9.6 KiB
Common Command Variations
Real-world command patterns with explanations. Use these as reference when building commands for specific scenarios.
Basic Scans
1. Scan Entire Workspace (Default)
sf code-analyzer run \
--rule-selector Recommended \
--output-file ./code-analyzer-results-20260519-101030.json \
--include-fixes \
2>&1 | tee ./code-analyzer-results-20260519-101030.log
When: User says "scan my code" with no specifics.
2. Security-Focused Scan
sf code-analyzer run \
--rule-selector "all:Security:(1,2)" \
--output-file ./code-analyzer-results-20260519-101030.json \
--include-fixes \
2>&1 | tee ./code-analyzer-results-20260519-101030.log
When: User says "check for security issues", "find vulnerabilities", "AppExchange security review".
Selector breakdown: all = all engines, :Security = Security category only, :(1,2) = Critical and High severity only.
3. Specific Engine
sf code-analyzer run \
--rule-selector "pmd" \
--output-file ./code-analyzer-results-20260519-101030.json \
--include-fixes \
2>&1 | tee ./code-analyzer-results-20260519-101030.log
When: User says "run PMD", "check my Apex code".
4. Multiple Engines
sf code-analyzer run \
--rule-selector "(pmd,eslint)" \
--output-file ./code-analyzer-results-20260519-101030.json \
--include-fixes \
2>&1 | tee ./code-analyzer-results-20260519-101030.log
When: User says "scan Apex and JavaScript", "run PMD and ESLint".
Selector breakdown: Parentheses + comma = OR logic.
Target-Specific Scans
5. Scan Specific File
sf code-analyzer run \
--rule-selector Recommended \
--target "force-app/main/default/classes/AccountService.cls" \
--output-file ./code-analyzer-results-20260519-101030.json \
--include-fixes \
2>&1 | tee ./code-analyzer-results-20260519-101030.log
When: User says "scan AccountService.cls".
6. Scan Specific Folder
sf code-analyzer run \
--rule-selector Recommended \
--target "force-app/main/default/lwc" \
--output-file ./code-analyzer-results-20260519-101030.json \
--include-fixes \
2>&1 | tee ./code-analyzer-results-20260519-101030.log
When: User says "scan my LWC components", "check the lwc folder".
7. Scan Multiple Paths
sf code-analyzer run \
--rule-selector Recommended \
--target "force-app/main/default/classes,force-app/main/default/triggers" \
--output-file ./code-analyzer-results-20260519-101030.json \
--include-fixes \
2>&1 | tee ./code-analyzer-results-20260519-101030.log
When: User says "scan classes and triggers".
Note: Comma-separated paths in a single --target value.
8. Scan Using Glob Pattern
sf code-analyzer run \
--rule-selector Recommended \
--target "**/*.cls,**/*.trigger" \
--output-file ./code-analyzer-results-20260519-101030.json \
--include-fixes \
2>&1 | tee ./code-analyzer-results-20260519-101030.log
When: User says "scan all Apex files", "check all classes and triggers".
Note: Glob patterns must match from workspace root.
Diff-Based Scans
9. Scan Changed Files (Git Diff)
Step 1: Get changed files
git diff --name-only main...HEAD
Step 2: Filter to scannable types (.cls, .trigger, .js, .ts, .flow-meta.xml, etc.)
Step 3: Pass as --target
sf code-analyzer run \
--rule-selector Recommended \
--target "force-app/main/default/classes/AccountService.cls,force-app/main/default/lwc/accountCard/accountCard.js" \
--output-file ./code-analyzer-results-20260519-101030.json \
--include-fixes \
2>&1 | tee ./code-analyzer-results-20260519-101030.log
When: User says "scan my changes", "check what I modified", "analyze the diff".
Advanced Scenarios
10. Deep Analysis with SFGE (Data Flow)
sf code-analyzer run \
--rule-selector "sfge" \
--workspace "force-app" \
--output-file ./code-analyzer-results-20260519-101030.json \
--include-fixes \
2>&1 | tee ./code-analyzer-results-20260519-101030.log
When: User says "deep analysis", "data flow analysis", "path-based analysis", "find CRUD violations with certainty".
Note: Requires Java 11+. May take 10-20 minutes. Use --workspace to avoid compiling template files.
Timeout: Set to 1200000ms (20 minutes).
11. Find Code Duplicates (CPD)
sf code-analyzer run \
--rule-selector "cpd" \
--output-file ./code-analyzer-results-20260519-101030.json \
--include-fixes \
2>&1 | tee ./code-analyzer-results-20260519-101030.log
When: User says "find duplicates", "check for copy-paste", "detect code clones".
