olsh.me

What is Oleg Shevchenko's blog?

Oleg Shevchenko's blog is a personal, technically focused site by a .NET developer. It reads as a working notebook: short posts and notes on configuration problems, tooling workflows, and dependency security, often with a brief update appended years later when the advice changed. You can find it at Oleg Shevchenko's blog.

Who it is for

• .NET and ASP.NET developers, especially those working with MVC, IIS, and self-hosted build or quality servers.
• Team leads and DevOps-minded engineers who assemble toolchains from Jira, TeamCity, Octopus, and SonarQube.
• Readers who prefer a concrete fix or setup note over a long tutorial.

What it covers

The visible posts cluster around a few practical themes:

• Error handling in ASP.NET MVC 5 and IIS — custom error page configuration, framed by the author's observation that this is hard to get right, even for Microsoft.
• Release notes automation — generating release notes from Jira and TeamCity, including a note that the official Octopus plugin for TeamCity gained metadata generation support.
• Dependency vulnerability monitoring — using Snyk to continuously scan .NET Core projects, written because the .NET setup path was thinly documented at the time.
• Code quality integration — importing ReSharper issues into SonarQube, with a later note about a plugin option for self-hosted servers.

How to use it

Treat it as a starting point for a specific problem, not a structured course. If you are setting up custom error pages in an older MVC app, or wiring vulnerability scanning into a .NET Core pipeline, search the site for that topic first.

A practical example: you inherit an ASP.NET MVC 5 application where 404s and 500s show inconsistent pages in production. The relevant post gives you a configuration-oriented walkthrough rather than a general theory of error handling, which is usually what you want at that moment.

A decision criterion: check the post date and any update note before following instructions. Several entries are from 2018 and 2019 with later amendments, so verify commands and plugin behavior against current tool versions.

For broader context on the tools mentioned, see Snyk, Octopus Deploy, and SonarSource.

How do I configure custom error pages in ASP.NET MVC 5 and IIS?

Custom error pages in ASP.NET MVC 5 need to be configured in two layers: the MVC pipeline (for exceptions and missing actions/controllers) and IIS (for requests that never reach MVC, such as static files or blocked paths). Getting only one layer right is the usual reason people see IIS's default error page instead of their own.

Oleg Shevchenko's post on this topic is a practical starting point: Oleg Shevchenko's blog. He notes that this is genuinely fiddly to get right, even for Microsoft's own sites, which matches what most developers find.

Layer 1: MVC-level handling

• Turn on custom errors in Web.config with mode="On" (or RemoteOnly during development) and point defaultRedirect at a controller action, e.g. /Error/Index.
• Add [HandleError] (or a global filter registered in FilterConfig) so unhandled exceptions route to an error view. In MVC 5, global filters registered in Global.asax/FilterConfig are more reliable than per-controller attributes.
• Handle 404s for unmatched routes with a catch-all route ({*url}) that maps to an error action, plus httpErrors in Web.config for requests IIS handles before routing.
• Pass a status code to the response so search engines and clients see the real error, not a 200.

Layer 2: IIS-level handling

• Use the <httpErrors> element under <system.webServer> with errorMode="Custom" and existingResponse="Replace" (or PassThrough if your app already sets the body). This covers static files, extensionless URLs and paths blocked before MVC runs.
• Keep customErrors and httpErrors consistent — mismatched settings are a common source of "my page works locally but not on the server."
• On IIS 7+, Response.TrySkipIisCustomErrors = true in your error action prevents IIS from overwriting the MVC response.

Quick comparison

Practical next step

Pick one error action (say Error/Index) that accepts a status code, log the exception there, and test three cases explicitly: a thrown exception, an unknown URL, and a request for a missing .css file. If any of the three shows an IIS page, the IIS layer needs adjusting; if a thrown exception shows a yellow screen, the MVC filter or customErrors setting is the culprit.

How can I generate release notes using Jira and TeamCity?

The short answer is that Oleg Shevchenko's own post on this topic points to Octopus Deploy's official TeamCity plugin, which added support for generating release-note metadata from work items. His note is dated September 5, 2018, with an update on August 24, 2019, so treat it as a pointer to the Octopus workflow rather than a current step-by-step guide.

Oleg Shevchenko's blog

What the approach actually is

The pattern is: link Jira issues to commits or builds in TeamCity, let a release tooling layer collect those linked work items, and turn them into formatted notes attached to a release. Octopus Deploy is the piece Oleg highlights, because its TeamCity plugin can pull work-item metadata during a build.

A practical path

1. Make sure your commit messages or branch names reference Jira issue keys (for example PROJ-142).
2. Install the Octopus plugin for TeamCity and enable metadata/work-item generation in the build steps.
3. Create the release in Octopus so it can assemble the referenced issues into notes.
4. Review the generated notes before publishing — automatic collection often includes chores, spikes or reverted work you may not want in customer-facing notes.

Who this suits

• Teams already on the Jira + TeamCity + Octopus stack: lowest friction, since the integration is native.
• Teams on TeamCity but not Octopus: you can still query Jira's REST API from a build step and render notes yourself, but you own the formatting and error handling.
• Teams wanting polished, audience-specific notes: automatic generation is a starting draft, not a finished document.

For the official plugin details and current behaviour, see Octopus Deploy. Jira's own issue-linking and JQL documentation at Atlassian is useful if you decide to script the collection yourself.

