mirror of
https://github.com/forcedotcom/afv-library.git
synced 2026-07-30 19:50:42 +08:00
334 lines
9.6 KiB
Markdown
334 lines
9.6 KiB
Markdown
# Common Command Variations
|
|
|
|
Real-world command patterns with explanations. Use these as reference when building commands for specific scenarios.
|
|
|
|
---
|
|
|
|
## Basic Scans
|
|
|
|
### 1. Scan Entire Workspace (Default)
|
|
```bash
|
|
sf code-analyzer run \
|
|
--rule-selector Recommended \
|
|
--output-file ./code-analyzer-results-20260519-101030.json \
|
|
--include-fixes \
|
|
2>&1 | tee ./code-analyzer-results-20260519-101030.log
|
|
```
|
|
**When:** User says "scan my code" with no specifics.
|
|
|
|
---
|
|
|
|
### 2. Security-Focused Scan
|
|
```bash
|
|
sf code-analyzer run \
|
|
--rule-selector "all:Security:(1,2)" \
|
|
--output-file ./code-analyzer-results-20260519-101030.json \
|
|
--include-fixes \
|
|
2>&1 | tee ./code-analyzer-results-20260519-101030.log
|
|
```
|
|
**When:** User says "check for security issues", "find vulnerabilities", "AppExchange security review".
|
|
**Selector breakdown:** `all` = all engines, `:Security` = Security category only, `:(1,2)` = Critical and High severity only.
