Code Analyzer

The code analyzer linter runs Salesforce Code Analyzer against your project, providing static analysis through PMD, ESLint, and CPD engines. It identifies security issues, best practice violations, performance concerns, and duplicate code.

Overview

The code analyzer integrates Salesforce Code Analyzer into the project:analyze command and:

1. Detects the configuration file (or uses engine defaults)
2. Runs the configured engines (PMD, ESLint, CPD) against the target files
3. Collects results in SARIF format
4. Reports findings with file locations, line numbers, and rule details
5. Creates GitHub Checks with annotations when running in CI

Supported Engines

Engine	Language	What It Checks
pmd	Apex	Security, best practices, performance, design
eslint	LWC JavaScript / Aura	JavaScript quality, security, best practices
cpd	Apex, JavaScript	Copy-paste / duplicate code detection

Configuration

The code analyzer is configured through a YAML file that follows the Salesforce Code Analyzer v5 configuration format. The file is checked in priority order until the first match is found:

1. --code-analyzer-config <path> CLI flag
2. config/code-analyzer.yml
3. config/code-analyzer.yaml
4. .code-analyzer.yml
5. .code-analyzer.yaml

If no file is found, the default engine configuration is used (all engines with their built-in rule sets).

Schema

# config/code-analyzer.yml

engines:
  pmd:
    # Disable specific PMD rules by name
    disable_rules:
      - ApexUnitTestClassShouldHaveAsserts
      - AvoidDebugStatements

    # Custom PMD rule sets (paths relative to repo root or URLs)
    custom_rulesets:
      - config/pmd/custom-rules.xml

    # Java heap size for PMD (MB)
    java_max_heap: 1024

  eslint:
    # Path to ESLint config file
    config_file: config/.eslintrc.json

    # Additional plugins to load
    plugins:
      - '@salesforce/eslint-plugin-lwc'

  cpd:
    # Minimum number of duplicate tokens to report
    minimum_tokens: 100

    # File extensions to scan for duplicates
    language: apex

Examples

PMD-Only with Custom Rules

# config/code-analyzer.yml
engines:
  pmd:
    disable_rules:
      - ApexUnitTestClassShouldHaveRunAs
    custom_rulesets:
      - config/pmd/salesforce-best-practices.xml

Tighter Duplicate Detection

# config/code-analyzer.yml
engines:
  cpd:
    minimum_tokens: 75

Disable PMD Rules That Don't Apply

# config/code-analyzer.yml
engines:
  pmd:
    disable_rules:
      - ApexUnitTestClassShouldHaveRunAs
      - AvoidDebugStatements
      - ApexUnitTestClassShouldHaveAsserts

Integration with CI/CD

Integration is limited only to GitHub at the moment. The command needs GITHUB_APP_PRIVATE_KEY and GITHUB_APP_ID to be set in environment variables for results to be reported as GitHub checks.

# Run code analyzer and fail on issues
sfp project:analyze --fail-on code-analyzer --output-format github

# GitHub Actions
- name: Run Code Analysis
  run: |
    sfp project:analyze --fail-on code-analyzer --output-format github
  env:
    GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

Scoping Analysis

Use the same scoping options as other analysis commands:

# By package
sfp project:analyze --fail-on code-analyzer -p core,utils

# By domain
sfp project:analyze --fail-on code-analyzer -d sales

# By source path
sfp project:analyze --fail-on code-analyzer -s ./force-app/main/default

For full engine configuration options, see the Salesforce Code Analyzer documentation.