@salesforce/afv-skills 1.16.0 → 1.18.0

package/skills/configuring-code-analyzer/examples/ci-github-actions.yml

@@ -0,0 +1,96 @@
+# GitHub Actions Workflow — Code Analyzer Quality Gate
+#
+# Scans pull requests for code quality and security violations.
+# Uploads SARIF results to GitHub Code Scanning for inline annotations.
+#
+# Usage:
+#   Copy to .github/workflows/code-analyzer.yml in your repository
+#   Customize severity-threshold and rule-selector as needed
+#
+# Prerequisites:
+#   - Repository must have GitHub Advanced Security enabled for SARIF upload
+#   - Or remove the "Upload SARIF" step for basic artifact-only workflow
+
+name: Code Analyzer
+
+on:
+  pull_request:
+    branches: [main, develop]
+    paths:
+      - 'force-app/**'
+      - 'src/**'
+      - '**/*.cls'
+      - '**/*.trigger'
+      - '**/*.js'
+      - '**/*.ts'
+      - '**/*.html'
+      - '**/*.flow-meta.xml'
+      - 'code-analyzer.yml'
+  push:
+    branches: [main, develop]
+
+permissions:
+  contents: read
+  security-events: write  # Required for SARIF upload
+
+jobs:
+  code-analysis:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0  # Full history for diff-based scans
+
+      - name: Set up Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '20'
+
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+
+      - name: Install Salesforce CLI
+        run: npm install -g @salesforce/cli
+
+      - name: Install Code Analyzer
+        run: sf plugins install @salesforce/plugin-code-analyzer
+
+      - name: Verify installation
+        run: |
+          sf --version
+          sf plugins --core | grep code-analyzer
+          java -version
+          node --version
+
+      - name: Run Code Analyzer
+        run: |
+          sf code-analyzer run \
+            --rule-selector Recommended \
+            --severity-threshold 2 \
+            --output-file results.sarif \
+            --output-file results.json \
+            --output-file results.html \
+            --config-file code-analyzer.yml
+
+      - name: Upload SARIF to GitHub Security
+        if: always()
+        uses: github/codeql-action/upload-sarif@v3
+        with:
+          sarif_file: results.sarif
+          category: code-analyzer
+
+      - name: Upload Results as Artifact
+        if: always()
+        uses: actions/upload-artifact@v4
+        with:
+          name: code-analyzer-results
+          path: |
+            results.json
+            results.html
+          retention-days: 30

package/skills/configuring-code-analyzer/examples/fullstack-project-config.yml

@@ -0,0 +1,46 @@
+# Code Analyzer Configuration — Full-Stack Salesforce Project
+#
+# This file contains ONLY overrides. Code Analyzer's built-in defaults
+# handle everything else. Only add entries here that intentionally
+# change behavior for your project.
+#
+# Usage:
+#   Place at project root as code-analyzer.yml
+#   Validate: sf code-analyzer config --config-file code-analyzer.yml
+
+# Exclude non-project files
+ignores:
+  files:
+    - "**/node_modules/**"
+    - "**/.sfdx/**"
+    - "**/.sf/**"
+    - "**/jest-mocks/**"
+    - "**/__tests__/**"
+    - "**/*.min.js"
+    - "**/staticresources/jquery*"
+    - "**/staticresources/bootstrap*"
+
+# Engine tuning — only what differs from defaults
+engines:
+  # SFGE: increase heap for large Apex codebases
+  sfge:
+    java_max_heap_size: "4g"
+  # ESLint: use project's existing config for LWC-specific rules
+  eslint:
+    auto_discover_eslint_config: true
+
+# Rule overrides — only rules that need project-specific treatment
+rules:
+  pmd:
+    # Promote security rules (default is High → make Critical)
+    ApexCRUDViolation:
+      severity: 1
+    ApexSOQLInjection:
+      severity: 1
+    # Demote noisy documentation rule
+    ApexDoc:
+      severity: 5
+  eslint:
+    # Demote console warnings in development (default is Moderate)
+    no-console:
+      severity: 4

package/skills/configuring-code-analyzer/examples/lwc-project-config.yml

@@ -0,0 +1,26 @@
+# Code Analyzer Configuration — LWC-focused Project
+#
+# This file contains ONLY overrides. Code Analyzer's built-in defaults
+# handle everything else. Only add entries here that intentionally
+# change behavior for your project.
+#
+# Usage:
+#   Place at project root as code-analyzer.yml
+#   Validate: sf code-analyzer config --config-file code-analyzer.yml
+
+# Exclude non-project files and test infrastructure
+ignores:
+  files:
+    - "**/node_modules/**"
+    - "**/.sfdx/**"
+    - "**/.sf/**"
+    - "**/jest-mocks/**"
+    - "**/__tests__/**"
+    - "**/*.min.js"
+
+# Engine tuning
+engines:
+  # ESLint: opt-in to use project's existing ESLint config
+  # (built-in default is false — Code Analyzer uses its own base configs)
+  eslint:
+    auto_discover_eslint_config: true