title: Excluding roslyn analyzer DLLs from production deployment
body: <p>With the introduction of Roslyn Analyzers, analyzers (and any dependencies) are now added to your Visual Studio project - one analyzer I added included 64 dependant packages. These DLLs are then included in the primary output of the project. Some of these DLLs will also be used by the project, but many will just be used by the analyzers.</p>
  
  <p>So if I created a deployment package using the Publish functionality (for a web site), or use some other build tool (e.g. OctoPack), all files (including all analyzers) from the primary output are included. My view is that you should only deploy code that is absolutely essential (i.e. minimize the attack surface).</p>
  
  <p>A couple of questions:</p>
  
  <ol>
  <li><p>How are people excluding analyzers from production installations especially if, for example, you are using the Publish function in Visual Studio.</p></li>
  <li><p>If you build a install package manually (e.g. using WIX), how do you determine which DLLs to exclude from your project.</p></li>
  </ol>