|
|
|
|
---
|
|
|
|
### 3. Specific Engine
|
|
```bash
|
|
sf code-analyzer run \
|
|
--rule-selector "pmd" \
|
|
--output-file ./code-analyzer-results-20260519-101030.json \
|
|
--include-fixes \
|
|
2>&1 | tee ./code-analyzer-results-20260519-101030.log
|
|
```
|
|
**When:** User says "run PMD", "check my Apex code".
|
|
|
|
---
|
|
|
|
### 4. Multiple Engines
|
|
```bash
|
|
sf code-analyzer run \
|
|
--rule-selector "(pmd,eslint)" \
|
|
--output-file ./code-analyzer-results-20260519-101030.json \
|
|
--include-fixes \
|
|
2>&1 | tee ./code-analyzer-results-20260519-101030.log
|
|
```
|
|
**When:** User says "scan Apex and JavaScript", "run PMD and ESLint".
|
|
**Selector breakdown:** Parentheses + comma = OR logic.
|
|
|
|
---
|
|
|
|
## Target-Specific Scans
|
|
|
|
### 5. Scan Specific File
|
|
```bash
|
|
sf code-analyzer run \
|
|
--rule-selector Recommended \
|
|
--target "force-app/main/default/classes/AccountService.cls" \
|
|
--output-file ./code-analyzer-results-20260519-101030.json \
|
|
--include-fixes \
|
|
2>&1 | tee ./code-analyzer-results-20260519-101030.log
|
|
```
|
|
**When:** User says "scan AccountService.cls".
|
|
|
|
---
|
|
|
|
### 6. Scan Specific Folder
|
|
```bash
|
|
sf code-analyzer run \
|
|
--rule-selector Recommended \
|
|
--target "force-app/main/default/lwc" \
|
|
--output-file ./code-analyzer-results-20260519-101030.json \
|
|
--include-fixes \
|
|
2>&1 | tee ./code-analyzer-results-20260519-101030.log
|
|
```
|
|
**When:** User says "scan my LWC components", "check the lwc folder".
|
|
|
|
---
|
|
|
|
### 7. Scan Multiple Paths
|
|
```bash
|
|
sf code-analyzer run \
|
|
--rule-selector Recommended \
|
|
--target "force-app/main/default/classes,force-app/main/default/triggers" \
|
|
--output-file ./code-analyzer-results-20260519-101030.json \
|
|
--include-fixes \
|
|
2>&1 | tee ./code-analyzer-results-20260519-101030.log
|
|
```
|
|
**When:** User says "scan classes and triggers".
|
|
**Note:** Comma-separated paths in a single `--target` value.
|
|
|
|
---
|
|
|
|
### 8. Scan Using Glob Pattern
|
|
```bash
|
|
sf code-analyzer run \
|
|
--rule-selector Recommended \
|
|
--target "**/*.cls,**/*.trigger" \
|
|
--output-file ./code-analyzer-results-20260519-101030.json \
|
|
--include-fixes \
|
|
2>&1 | tee ./code-analyzer-results-20260519-101030.log
|
|
```
|
|
**When:** User says "scan all Apex files", "check all classes and triggers".
|
|
**Note:** Glob patterns must match from workspace root.
|
|
|
|
---
|
|
|
|
## Diff-Based Scans
|
|
|
|
### 9. Scan Changed Files (Git Diff)
|
|
**Step 1:** Get changed files
|
|
```bash
|
|
git diff --name-only main...HEAD
|
|
```
|
|
|
|
**Step 2:** Filter to scannable types (`.cls`, `.trigger`, `.js`, `.ts`, `.flow-meta.xml`, etc.)
|
|
|
|
**Step 3:** Pass as `--target`
|
|
```bash
|
|
sf code-analyzer run \
|
|
--rule-selector Recommended \
|
|
--target "force-app/main/default/classes/AccountService.cls,force-app/main/default/lwc/accountCard/accountCard.js" \
