mirror of
https://github.com/forcedotcom/afv-library.git
synced 2026-07-30 19:50:42 +08:00
97 lines
2.5 KiB
YAML
97 lines
2.5 KiB
YAML
# GitHub Actions Workflow — Code Analyzer Quality Gate
|
|
#
|
|
# Scans pull requests for code quality and security violations.
|
|
# Uploads SARIF results to GitHub Code Scanning for inline annotations.
|
|
#
|
|
# Usage:
|
|
# Copy to .github/workflows/code-analyzer.yml in your repository
|
|
# Customize severity-threshold and rule-selector as needed
|
|
#
|
|
# Prerequisites:
|
|
# - Repository must have GitHub Advanced Security enabled for SARIF upload
|
|
# - Or remove the "Upload SARIF" step for basic artifact-only workflow
|
|
|
|
name: Code Analyzer
|
|
|
|
on:
|
|
pull_request:
|
|
branches: [main, develop]
|
|
paths:
|
|
- 'force-app/**'
|
|
- 'src/**'
|
|
- '**/*.cls'
|
|
- '**/*.trigger'
|
|
- '**/*.js'
|
|
- '**/*.ts'
|
|
- '**/*.html'
|
|
- '**/*.flow-meta.xml'
|
|
- 'code-analyzer.yml'
|
|
push:
|
|
branches: [main, develop]
|
|
|
|
permissions:
|
|
contents: read
|
|
security-events: write # Required for SARIF upload
|
|
|
|
jobs:
|
|
code-analysis:
|
|
runs-on: ubuntu-latest
|
|
timeout-minutes: 30
|
|
|
|
steps:
|
|
- name: Checkout code
|
|
uses: actions/checkout@v4
|
|
with:
|
|
fetch-depth: 0 # Full history for diff-based scans
|
|
|
|
- name: Set up Node.js
|
|
uses: actions/setup-node@v4
|
|
with:
|
|
node-version: '20'
|
|
|
|
- name: Set up Java
|
|
uses: actions/setup-java@v4
|
|
with:
|
|
distribution: 'temurin'
|
|
java-version: '11'
|
|
|
|
- name: Install Salesforce CLI
|
|
run: npm install -g @salesforce/cli
|
|
|
|
- name: Install Code Analyzer
|
|
run: sf plugins install @salesforce/plugin-code-analyzer
|
|
|
|
- name: Verify installation
|
|
run: |
|
|
sf --version
|
|
sf plugins --core | grep code-analyzer
|
|
java -version
|
|
node --version
|
|
|
|
- name: Run Code Analyzer
|
|
run: |
|
|
sf code-analyzer run \
|
|
--rule-selector Recommended \
|
|
--severity-threshold 2 \
|
|
--output-file results.sarif \
|
|
--output-file results.json \
|
|
--output-file results.html \
|
|
--config-file code-analyzer.yml
|
|
|
|
- name: Upload SARIF to GitHub Security
|
|
if: always()
|
|
uses: github/codeql-action/upload-sarif@v3
|
|
with:
|
|
sarif_file: results.sarif
|
|
category: code-analyzer
|
|
|
|
- name: Upload Results as Artifact
|
|
if: always()
|
|
uses: actions/upload-artifact@v4
|
|
with:
|
|
name: code-analyzer-results
|
|
path: |
|
|
results.json
|
|
results.html
|
|
retention-days: 30
|