Local Sonar reproduction reaches only one of six projects

[matt-edmondson]

Problem

CLAUDE.md documents the local SonarCloud reproduction and its limitation:

Known limitation: this currently only reaches Semantics.SourceGenerators, the one project declaring its SDK with the <Project Sdk="..."> attribute form. The ktsu.Sdk projects use <Project> with <Sdk Name="..." /> elements, and CustomBeforeMicrosoftCommonProps does not reach them. Findings in Semantics.Strings, Paths, Music, Color and Quantities still have to be read from SonarCloud.

So five of six projects get no local Sonar coverage, and their findings only surface after a push — the ~10 minute round trip the mechanism exists to avoid.

The limitation is removable

CustomBeforeMicrosoftCommonProps does not reach <Sdk Name="..." /> projects, but CustomAfterMicrosoftCommonProps does. Verified while wiring the same reproduction into ktsu-dev/CodeBlocker, whose projects all use the element form:

dotnet build -p:CustomAfterMicrosoftCommonProps=$PWD/.sonarlint/sonar-local.props

That injected SonarAnalyzer.CSharp successfully and reported real findings, which is how the three new issues on ktsu-dev/CodeBlocker#87 were identified without dashboard access.

CustomAfterMicrosoftCommonProps is imported after Microsoft.Common.props, which is still early enough for a PackageReference to be picked up by restore.

Suggested change

• Switch the documented invocation in CLAUDE.md and the comment in .sonarlint/sonar-local.props from CustomBeforeMicrosoftCommonProps to CustomAfterMicrosoftCommonProps, and drop the "Known limitation" paragraph.
• Confirm each project is actually analysed — easiest check is to introduce a deliberate violation of a raised rule in each and see it reported.
• Expect a first run over the five newly-covered projects to surface a backlog. Triaging it is separate work; this issue is about making the findings visible locally at all.

A caveat worth knowing

.sonarlint/sonar-local.globalconfig is tuned to what CI's quality profile reports — it raises rules the analyzer package ships disabled and silences S1481, which the package enables but CI does not report. That tuning was derived from this repository's profile. If a newly-covered project sits under a different profile the local set will not match exactly, so treat a clean local run as strong evidence rather than proof.

Acceptance criteria

• A local Sonar build analyses all six projects.
• CLAUDE.md no longer documents the limitation, and the invocation it gives is the one that works.

Context

Found while working #181, and recorded on that epic.