Roslyn has recently (June 2019) exposed a new API, DiagnosticSuppressor, which allows to suppress warnings programmatically. Is SonarQube planning to take advantage of this new API anytime soon? When running the latest version, with default configuration, the false-positive warnings are still triggered. I don’t know if I’m missing something or if it’s not implemented yet.
When dealing with code analysis in a Unity engine context, we were constrained to face false-positive warnings for a long time. The most common one is warning CS0649: Field 'NewBehaviourScript.x' is never assigned to, and will always have its default value null. It happens when you are actually assigning a variable through the Unity Editor inspector, if the said variable is decorated with [SerializeField] attribute, which allows variable assignation at editor-time even for private variables.
For more details about this issue, you can read this thread on Roslyn GitHub:
Until now, we had two options to get rid of these false-positive warnings: either insert pragma supress warning everywhere, or disable completely the related rule (with the obvious side of effect of hiding real positive warnings). Neither were satisfying.
In short, we’re still using Roslyn 1.3.2 API (see our csproj). We do this do be backwards compatible with VS 2015 Update 3 and older MSBuild versions (Roslyn comes bundled with MSBuild, so we do not control the runtime version of Roslyn).
We currently don’t have a concrete plan to update to the latest Roslyn version (although we have been discussing about this internally).