feat(salesforce): add SALESFORCE_CODE_ANALYZER_FLOW linter (Flow Scanner engine) - #8408
Merged
Conversation
…ner engine) Add the Salesforce Code Analyzer v5 Flow Scanner engine as a new linter in the SALESFORCE descriptor. It runs `sf code-analyzer run --rule-selector flow` against `**/*.flow-meta.xml` files to audit Salesforce Flows for security issues, reusing the already-installed @salesforce/plugin-code-analyzer. - New linter entry code-analyzer-flow / SALESFORCE_CODE_ANALYZER_FLOW - Reuses the shared code-analyzer plugin install (no new dependency) - Known-error guidance for invalid config, no target flows, and the engine's Python 3.10+ requirement - amd64 only, matching the sibling Code Analyzer engines
Contributor
✅
|
Resolves cspell false positives in the new SALESFORCE_CODE_ANALYZER_FLOW descriptor text and Python-detection regex.
The flow linter reused the salesforce-lfs fixture and the shared code-analyzer.yml, which forced PMD to load ./apex-pmd-ruleset.xml (absent from that workspace) and raised a Critical pmd:UninstantiableEngineError, plus the "good" DML flow still tripped High/Moderate flow rules. - Add TEMPLATES/code-analyzer-flow.yml that disables the PMD engine, since the flow linter only selects flow rules (--rule-selector flow). This also fixes real-world use on workspaces without an Apex PMD ruleset. - Point the flow linter at code-analyzer-flow.yml via config_file_name. - Drop the non-clean DML_Statement_In_A_Loop_Fixed flow from the good fixture; the remaining flow only yields sub-threshold (Low) violations.
The MegaLinter self-scan reported 258 cspell errors across every linter doc page (projectb/projectr/fileb/argumentb/argumentr) - each is a real word that sits immediately before a <br/> in the generated CLI_LINT_MODE tables, with the tag's "b"/"r" glued on by cspell's HTML handling. Add an ignoreRegExpList entry that removes <br/> (and <br>, <br />) before spell-checking so the tag can no longer merge into adjacent words.
MegaLinter's cspell (v10.0.1) tokenizes the <br/> tags in the generated CLI_LINT_MODE doc tables by gluing the tag's "b"/"r" onto the adjacent word, producing 258 false positives across every linter doc page (projectb, projectr, fileb, argumentb, argumentr). This is not reproducible with cspell + this config outside the MegaLinter runtime, and a repo-level ignoreRegExpList had no effect, so ignore the five artifact tokens directly. Also drop that ineffective ignoreRegExpList.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
What
Adds a new linter
SALESFORCE_CODE_ANALYZER_FLOWto theSALESFORCEdescriptor, exposing the Flow Scanner (flow) engine of Salesforce Code Analyzer v5. It audits Salesforce Flows (*.flow-meta.xml) for security issues.How
sf code-analyzer run --rule-selector flow --target "**/*.flow-meta.xml", mirroring the existingcode-analyzer-apex/aura/lwcentries.@salesforce/plugin-code-analyzer— no new dependency.common_linter_errorsguidance for invalid config, no target flows, and the engine's Python 3.10+ requirement.Notes
sfge) was intentionally left out — it is still a Salesforce Developer Preview.lightning-flow-scannerentry (disabled, repo archived) is untouched; this engine is its maintained successor inside Code Analyzer v5.salesforce-lfstest fixtures. CI will confirm the flow engine flags the bad fixtures; a security-focused bad flow can be added if needed.