Add ApexGuru engine of Salesforce Code Analyzer (SALESFORCE_CODE_ANALYZER_APEXGURU) - #8820
Open
nvuillam wants to merge 5 commits into
Open
Add ApexGuru engine of Salesforce Code Analyzer (SALESFORCE_CODE_ANALYZER_APEXGURU)#8820nvuillam wants to merge 5 commits into
nvuillam wants to merge 5 commits into
Conversation
…YZER_APEXGURU) ApexGuru is the AI-driven engine of Salesforce Code Analyzer: it sends Apex classes and triggers to a connected org, where an LLM combined with JVM runtime traces detects SOQL inefficiencies, anti-patterns and scalability hotspots that static analysis can not see. It needs an authenticated org, so it is inactive by default and activates only when SFDX_AUTH_URL is defined. This required a new activation rule type, "variable_is_set": existing activation rules can only compare a variable to a fixed expected value, which can not express "a credential is present". SFDX_AUTH_URL matches the default secured variables regexes, so the linter class allow-lists it for its own sub-processes and lets the login command expand it, keeping the auth url out of the logs. No extra installation: ApexGuru is an engine of the code-analyzer plugin already installed by the other Salesforce Code Analyzer linters. quick build TEST_KEYWORDS=salesforce_code_analyzer_apexguru_test
nvuillam
requested review from
Kurt-von-Laven,
bdovaz and
echoix
as code owners
August 28, 2026 10:42
Contributor
✅
|
Forward the SFDX_AUTH_URL repository secret to the test containers of the DEV, DEV-linters and BETA-linters workflows, so the SALESFORCE_CODE_ANALYZER_APEXGURU lint tests can reach a connected org. GitHub does not expose repository secrets to pull request jobs from a forked repository, so the variable is empty there. Rather than failing, a linter whose activation depends on a "variable_is_set" rule now skips its lint tests when the variable is missing: LinterTestRoot.skip_if_required_variables_missing() guards the per-lint-mode and SARIF tests. The version and help tests keep running in every case: they only call the CLI and need no credential. quick build TEST_KEYWORDS=salesforce_code_analyzer_apexguru_test
SPELL_CSPELL reported 28 blocking errors, all of them the new linter name. The dictionary entry is lowercase, which cspell matches case-insensitively, so it covers apexguru, ApexGuru and APEXGURU.
nvuillam
force-pushed
the
feat/add-apexguru-linter
branch
from
August 28, 2026 14:08
e4f74cb to
8e371b6
Compare
nvuillam
force-pushed
the
feat/add-apexguru-linter
branch
from
August 28, 2026 14:38
8e371b6 to
938ba42
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Adds SALESFORCE_CODE_ANALYZER_APEXGURU, the AI-driven engine of Salesforce Code Analyzer, as a 5th Code Analyzer linter next to the Apex, Aura, LWC and Flow engines.
Unlike the other engines, ApexGuru does not analyze sources locally: it sends
.clsand.triggerfiles to a connected Salesforce org, where an LLM combined with JVM runtime traces detects SOQL inefficiencies, critical anti-patterns and scalability hotspots that static analysis alone can not see.Docs: https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/engine-apexguru.html
Activation — inactive by default
ApexGuru requires an authenticated org, so it must never run for projects that have not opted in. It activates only when
SFDX_AUTH_URLis defined, and MegaLinter logs in to that org before the scan.This needed a new
activation_rulestype,variable_is_set: the existing rules can only compare a variable to a fixedexpected_value, which can not express "a credential is present".SFDX_AUTH_URLSFDX_AUTH_URL is not set (define SFDX_AUTH_URL to activate)SFDX_AUTH_URLmatches MegaLinter's default secured-variable regexes (_AUTH_), so it would otherwise reach the login command asHIDDEN_BY_MEGALINTER.SalesforceCodeAnalyzerApexGuruLinterallow-lists it throughunsecured_env_variablesand lets the shell expand it, so the auth url never appears in a logged command line.Notes
code-analyzerplugin already installed by the other Salesforce Code Analyzer linters — the generated Dockerfiles correctly comment the duplicate install out.--targetis intentionally not passed: ApexGuru only reads.cls/.trigger, so--workspace .is enough.cli_help_extra_commandsis intentionally omitted:sf code-analyzer rules --rule-selector apexguruneeds an org, and the help test keys off the last command's exit code.linter_speed: 1— remote analysis polled until it completes (5 minutes default timeout).salesforcetest folder:bad/already containsSoqlInLoop.cls, exactly ApexGuru's target class of finding.common_linter_errorsentries cover invalid config, no authenticated org, ApexGuru not enabled on the org, and analysis timeout.Requirements for users
ApexGuru must be enabled on the connected org: it needs Scale Center, and is available for Unlimited Edition production orgs, full copy sandboxes, Signature orgs and Scale Test customers.
Validation
make megalinter-buildran clean and regenerated the same file set as the recent tofu-validate linter additionmegalinter-descriptor.jsonschema.json; all regexes compileLocal Docker validation could not be completed (pip cannot reach PyPI from inside the image build on the dev machine). CI needs an
SFDX_AUTH_URLsecret for the ApexGuru lint tests to run; without it, the linter is inactive and its success/failure tests can not pass.This first commit uses
quick build— a full build is still needed before merge.