12. Check Vulnerable Libraries (RetireJS)
sf code-analyzer run \
--rule-selector "retire-js" \
--output-file ./code-analyzer-results-20260519-101030.json \
--include-fixes \
2>&1 | tee ./code-analyzer-results-20260519-101030.log
When: User says "check for vulnerable libraries", "scan dependencies", "find CVEs".
13. Analyze Flows
sf code-analyzer run \
--rule-selector "flow" \
--target "**/*.flow-meta.xml" \
--output-file ./code-analyzer-results-20260519-101030.json \
--include-fixes \
2>&1 | tee ./code-analyzer-results-20260519-101030.log
When: User says "analyze my Flows", "check Flow best practices".
Note: Requires Python 3.
14. Performance Analysis (ApexGuru)
sf code-analyzer run \
--rule-selector "apexguru" \
--output-file ./code-analyzer-results-20260519-101030.json \
--include-fixes \
2>&1 | tee ./code-analyzer-results-20260519-101030.log
When: User says "performance analysis", "find slow code", "check governor limits".
Note: Requires authenticated Salesforce org. See references/special-behaviors.md for auth setup.
Output Format Variations
15. HTML Report
sf code-analyzer run \
--rule-selector Recommended \
--output-file ./code-analyzer-results-20260519-101030.html \
--include-fixes \
2>&1 | tee ./code-analyzer-results-20260519-101030.log
When: User explicitly requests HTML format.
Note: Extension determines format. JSON is default.
16. SARIF (GitHub/IDE Integration)
sf code-analyzer run \
--rule-selector Recommended \
--output-file ./code-analyzer-results-20260519-101030.sarif \
--include-fixes \
2>&1 | tee ./code-analyzer-results-20260519-101030.log
When: User says "SARIF format", "GitHub integration", "IDE integration".
17. CSV (Spreadsheet)
sf code-analyzer run \
--rule-selector Recommended \
--output-file ./code-analyzer-results-20260519-101030.csv \
--include-fixes \
2>&1 | tee ./code-analyzer-results-20260519-101030.log
When: User says "CSV format", "export to spreadsheet", "Excel format".
Complex Rule Selectors
18. Multiple Categories
sf code-analyzer run \
--rule-selector "all:(Security,Performance):(1,2,3)" \
--output-file ./code-analyzer-results-20260519-101030.json \
--include-fixes \
2>&1 | tee ./code-analyzer-results-20260519-101030.log
Selector breakdown: All engines, Security OR Performance categories, Severity 1-3 (Critical to Moderate).
19. Specific Rule by Name
sf code-analyzer run \
--rule-selector "pmd:ApexCRUDViolation" \
--output-file ./code-analyzer-results-20260519-101030.json \
--include-fixes \
2>&1 | tee ./code-analyzer-results-20260519-101030.log
When: User says "check for ApexCRUDViolation", "run the CRUD rule".
Note: Must be exact full rule name. If uncertain, look up first: sf code-analyzer rules --rule-selector all 2>&1 | grep -i "CRUD"
20. Engine + Category + Severity
sf code-analyzer run \
--rule-selector "(pmd,eslint):Security:(1,2)" \
--output-file ./code-analyzer-results-20260519-101030.json \
--include-fixes \
2>&1 | tee ./code-analyzer-results-20260519-101030.log
Selector breakdown: (PMD OR ESLint) AND Security AND (Sev 1 OR Sev 2).
Key Patterns
| Pattern | Meaning | Example |
|---|---|---|
: |
AND | pmd:Security = PMD and Security |
, |
OR | (pmd,eslint) = PMD or ESLint |
() |
Grouping | (pmd,eslint):Security = (PMD or ESLint) and Security |
(1,2) |
Severity range | :(1,2) = Severity 1 or 2 |
--target <path> |
Specific files/folders | Comma-separated in single arg |
--workspace <path> |
Compilation scope (SFGE only) | Prevents compiling template files |
.json, .html, .sarif, .csv, .xml |
Output format | Extension of --output-file |
Anti-Patterns (DO NOT USE)
Using --format flag
# WRONG - v3 syntax, does not exist in v4+
sf code-analyzer run --format json
Why: The --format flag was removed in v4+. Use --output-file with extension instead.
Using $TIMESTAMP variable in command
# WRONG - variable substitution fails in permission prompts
sf code-analyzer run --output-file "./results-${TIMESTAMP}.json"
Why: Generate timestamp first, then use literal string in command.
Running in background for long scans
# WRONG - loses output stream
sf code-analyzer run --rule-selector sfge &
Why: Use foreground with high timeout (1200000ms). Backgrounding loses the output.
Partial rule names
# WRONG - returns 0 results
sf code-analyzer run --rule-selector "no-hardcoded-values"
Why: Rule names must be exact. Look up first: sf code-analyzer rules --rule-selector all | grep -i "hardcoded"
Correct: --rule-selector "@salesforce-ux/slds/no-hardcoded-values-slds2"