Do not output helplink for custom check diags

[JanKrivanek]

Context

Buildcheck is outputing helplinks as part of its diagnostics - e.g.:

warning BC0201: https://aka.ms/buildcheck/codes#BC0201 - Property: 'GITHUB_TOKEN' was accessed, but it was never initialized.

However the link is missleading for custom checks - as we do not have any help for those

warning DU0201: https://aka.ms/buildcheck/codes#DU0201 - Location: 'C:\Users\jankrivanek\Downloads\secrets-redaction-demo-main\secrets-redaction-demo-main' cannot be fully trusted, place your projects outside of that folder (Project: secrets-redaction-demo.csproj).

Changes Made

The help link is provided only for internaly reported diagnostics

Testing

Existing tests

[baronfel]

Alternatively we should allow for custom checks to register a help URL as part of their definitions/reports. We can decide separately to render that or not but the ability to link to external documentation is pretty fundamental to all modern diagnostic reporting experiences (see VS and VSCode problem displays for example).

[JanKrivanek]

Alternatively we should allow for custom checks to register a help URL as part of their definitions/reports. We can decide separately to render that or not but the ability to link to external documentation is pretty fundamental to all modern diagnostic reporting experiences (see VS and VSCode problem displays for example).

I was woried of security concerns. But now I can see there is a prior art for this: https://learn.microsoft.com/en-us/dotnet/api/microsoft.codeanalysis.diagnosticdescriptor.helplinkuri

Lm try to imporove here

[JanProvaznik]

I was woried of security concerns.

What is the concern? That users would click on links that seem trustworthy because they come from MSBuild or something else?

Perhaps we could wrap the link to something like https://aka.ms/CustomBuildCheck?name=<checkName>&helplink=<https://usersBClink.com> and that page would be just saying that this check is not microsoft provided and to proceed if you trust it.

[JanKrivanek]

I was woried of security concerns.

What is the concern? That users would click on links that seem trustworthy because they come from MSBuild or something else?

Perhaps we could wrap the link to something like https://aka.ms/CustomBuildCheck?name=<checkName>&helplink=<https://usersBClink.com> and that page would be just saying that this check is not microsoft provided and to proceed if you trust it.

Yes - exactly this

Let's wait with wrapping till we see some initial usages of cusom buildchecks