MSBuild project SDKs that distill the Rocket Surgeons Guild build conventions into a single versioned package family — compiler defaults, analyzers, standardized editorconfigs, NuGet audit, source link, and Microsoft.Testing.Platform test wiring.

Pin the version once in global.json:

{
    "msbuild-sdks": {
        "Rocket.Surgery.Sdk": "2026.7.0",
        "Rocket.Surgery.Sdk.Test": "2026.7.0"
    }
}

<Project Sdk="Rocket.Surgery.Sdk">
    <PropertyGroup>
        <TargetFramework>net10.0</TargetFramework>
    </PropertyGroup>
</Project>

Or inline: <Project Sdk="Rocket.Surgery.Sdk/2026.7.0">.

#:sdk Rocket.Surgery.Sdk@2026.7.0

Console.WriteLine("Hello");

File-based apps are detected automatically and get a relaxed analyzer profile.

• LangVersion=preview, Features=strict, Nullable=enable, ImplicitUsings=enable, ProduceReferenceAssembly=true (unless it's a single-file app)
• Default TargetFramework (the SDK's newest, e.g. net10.0) — a csproj can be a single line
• AnalysisMode=AllEnabledByDefault, AnalysisLevel=latest, EnableNETAnalyzers=true
• GenerateDocumentationFile=true for regular projects (off for test/sample/single-file-app projects)
• Roslynator, BannedApiAnalyzers, PublicApiAnalyzers and Microsoft.CodeAnalysis.Analyzers injected (versions pinned by the SDK, individually overridable — see Injected package versions below)
• Shared editorconfig profiles (common, coding style, JetBrains, Roslynator, tests, samples, file-based apps, per-SDK-variant) applied as global analyzer configs — your own .editorconfig always wins
• NuGetAudit=true (mode all, level moderate)
• Source link / deterministic CI builds auto-detected via ContinuousIntegrationBuild (GitHub Actions, Azure DevOps, GitLab CI env vars); build-provenance AssemblyMetadata (commit SHA, run/job/pipeline IDs, etc.) is embedded automatically on those providers
• TreatWarningsAsErrors=true in CI and Release builds only; WarningsAsErrors always includes RS0017 (broken public API tracking)
• A BannedSymbols.txt (and, if not disabled, BannedSymbols.NewtonsoftJson.txt) is wired up automatically
• SBOM generation on pack, but only for packable projects in CI (Microsoft.Sbom.Targets, opt out with GenerateSBOM=false)
• Package validation: set PackageValidationBaselineVersion to your last released version to turn on EnablePackageValidation
• RollForward=LatestMajor for non-test executables; assemblies carry a RocketSurgery.Sdk.Name metadata attribute (when GenerateAssemblyInfo=true)
• Source-linked, portable-PDB, symbol-package defaults (EmbedUntrackedSources, IncludeSymbols, DebugType=portable)
• Publish/copy defaults: PublishRepositoryUrl, PublishDocumentationFile, PublishReferencesDocumentationFiles, PublishReferencesSymbols, CopyDebugSymbolFilesFromPackages, CopyDocumentationFilesFromPackages all default true
• Applied editorconfigs/BannedSymbols are embedded into -bl binary logs for diagnosability

Use Rocket.Surgery.Sdk (or Rocket.Surgery.Sdk.Test, which also sets IsTestProject=true and UseMicrosoftTestingPlatformRunner=true up front), then just reference your framework. Detection is automatic, based on your PackageReferences:

