Add unsafe modifier migration code fixer

[EgorBo]

This PR adds new analyzers and codefixer (not yet shipping) that assists in migrating to the new unsafe-v2 rules ("unsafe evolution") and are supposed to be idempotent. This PR doesn't add a code-fixer that introduces new unsafe scopes/or unsafe-expressions as that ons is quite complex and will be added separately. So I tried to just rely on Roslyn's existing diagnostics and only introduced IL5005 and IL5006 (see below).

New analyzers/code-fixers

• AddUnsafeToExternCodeFixProvider fixes CS9389 by marking an extern member unsafe by default. Developers can replace it with safe after auditing the interop boundary.

• RemoveInvalidUnsafeCodeFixProvider fixes CS9377 and unsafe-specific CS0106 diagnostics by removing the compiler-reported meaningless or invalid unsafe modifier. (e.g. from class level)

• UnsafeMemberMissingSafetyDocumentationAnalyzer (IL5005) reports unsafe members without a <safety> XML comment. Members with pointer or function-pointer signatures are excluded because they were already effectively caller-unsafe under the legacy rules.

  • Basically, we assume that e.g. a unsafe void Foo() is coming from legacy rules where it used that unsafe to open a global unsafe scope if there is no <safety> comment.

• RemoveUndocumentedUnsafeCodeFixProvider a companion code-fixer for IL5005 defined above ^ by removing the undocumented unsafe modifier (we assume it's the unsafe-v1's global unsafe scope unsafe and not caller-unsafe).

• PointerSignatureRequiresUnsafeAnalyzer (IL5006) reports members with pointer or function-pointer signatures that are missing unsafe. A <safety> XML comment suppresses the diagnostic when the signature is intentionally safe, e.g. an API that never dereferences the pointer - ArgumentNullException.ThrowIfNull(void*).

• AddUnsafeToPointerSignatureCodeFixProvider fixes IL5006 ^ by adding the missing unsafe modifier.

• UnsafeMemberAnalysis and UnsafeModifierCodeFixHelpers contain the shared declaration, pointer-signature, documentation, and modifier-editing logic used by the focused components above.

Codes

• CS9389 [Roslyn] - An extern member must be explicitly marked unsafe or safe.
• CS9377 [Roslyn] - The unsafe modifier has no effect at this location under the updated memory safety rules.
• CS0106 [Roslyn] - The unsafe modifier is not valid for this item. This PR's fixer only activates when unsafe is the invalid modifier.
• IL5005 [This PR] - An unsafe member has no <safety> XML documentation. Pointer and function-pointer signatures are excluded for legacy compatibility.
• IL5006 [This PR] - A member with a pointer or function-pointer signature is missing unsafe, unless a <safety> comment documents why it is safe. (e.g. when in unsafe-v1 such methods relied on unsafe on the class level).

For follow ups

• Implement a code fixer for unsafe-context diagnostics CS9360, CS9361, CS9362, CS9363, and CS9376. It should introduce unsafe { /* SAFETY: Audit */ } blocks or unsafe(/* SAFETY: Audit */ ...) expressions

• Synchronize intentional caller-unsafe contracts across overrides, interface implementations, and partial declarations. This includes Roslyn's unsafe-to-safe mismatch diagnostics CS9364, CS9365, and CS9366, partial modifier mismatches CS0764 and CS9390, and the opposite migration case where an unsafe interface/base contract should be propagated to an implementation that is currently unannotated.

• Handle explicit/extended-layout fields and compiler-generated backing fields. CS9392 requires an explicit unsafe or safe marker, while CS9388 reports invalid safe usage. Migration should default to unsafe unless the developer has explicitly audited the field as safe.

• Figure out what to do with LibraryImport. Roslyn currently does not treat it as extern, safe cannot be applied to it, and its generated implementation is not compiled under the updated memory-safety rules. See safe keyword on LibraryImport roslyn#84555

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).
12 pipeline(s) were filtered out due to trigger conditions.
There may be pipelines that require an authorized user to comment /azp run to run.

