTests.cs — several test cases using a test-local FakeIDE0044Analyzer to produce IDE0044 in-process. Covers: MEF v1 [Import], MEF v1 [ImportMany], non-MEF fields (no suppression), and readonly fields.

• CSharpMultiAnalyzerVerifier+Test.cs — suppressor added to the multi-analyzer test harness.

• README.md — documents the new suppressor in a "Diagnostic Suppressors" table.

// Before: IDE0044 fires, suggesting to make the field readonly (breaks MEF injection)
[Import]
private IFoo _foo;

// After: IDE0044 is suppressed — VSMEF013 justification explains why
[Import]
private IFoo _foo;

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• 31bvsblobprodwus2143.vsblob.vsassets.io
  • Triggering command: /opt/hostedtoolcache/dotnet/dotnet dotnet restore --no-dependencies /tmp/codeql-scratch-9960d47625b9bdfe/dbs/csharp/working/5707D9CCD3909344C2384588AB311A3D/missingpackages_workingdir --packages /tmp/codeql-scratch-9960d47625b9bdfe/dbs/csharp/working/missingpackages /p:DisableImplicitNuGetFallbackFolder=true --verbosity normal --configfile /tmp/codeql-scratch-9960d47625b9bdfe/dbs/csharp/working/nugetconfig/nuget.config --force (dns block)
• b53vsblobprodwus2154.vsblob.vsassets.io
  • Triggering command: /opt/hostedtoolcache/dotnet/dotnet dotnet restore --no-dependencies /tmp/codeql-scratch-9960d47625b9bdfe/dbs/csharp/working/5707D9CCD3909344C2384588AB311A3D/missingpackages_workingdir --packages /tmp/codeql-scratch-9960d47625b9bdfe/dbs/csharp/working/missingpackages /p:DisableImplicitNuGetFallbackFolder=true --verbosity normal --configfile /tmp/codeql-scratch-9960d47625b9bdfe/dbs/csharp/working/nugetconfig/nuget.config --force (dns block)
• h8evsblobprodwus2120.vsblob.vsassets.io
  • Triggering command: /opt/hostedtoolcache/dotnet/dotnet /opt/hostedtoolcache/dotnet/dotnet exec --runtimeconfig /home/REDACTED/work/vs-mef/vs-mef/bin/Tests/Microsoft.VisualStudio.Composition.Analyzers.Tests/Release/net8.0/Microsoft.VisualStudio.Composition.Analyzers.Tests.runtimeconfig.json --depsfile /home/REDACTED/work/vs-mef/vs-mef/bin/Tests/Microsoft.VisualStudio.Composition.Analyzers.Tests/Release/net8.0/Microsoft.VisualStudio.Composition.Analyzers.Tests.deps.json /home/REDACTED/work/vs-mef/vs-mef/bin/Tests/Microsoft.VisualStudio.Composition.Analyzers.Tests/Release/net8.0/testhost.dll --port 46053 --endpoint 127.0.0.1:046053 --role client --parentprocessid 6219 --telemetryoptedin false (dns block)
• s8nvsblobprodwus2158.vsblob.vsassets.io
  • Triggering command: /opt/hostedtoolcache/dotnet/dotnet dotnet build src/Microsoft.VisualStudio.Composition.Analyzers/Microsoft.VisualStudio.Composition.Analyzers.csproj -c Release (dns block)
  • Triggering command: /opt/hostedtoolcache/dotnet/dotnet dotnet build test/Microsoft.VisualStudio.Composition.Analyzers.Tests/Microsoft.VisualStudio.Composition.Analyzers.Tests.csproj -c Release (dns block)
  • Triggering command: /opt/hostedtoolcache/dotnet/dotnet dotnet test test/Microsoft.VisualStudio.Composition.Analyzers.Tests/Microsoft.VisualStudio.Composition.Analyzers.Tests.csproj --no-build -c Release -- --filter-class IDE0044ImportFieldSuppressorTests (dns block)
• xofvsblobprodwus2114.vsblob.vsassets.io
  • Triggering command: /opt/hostedtoolcache/dotnet/dotnet dotnet restore --no-dependencies /tmp/codeql-scratch-9960d47625b9bdfe/dbs/csharp/working/5707D9CCD3909344C2384588AB311A3D/missingpackages_workingdir --packages /tmp/codeql-scratch-9960d47625b9bdfe/dbs/csharp/working/missingpackages /p:DisableImplicitNuGetFallbackFolder=true --verbosity normal --configfile /tmp/codeql-scratch-9960d47625b9bdfe/dbs/csharp/working/nugetconfig/nuget.config --force (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[Copilot]

Copilot encountered an error and was unable to review this pull request. You can try again by re-requesting a review.

[Copilot]

Pull request overview

Copilot reviewed 8 out of 8 changed files in this pull request and generated 5 comments.

[Copilot]

Pull request overview

Copilot reviewed 11 out of 11 changed files in this pull request and generated 4 comments.

Comments suppressed due to low confidence (1)

src/Microsoft.VisualStudio.Composition.Analyzers/README.md:20

• The suppressor is documented as applying to MEF [Import]/[ImportMany] in general, but the implementation only checks MEF v1 (System.ComponentModel.Composition) for field imports. Please clarify this description (e.g., explicitly call out MEF v1) to avoid implying the suppressor applies to System.Composition as well.

## Diagnostic Suppressors

Suppressor ID | Suppressed Diagnostic | Description
--|--|--
VSMEF013 | IDE0044 | Suppresses "Make field readonly" for fields decorated with MEF `[Import]` or `[ImportMany]` attributes, since such fields are assigned at runtime via reflection.