Salesforce Analyzer Code Scan

Owned by Christina
Last updated: May 31, 2022
3 min read

Prerequisites: To properly configure Salesforce Analyzer Code Scan in pipelines, you must first configure a Salesforce Analyzer Code Scan tool and a Jenkins tool in the Tool Registry.

Salesforce Analyzer Code Scan Tool Registry Configuration

  1. Create a new tool with Tool Type: Salesforce Code Analyzer.

  2. Navigate to the Validation Rules tab to add a new scan rule.

  3. Click + New SFDX Scan Rule and complete the form:

    Name - Provide a unique name for the Scan Rule
    Category - Select a Category. Choose from the following: Security, Best Practices, Performances, Code Style, Design, Documentation, Error Prone, ECMAScript6, Possible Errors, Variables, or Stylistic Issues.
    Threshold - Provide a number for threshold to be used against the Category selected. During the scan, if the number of vulnerabilities is higher than the threshold, the pipeline step will fail.
    Quality Gates - Select a Rule and Threshold/Count. If there are more vulnerabilities than the Threshold in the particular Rule, the Quality Gate will fail.



  4. Click Create to save the form.

Jenkins Tool Registry Configuration

  1. Navigate to a properly configured Jenkins tool and navigate to the Jobs tab.

  2. Click + New Jenkins Job and make the following selections in the form:

    Name - Provide a unique name for the job to be fetched in the Salesforce Code Analyzer. This will be fetched in the pipeline step.
    Job Type - Select Salesforce Code Analyzer from the drop-down list.

  3. Click Create to save the job.

Pipeline Configuration

  1. Create a new pipeline step and select Tool Type: Salesforce Code Analyzer. Save the step and then click the gear icon to configure it.

  2. In Step Configuration, make the following selections to configure the step:

    Step Tool - Select the configured Jenkins tool containing the Salesforce Code Analyzer job.
    Job - Select the Salesforce Code Analyzer job.
    Build/Package Step - Choose the pipeline step you wish to scan.
    Select Salesforce Scan Tool - Select the configured Salesforce Code Analyzer job.
    Quality Gates -

  3. Once the pipeline is configured properly, it can be triggered.

 

Pipeline Logs

  1. To view the results from the scan, view the Pipeline Activity Logs.

  2. Locate the column containing the Sfdx Code Scan Report and click it.

  3. View Summary and Execution details to analyze Quality Gates.

Â