[dotnet-policy-service]

Tagging subscribers to this area: @agocke, @dotnet/illink
See info in area-owners.md if you want to be subscribed.

[Copilot]

Pull request overview

Adds initial “unsafe modifier migration” support to the ILLink analyzer/codefix tooling (DEBUG-only), wiring a new IL5005-style diagnostic and a code fix that normalizes unsafe modifiers based on signature/docs, plus build plumbing to enable the feature via EnableUnsafeMigration.

Changes:

• Introduces UnsafeMigrationAnalyzer (IL5005) and UnsafeModifierMigrationCodeFixProvider to report/fix unsafe modifier normalization when EnableUnsafeMigration is enabled.
• Adds supporting shared diagnostic IDs/categories/strings and exposes EnableUnsafeMigration as a compiler-visible MSBuild property.
• Extends the existing analyzer/codefix test suite with targeted tests for the new diagnostic and fixer.

Reviewed changes

Copilot reviewed 11 out of 11 changed files in this pull request and generated 2 comments.

Show a summary per file

File	Description
src/tools/illink/test/ILLink.RoslynAnalyzer.Tests/RequiresUnsafeCodeFixTests.cs	Adds verifier helpers and new tests for the unsafe modifier migration diagnostic and code fix.
src/tools/illink/src/ILLink.Shared/SharedStrings.resx	Adds title/message resources for the new unsafe migration diagnostic.
src/tools/illink/src/ILLink.Shared/DiagnosticId.cs	Adds UnsafeModifierMigration (DEBUG-only) and maps it to a new diagnostic category.
src/tools/illink/src/ILLink.Shared/DiagnosticCategory.cs	Adds Unsafe diagnostic category (DEBUG-only).
src/tools/illink/src/ILLink.RoslynAnalyzer/UnsafeMigrationAnalyzer.cs	New analyzer that reports a single “file needs unsafe modifier migration” diagnostic when updates are detected.
src/tools/illink/src/ILLink.RoslynAnalyzer/UnsafeMigrationAnalysis.cs	New semantic analysis that computes which declarations should/shouldn’t have unsafe based on rules (docs/pointers/interop).
src/tools/illink/src/ILLink.RoslynAnalyzer/MSBuildPropertyOptionNames.cs	Adds EnableUnsafeMigration MSBuild property name (DEBUG-only constant).
src/tools/illink/src/ILLink.RoslynAnalyzer/build/Microsoft.NET.ILLink.Analyzers.props	Exposes EnableUnsafeMigration as a compiler-visible property.
src/tools/illink/src/ILLink.CodeFix/UnsafeModifierMigrationCodeFixProvider.cs	New code fix provider to apply modifier normalization across a document when enabled.
src/tools/illink/src/ILLink.CodeFix/Resources.resx	Adds the code fix title resource string.
eng/liveILLink.targets	Wires EnableUnsafeMigration into LiveILLink, enabling unsafe analyzer and setting the updated-memory-safety-rules feature flag.

[Copilot]

Pull request overview

Copilot reviewed 16 out of 16 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

src/tools/illink/test/ILLink.RoslynAnalyzer.Tests/RequiresUnsafeCodeFixTests.cs:130

• DiagnosticDescriptor.HelpLinkUri is a nullable string and DiagnosticDescriptors.GetDiagnosticDescriptor(...) passes helpLinkUri through directly. For these new diagnostics DiagnosticIdExtensions.GetHelpUri returns null, so descriptor.HelpLinkUri will be null and Assert.Empty(descriptor.HelpLinkUri) will fail. Use a null check (or string.IsNullOrEmpty) instead of Assert.Empty.

                DiagnosticDescriptor descriptor = DiagnosticDescriptors.GetDiagnosticDescriptor(diagnosticId);
                Assert.Equal("Unsafe", descriptor.Category);
                Assert.Empty(descriptor.HelpLinkUri);
            }