How do I set up Snyk to monitor vulnerabilities in .NET Core projects?

Snyk scans a .NET Core project's dependency graph and alerts you when a package version you use has a known vulnerability. The practical approach is to run it as a CLI step in your build pipeline rather than relying only on manual checks.

Oleg Shevchenko's note on this blog covers exactly this setup and points out that Snyk's own documentation for .NET was thin at the time, so he walks through the configuration himself. Treat that post as the worked example and the points below as the surrounding decision framework.

Oleg Shevchenko's blog

What you actually need to do

1. Choose where scanning runs. Locally, a Snyk CLI command against the solution or project file gives fast feedback. In CI, the same command runs on every build and can fail the build on new findings. Most teams end up doing both.
2. Authenticate once per environment. The CLI needs a token tied to your Snyk account; in CI this lives in a secret, not in the repository.
3. Point it at the right manifest. For .NET Core that generally means the .csproj or solution file, since that is where package references live. If your project uses a packages.lock.json, scanning against the lock file gives more reproducible results than resolving versions fresh.
4. Decide the failure threshold. A useful starting point: fail the build only on high-severity issues with a known fix, and let lower-severity findings appear as warnings. Failing on everything on day one tends to get the check disabled within a week.
5. Schedule a recurring scan. Dependency vulnerabilities are disclosed after your code is written, so a build-time check alone misses anything published between releases. A nightly or weekly run against the default branch closes that gap.

Trade-offs worth knowing

The main limitation of any dependency scanner is that it sees declared packages, not what your code does with them. A vulnerable transitive package that you never call still shows up, so expect some triage noise. Conversely, a scanner will not flag vulnerable code you wrote yourself.

A concrete next step

Take one .NET Core solution, run the scan locally against the .csproj, and look at the finding count before deciding anything about CI. If the list is long, fix or suppress the high-severity items first and record the rest; that gives you a realistic baseline for a build gate. If you want a second opinion on the same dependency graph, GitHub's Dependabot alerts cover a similar problem for repositories hosted there, and comparing the two lists is a quick way to spot false positives.

How can I import ReSharper issues into SonarQube?

The short answer is that you generally route ReSharper findings into SonarQube as external issues rather than trying to make SonarQube run ReSharper itself. SonarQube has a generic import format for third-party analyzer results, and ReSharper (or its command-line sibling, InspectCode) can produce a report that you convert into that format.

Oleg Shevchenko's blog covers this in a post on importing ReSharper issues into SonarQube, with a 2019 update noting that if you run a self-hosted SonarQube server, a plugin is worth considering. That points to the two realistic paths below.

Two practical approaches

Plugin route (self-hosted SonarQube)

• A community plugin reads ReSharper/InspectCode output and creates external issues in SonarQube.
• Least custom work, but you are tied to plugin compatibility with your SonarQube version.
• Best when you control the server and can install plugins.

Generic external-issues route (any SonarQube, including SonarCloud)

• Run InspectCode in CI to produce an XML report.
• Convert that report into SonarQube's generic issue import JSON.
• Pass it to the scanner via the sonar.externalIssuesReportPaths property.
• More setup, but no server-side plugin and it works with hosted SonarQube.

Example flow in a .NET pipeline

1. Restore and build the solution.
2. Run InspectCode against the solution, writing an XML report.
3. Transform the XML into the generic issue JSON (issue key, rule, engine ID, severity, primary location with file path and line).
4. Invoke the SonarScanner with the external issues report path set.
5. Confirm the findings appear under the project's external issues, attributed to ReSharper.

A small transformation script is usually the main effort; keep the rule IDs stable so trends don't reset each build.

Decision criteria

One trade-off to expect: imported issues are treated as external, so they don't get SonarQube's own quality-profile management or remediation guidance. If code-quality gating matters more than preserving ReSharper's exact rule set, it is often simpler to enable SonarQube's C# analyzer and use ReSharper for local developer feedback instead.

What are the best practices for integrating Jira, TeamCity, and Octopus for metadata generation?

The short answer: let Jira remain the single source of truth for work items, let TeamCity attach that context to the build, and let Octopus carry it through to the deployment. Metadata generation is mostly about preserving the link between a commit, a build and a release, not about adding another dashboard.

Oleg Shevchenko's blog notes that the official Octopus plugin for TeamCity supports metadata generation, which is the practical starting point for a Jira + TeamCity + Octopus stack (Oleg Shevchenko's blog).

The integration chain

1. Jira — every commit message or branch name references an issue key. This is the only reliable way to connect code changes to work items later.
2. TeamCity — the build captures those issue keys from version control and passes them onward. The Octopus plugin for TeamCity is where this hand-off happens.
3. Octopus — the release and deployment records inherit the work item metadata, so a deployment can be traced back to the Jira issues it resolves.

Where teams usually get it wrong

• Treating metadata as a reporting afterthought rather than part of the build pipeline.
• Inconsistent commit conventions, which break issue-key extraction silently.
• Generating release notes manually when the chain above can produce them automatically.

A practical decision criterion

If you already run Jira + TeamCity + Octopus, enable the official TeamCity plugin for Octopus and confirm that issue keys flow from commits into the release record before you build any custom tooling. If you are on a different stack, the same principle applies: connect issue tracking to the build, then to the deployment, rather than duplicating the data in each tool.

For the broader vulnerability and dependency side of .NET pipelines, Snyk is worth evaluating as a complementary check (Snyk).