feat(salesforce): add SALESFORCE_CODE_ANALYZER_FLOW linter (Flow Scanner engine)

.automation/generated/linters_matrix.json

@@ -101,6 +101,7 @@
     "salesforce_code_analyzer_apex",
     "salesforce_code_analyzer_aura",
     "salesforce_code_analyzer_lwc",
+    "salesforce_code_analyzer_flow",
     "scala_scalafix",
     "snakemake_lint",
     "snakemake_snakefmt",

.cspell.json

@@ -22,6 +22,11 @@
         ".lycheeignore"
     ],
     "ignoreWords": [
+        "argumentb",
+        "argumentr",
+        "fileb",
+        "projectb",
+        "projectr",
         "AKIAIOSFODNN",
         "ARGTOP",
         "AROA47DSWDEZA3",
@@ -1524,6 +1529,8 @@
         "subcharts",
         "SUBCOMMAND",
         "subdir",
+        "subflow",
+        "subflows",
         "sublack",
         "Sublicensing",
         "submodules",
@@ -1735,6 +1742,7 @@
         "YOURBRANCH",
         "YOURORGNAME",
         "YOURUSERNAME",
+        "ython",
         "yxtay",
         "zaach",
         "zavoloklom",

CHANGELOG.md

@@ -17,6 +17,8 @@ Note: Can be used with `oxsecurity/megalinter@beta` in your GitHub Action mega-l
 
 - New linters
 
+  - Add [SALESFORCE_CODE_ANALYZER_FLOW](https://megalinter.io/beta/descriptors/salesforce_code_analyzer_flow/), the Salesforce Code Analyzer v5 Flow Scanner engine that audits Salesforce Flows for security issues
+
 - Disabled linters
 
 - Re-enabled linters

Dockerfile

@@ -1184,6 +1184,11 @@ RUN curl -sSfL https://raw.githubusercontent.com/anchore/syft/refs/tags/v${REPOS
 # RUN sf plugins install code-analyzer@${SALESFORCE_CODE_ANALYZER_VERSION} \
 #     && (npm cache clean --force || true) \
 #     && rm -rf /root/.npm/_cacache
+# code-analyzer-flow installation
+# Next line commented because already managed by another linter
+# RUN sf plugins install code-analyzer@${SALESFORCE_CODE_ANALYZER_VERSION} \
+#     && (npm cache clean --force || true) \
+#     && rm -rf /root/.npm/_cacache
 # scalafix installation
     && ./coursier install scalafix:${SCALA_SCALAFIX_VERSION} --quiet --install-dir /usr/bin && rm -rf /root/.cache \
 # snakemake installation

TEMPLATES/code-analyzer-flow.yml

@@ -0,0 +1,22 @@
+# ======================================================================
+# CODE ANALYZER CONFIGURATION - FLOW SCANNER ENGINE
+# Used by MegaLinter's SALESFORCE_CODE_ANALYZER_FLOW linter.
+# To learn more about this configuration, visit:
+#   https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/config-custom.html
+# ======================================================================
+# Level at which to log messages to log files.
+# Possible values are:
+#   1 or 'Error' - Includes only error messages in the log.
+#   2 or 'Warn' - Includes warning and error messages in the log.
+#   3 or 'Info' - Includes informative, warning, and error messages in the log.
+#   4 or 'Debug' - Includes debug, informative, warning, and error messages in the log.
+#   5 or 'Fine' - Includes fine detail, debug, informative, warning, and error messages in the log.
+log_level: 4
+
+# The flow linter only selects rules from the 'flow' engine (--rule-selector flow).
+# PMD is disabled so its Apex custom ruleset (apex-pmd-ruleset.xml) is not required
+# in the analyzed workspace; otherwise Code Analyzer fails to instantiate PMD during
+# rule selection and reports a Critical pmd:UninstantiableEngineError.
+engines:
+  pmd:
+    disable_engine: true

docs/standalone-linters.md

@@ -103,6 +103,7 @@
 | SALESFORCE_CODE_ANALYZER_APEX     | ghcr.io/oxsecurity/megalinter-only-salesforce_code_analyzer_apex:beta     |   ![Docker Image Size (tag)](https://img.shields.io/docker/image-size/oxsecurity/megalinter-only-salesforce_code_analyzer_apex/beta)   |
 | SALESFORCE_CODE_ANALYZER_AURA     | ghcr.io/oxsecurity/megalinter-only-salesforce_code_analyzer_aura:beta     |   ![Docker Image Size (tag)](https://img.shields.io/docker/image-size/oxsecurity/megalinter-only-salesforce_code_analyzer_aura/beta)   |
 | SALESFORCE_CODE_ANALYZER_LWC      | ghcr.io/oxsecurity/megalinter-only-salesforce_code_analyzer_lwc:beta      |   ![Docker Image Size (tag)](https://img.shields.io/docker/image-size/oxsecurity/megalinter-only-salesforce_code_analyzer_lwc/beta)    |
+| SALESFORCE_CODE_ANALYZER_FLOW     | ghcr.io/oxsecurity/megalinter-only-salesforce_code_analyzer_flow:beta     |   ![Docker Image Size (tag)](https://img.shields.io/docker/image-size/oxsecurity/megalinter-only-salesforce_code_analyzer_flow/beta)   |
 | SCALA_SCALAFIX                    | ghcr.io/oxsecurity/megalinter-only-scala_scalafix:beta                    |          ![Docker Image Size (tag)](https://img.shields.io/docker/image-size/oxsecurity/megalinter-only-scala_scalafix/beta)           |
 | SNAKEMAKE_LINT                    | ghcr.io/oxsecurity/megalinter-only-snakemake_lint:beta                    |          ![Docker Image Size (tag)](https://img.shields.io/docker/image-size/oxsecurity/megalinter-only-snakemake_lint/beta)           |
 | SNAKEMAKE_SNAKEFMT                | ghcr.io/oxsecurity/megalinter-only-snakemake_snakefmt:beta                |        ![Docker Image Size (tag)](https://img.shields.io/docker/image-size/oxsecurity/megalinter-only-snakemake_snakefmt/beta)         |

flavors/salesforce/Dockerfile

@@ -587,6 +587,11 @@ RUN curl -sSfL https://raw.githubusercontent.com/anchore/syft/refs/tags/v${REPOS
 # RUN sf plugins install code-analyzer@${SALESFORCE_CODE_ANALYZER_VERSION} \
 #     && (npm cache clean --force || true) \
 #     && rm -rf /root/.npm/_cacache
+# code-analyzer-flow installation
+# Next line commented because already managed by another linter
+# RUN sf plugins install code-analyzer@${SALESFORCE_CODE_ANALYZER_VERSION} \
+#     && (npm cache clean --force || true) \
+#     && rm -rf /root/.npm/_cacache
 # snakemake installation
 # snakefmt installation
 # cspell installation

flavors/salesforce/flavor.json

@@ -50,6 +50,7 @@
         "SALESFORCE_CODE_ANALYZER_APEX",
         "SALESFORCE_CODE_ANALYZER_AURA",
         "SALESFORCE_CODE_ANALYZER_LWC",
+        "SALESFORCE_CODE_ANALYZER_FLOW",
         "SNAKEMAKE_LINT",
         "SNAKEMAKE_SNAKEFMT",
         "SPELL_CSPELL",