• TUnit → Rocket.Surgery.Extensions.Testing.TUnit

Every test project also gets Microsoft.Testing.Extensions.CrashDump, HangDump, TrxReport, HotReload, AzureDevOpsReport and GitHubActionsReport on by default, plus CodeCoverage in CI — with the matching command-line options wired through dotnet test automatically: crash/hang dumps (mini, 1-hour hang timeout), TRX reports, --report-azdo (Azure Pipelines) and --report-gh (GitHub Actions) — both are harmless no-ops outside their respective CI, and (once RsgSdk_Testing_Extensions is on) --minimum-expected-tests 1 so a run that discovers zero tests fails — set RsgSdk_Testing_MinimumExpectedTests=0 to disable. Coverage (cobertura, via the SDK's default coverage.runsettings, overridable with RunSettingsFilePath) is collected in CI by default; set RsgSdk_Testing_CodeCoverage=true to also collect locally, or =false to disable entirely. HotReload activates via TESTINGPLATFORM_HOTRELOAD_ENABLED=1 (set automatically by dotnet watch), not a command-line flag, so there's nothing to wire for it beyond the package reference. Analyzers are skipped when compiling for dotnet test (RocketSurgeryOptimizeTestBuild=true to enable — it's opt-in). Microsoft.Testing.Extensions.Retry is opt-in too: set RsgSdk_Testing_Retry=true and RsgSdk_Testing_RetryCount to the number of retries.

All defaults are guarded (Condition="'$(Property)' == ''"), so anything set in your project, Directory.Build.props, or the command line always wins.

Editorconfig profiles are also applied automatically per project shape — Tests.editorconfig when IsTestProject=true, Samples.editorconfig when IsSampleProject=true, SingleFileApp.editorconfig when RocketSurgerySingleFileApp=true, and (if one exists) editorconfig/$(RocketSurgerySdkName).editorconfig per SDK variant — none of these have their own opt-out property beyond RocketSurgeryEditorConfig.

IsSampleProject (default false, never set by the SDK — you opt in) relaxes packing, documentation, and RS0017 public-API tracking; see src/common/Common.targets.

Assemblies get a RocketSurgery.Sdk.Name metadata attribute whenever RocketSurgerySdkName is set (one fixed value per SDK package, e.g. Rocket.Surgery.Sdk.Web) and GenerateAssemblyInfo=true.

Framework adapters (Rocket.Surgery.Extensions.Testing.TUnit) are added automatically by inspecting your PackageReferences (TUnit) — there is no property to force them on or off independently of RsgSdk_Testing_Extensions.

There's no checked-in Packages.props to hand-maintain — common/Packages.props is generated at pack time (see src/Directory.Build.targets) from this repo's own Directory.Packages.props. Every PackageVersion / GlobalPackageReference whose package id starts with one of these prefixes is picked up automatically:

• Rocket.Surgery.Extensions.
• Microsoft.Testing.Extensions.
• Roslynator
• Microsoft.CodeAnalysis.
• Microsoft.Sbom.Targets (exact match)

Adding a new package to that list is enough to make the SDK inject a version default for it — no manual property to add or keep in sync. The generated property name follows a fixed pattern: strip the dots from the package id and wrap it as RsgSdk_<PackageIdNoDots>_Version. For example:

Every one of these is overridable the same way as any other SDK default — set the property in your project, Directory.Build.props, or on the command line before the SDK evaluates it. To see the full current list, either inspect common/Packages.props inside a packed nupkg, or run dotnet build -getProperty:RsgSdk_RoslynatorAnalyzers_Version (etc.) against a consumer project.

ContinuousIntegrationBuild is forced false during design-time builds; otherwise it's left for the normal SDK/CI-provider detection to set. When TF_BUILD, GITHUB_ACTIONS, or GITLAB_CI is present, the matching ci/*.targets file also adds provenance AssemblyMetadata items (commit SHA, run/job/pipeline/build IDs, repository info, etc.) pulled from that provider's environment variables.

Migrating a repo that used GlobalPackageReference for these analyzers? Remove those entries — the SDK injects them.

Versions follow <year>.<month>.<build> (e.g. 2026.7.1) and a release is published weekly by GitHub Actions using NuGet Trusted Publishing (OIDC — no API keys). One-time setup: on nuget.org, add a trusted publishing policy for RocketSurgeonsGuild/rsg-sdk with workflow release.yml.