sf-code-analyzer

Files (1)

• SKILL.md

SKILL.md (first lines)

# Salesforce Code Analyzer

## Prerequisites

| Tool | Check | Install |
|------|-------|---------|
| Salesforce CLI | `sf --version` | [https://developer.salesforce.com/tools/salesforcecli](https://developer.salesforce.com/tools/salesforcecli) |
| Code Analyzer plugin | `sf plugins inspect @salesforce/plugin-code-analyzer` | `sf plugins install @salesforce/plugin-code-analyzer` |

Before proceeding, ensure the plugin is installed:

```bash
sf plugins inspect @salesforce/plugin-code-analyzer 2>/dev/null || sf plugins install @salesforce/plugin-code-analyzer
```

---

## Active Job Monitoring (CRITICAL)

When you execute `sf code-analyzer run`, you MUST wait for it to complete.
**Never** ask the user to check the result or suggest reviewing later.
Report the full results including violation count, severity breakdown, and
affected files. If the analysis is long-running, monitor its progress.

---

## 1. Running Analysis (`sf code-analyzer run`)

### Basic Usage

```bash
# Analyze entire project
sf code-analyzer run --target force-app

# Analyze specific files (comma-separated)
sf code-analyzer run --target "force-app/main/default/classes/MyClass.cls,force-app/main/default/classes/MyService.cls"

# Analyze a directory
sf code-analyzer run --target force-app/main/default/classes
```

### Rule Selectors

Use `--rule-selector` to pick which engines and rule categories to apply:

| Engine | Selector | Covers |
|--------|----------|--------|
| PMD | `pmd:Recommended` | Best practices, code style |
| PMD | `pmd:Security` | SOQL injection, CRUD/FLS, XSS |
| PMD | `pmd:Performance` | SOQL/DML in loops, large queries |
| PMD | `pmd:Design` | Complexity, coupling, class size |
| ESLint | `eslint:Recommended` | JS best practices for LWC |
| ESLint | `eslint:Security` | DOM XSS, eval, unsafe patterns |
| RetireJS | `retire-js:Recommended` | Known vulnerable JS libraries |
| CPD | `cpd:Recommended` | Copy-paste / duplicate code detection |

```bash
# Apex: security + performance rules only
sf code-analyzer run --target force-app/main/default/classes \
  --rule-selector "pmd:Security,pmd:Performance"

# LWC: recommended + security
sf code-analyzer run --target force-app/main/default/lwc \
  --rule-selector "eslint:Recommended,eslint:Security"

# Full scan: all engines
sf code-analyzer run --target force-app \
  --rule-selector "pmd:Recommended,pmd:Security,pmd:Performance,pmd:Design,eslint:Recommended,eslint:Security,retire-js:Recommended,cpd:Recommended"
```

### Severity Threshold

Control which severity level blocks (returns exit code 2):

```bash
# Block only on HIGH/critical violations
sf code-analyzer run --target force-app --severity-threshold 1

# Block on HIGH and MEDIUM
sf code-analyzer run --target force-app --severity-threshold 2

# Block on any violation (HIGH, MEDIUM, LOW)
sf code-analyzer run --target force-app --severity-threshold 3
```

| Exit Code | Meaning |
|-----------|---------|
| 0 | No violations above threshold |
| 2 | Violations found at or above threshold severity |
| Other | Analyzer error (treat as non-blocking) |

### Output Formats

```bash
# Table (default, best for terminal)
sf code-analyzer run --target force-app --output-format table

# JSON (for programmatic processing)
sf code-analyzer run --target force-app --output-format json

# CSV (for spreadsheet analysis)
sf code-analyzer run --target force-app --output-format csv --output-file report.csv

# HTML (for sharing with stakeholders)
sf code-analyzer run --target force-app --output-format html --output-file report.html
```

---

## 2. Listing Rules (`sf code-analyzer rules list`)

Inspect available rules before running analysis:

```bash
# List all available rules
sf code-analyzer rules list

# Filter by engine
sf code-analyzer rules list --rule-selector "pmd:Security"

From jterratsdev/smart-deployment, BSD-3-Clause.

More from jterratsdev/smart-deployment