|
|
--output-file ./code-analyzer-results-20260519-101030.json \
|
|
--include-fixes \
|
|
2>&1 | tee ./code-analyzer-results-20260519-101030.log
|
|
```
|
|
**When:** User says "scan my changes", "check what I modified", "analyze the diff".
|
|
|
|
---
|
|
|
|
## Advanced Scenarios
|
|
|
|
### 10. Deep Analysis with SFGE (Data Flow)
|
|
```bash
|
|
sf code-analyzer run \
|
|
--rule-selector "sfge" \
|
|
--workspace "force-app" \
|
|
--output-file ./code-analyzer-results-20260519-101030.json \
|
|
--include-fixes \
|
|
2>&1 | tee ./code-analyzer-results-20260519-101030.log
|
|
```
|
|
**When:** User says "deep analysis", "data flow analysis", "path-based analysis", "find CRUD violations with certainty".
|
|
**Note:** Requires Java 11+. May take 10-20 minutes. Use `--workspace` to avoid compiling template files.
|
|
**Timeout:** Set to 1200000ms (20 minutes).
|
|
|
|
---
|
|
|
|
### 11. Find Code Duplicates (CPD)
|
|
```bash
|
|
sf code-analyzer run \
|
|
--rule-selector "cpd" \
|
|
--output-file ./code-analyzer-results-20260519-101030.json \
|
|
--include-fixes \
|
|
2>&1 | tee ./code-analyzer-results-20260519-101030.log
|
|
```
|
|
**When:** User says "find duplicates", "check for copy-paste", "detect code clones".
|
|
|
|
---
|
|
|
|
### 12. Check Vulnerable Libraries (RetireJS)
|
|
```bash
|
|
sf code-analyzer run \
|
|
--rule-selector "retire-js" \
|
|
--output-file ./code-analyzer-results-20260519-101030.json \
|
|
--include-fixes \
|
|
2>&1 | tee ./code-analyzer-results-20260519-101030.log
|
|
```
|
|
**When:** User says "check for vulnerable libraries", "scan dependencies", "find CVEs".
|
|
|
|
---
|
|
|
|
### 13. Analyze Flows
|
|
```bash
|
|
sf code-analyzer run \
|
|
--rule-selector "flow" \
|
|
--target "**/*.flow-meta.xml" \
|
|
--output-file ./code-analyzer-results-20260519-101030.json \
|
|
--include-fixes \
|
|
2>&1 | tee ./code-analyzer-results-20260519-101030.log
|
|
```
|
|
**When:** User says "analyze my Flows", "check Flow best practices".
|
|
**Note:** Requires Python 3.
|
|
|
|
---
|
|
|
|
### 14. Performance Analysis (ApexGuru)
|
|
```bash
|
|
sf code-analyzer run \
|
|
--rule-selector "apexguru" \
|
|
--output-file ./code-analyzer-results-20260519-101030.json \
|
|
--include-fixes \
|
|
2>&1 | tee ./code-analyzer-results-20260519-101030.log
|
|
```
|
|
**When:** User says "performance analysis", "find slow code", "check governor limits".
|
|
**Note:** Requires authenticated Salesforce org. See `references/special-behaviors.md` for auth setup.
|
|
|
|
---
|
|
|
|
## Output Format Variations
|
|
|
|
### 15. HTML Report
|
|
```bash
|
|
sf code-analyzer run \
|
|
--rule-selector Recommended \
|
|
--output-file ./code-analyzer-results-20260519-101030.html \
|
|
--include-fixes \
|
|
2>&1 | tee ./code-analyzer-results-20260519-101030.log
|
|
```
|
|
**When:** User explicitly requests HTML format.
|
|
**Note:** Extension determines format. JSON is default.
|
|
|
|
---
|
|
|
|
### 16. SARIF (GitHub/IDE Integration)
|
|
```bash
|
|
sf code-analyzer run \
|
|
--rule-selector Recommended \
|
|
--output-file ./code-analyzer-results-20260519-101030.sarif \
|
|
--include-fixes \
|
|
2>&1 | tee ./code-analyzer-results-20260519-101030.log
|
|
```
|
|
**When:** User says "SARIF format", "GitHub integration", "IDE integration".
|
|
|
|
---
|
|
|
|
### 17. CSV (Spreadsheet)
|
|
```bash
|
|
sf code-analyzer run \
|
|
--rule-selector Recommended \
|
|
--output-file ./code-analyzer-results-20260519-101030.csv \
|
|
--include-fixes \
|
|
2>&1 | tee ./code-analyzer-results-20260519-101030.log
|
|
```
|
|
**When:** User says "CSV format", "export to spreadsheet", "Excel format".
|
|
|
|
---
|
|
|
|
## Complex Rule Selectors
|
|
|
|
### 18. Multiple Categories
|
|
```bash
|
|
sf code-analyzer run \
|
|
--rule-selector "all:(Security,Performance):(1,2,3)" \
|
|
--output-file ./code-analyzer-results-20260519-101030.json \
|
|
--include-fixes \
|
|
2>&1 | tee ./code-analyzer-results-20260519-101030.log
|
|
```
|
|
**Selector breakdown:** All engines, Security OR Performance categories, Severity 1-3 (Critical to Moderate).
|
|
|
|
---
|
|
|
|
### 19. Specific Rule by Name
|
|
```bash
|
|
sf code-analyzer run \
|
|
--rule-selector "pmd:ApexCRUDViolation" \
|
|
--output-file ./code-analyzer-results-20260519-101030.json \
|
|
--include-fixes \
|
|
2>&1 | tee ./code-analyzer-results-20260519-101030.log
|
|
```
|
|
**When:** User says "check for ApexCRUDViolation", "run the CRUD rule".
|
|
**Note:** Must be exact full rule name. If uncertain, look up first: `sf code-analyzer rules --rule-selector all 2>&1 | grep -i "CRUD"`
|
|
|
|
---
|
|
|
|
### 20. Engine + Category + Severity
|
|
```bash
|
|
sf code-analyzer run \
|
|
--rule-selector "(pmd,eslint):Security:(1,2)" \
|
|
--output-file ./code-analyzer-results-20260519-101030.json \
|
|
--include-fixes \
|
|
2>&1 | tee ./code-analyzer-results-20260519-101030.log
|
|
```
|
|
**Selector breakdown:** (PMD OR ESLint) AND Security AND (Sev 1 OR Sev 2).
|
|
|
|
---
|
|
|
|
## Key Patterns
|
|
|
|
| Pattern | Meaning | Example |
|
|
|---------|---------|---------|
|
|
| `:` | AND | `pmd:Security` = PMD **and** Security |
|
|
| `,` | OR | `(pmd,eslint)` = PMD **or** ESLint |
|
|
| `()` | Grouping | `(pmd,eslint):Security` = (PMD or ESLint) and Security |
|
|
| `(1,2)` | Severity range | `:(1,2)` = Severity 1 or 2 |
|
|
| `--target <path>` | Specific files/folders | Comma-separated in single arg |
|
|
| `--workspace <path>` | Compilation scope (SFGE only) | Prevents compiling template files |
|
|
| `.json`, `.html`, `.sarif`, `.csv`, `.xml` | Output format | Extension of `--output-file` |
|
|
|
|
---
|
|
|
|
## Anti-Patterns (DO NOT USE)
|
|
|
|
### ❌ Using `--format` flag
|
|
```bash
|
|
# WRONG - v3 syntax, does not exist in v4+
|
|
sf code-analyzer run --format json
|
|
```
|
|
**Why:** The `--format` flag was removed in v4+. Use `--output-file` with extension instead.
|
|
|
|
---
|
|
|
|
### ❌ Using `$TIMESTAMP` variable in command
|
|
```bash
|
|
# WRONG - variable substitution fails in permission prompts
|
|
sf code-analyzer run --output-file "./results-${TIMESTAMP}.json"
|
|
```
|
|
**Why:** Generate timestamp first, then use literal string in command.
|
|
|
|
---
|
|
|
|
### ❌ Running in background for long scans
|
|
```bash
|
|
# WRONG - loses output stream
|
|
sf code-analyzer run --rule-selector sfge &
|
|
```
|
|
**Why:** Use foreground with high timeout (1200000ms). Backgrounding loses the output.
|
|
|
|
---
|
|
|
|
### ❌ Partial rule names
|
|
```bash
|
|
# WRONG - returns 0 results
|
|
sf code-analyzer run --rule-selector "no-hardcoded-values"
|
|
```
|
|
**Why:** Rule names must be exact. Look up first: `sf code-analyzer rules --rule-selector all | grep -i "hardcoded"`
|
|
**Correct:** `--rule-selector "@salesforce-ux/slds/no-hardcoded-values-slds2"`
|