The only way that semi-work and satisfies my requirements is the one that relies on git-controlled configuration residing in .sonarlint directory. According to this post, this way is being deprecated: SonarLint for Visual Studio v7.0 - Connected mode settings are moving to a new place. The new way of storing the bindings, moves them to %AppData%\Roaming\SonarLint for Visual Studio\Bindings, which does not work across IDEs
What I mean by “not working” is that if I set the binding using the Visual Studio and then switch to Rider IDE it does not detect that binding. I suspect, this happens either due to a bug or Rider seeking for the sonarlint config in a different location altogether (perhaps, .idea?)
In my opinion, the binding configuration should reside in .sonarlint the way it was done before. This decision has nothing to do with the way the access token is stored. Since access token is a secret, it indeed should be persisted in a different location, outside of the sonarlint settings. Look at how this problem is solved in Git. The configuration is defined hierarchically (~/.gitconfig being at the top and <repo>/.git at repo level and under), but it doesn’t contain the access tokens. The credentials are managed by a separate solution like Git Credential Manager.
I’d like to get assurances that the .sonarlint directory is not going away and will remain the first-class location for bindings. This is the only way my team can rely on for sharing via source control.