upgrade code analyzer to v5 #6386

abdeslamads · 2025-10-19T20:24:57Z

Note

Integrates Salesforce Code Analyzer v5 as new Apex/Aura/LWC linters, wires installs into images, adds config/tests/docs, and updates schemas/matrix and SFDX scanner refs.

Salesforce linters:
- Add new code-analyzer v5 linters: SALESFORCE_CODE_ANALYZER_APEX, SALESFORCE_CODE_ANALYZER_AURA, SALESFORCE_CODE_ANALYZER_LWC (descriptors, docs, licenses, tests, mkdocs nav, supported/standalone lists).
- Provide default config TEMPLATES/apex.yml and link previews.
Build/Docker:
- Install [email protected] in main and Salesforce flavor Dockerfiles; add dedicated standalone Dockerfiles for each new linter.
Configs/Schemas:
- Extend schemas to include new linter keys and configuration variables.
- Update linters_matrix.json and flavors to include new linters.
Docs:
- Update site description counts; add new descriptor pages and badges; include new linters in tables.
- Update SFDX scanner docs to reference latest plugin version in install snippets.
Misc versions/help:
- Refresh generated help/version data (e.g., bash, powershell, git, java help text).

^{Written by Cursor Bugbot for commit 7ea6c41. This will update automatically on new commits. Configure here.}

echoix · 2025-10-19T20:40:41Z

I think there's more to change. The tool is completely different, different name, etc. It doesn't seem published as @salesforce/code-analyzer. See https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/migrate.html

There would be also maybe some keys to change, some links, docs, etc. @nvuillam I think you know more about salesforce than me. How are we supposed to install it if it is not on npm like the others? and the lwc workaround, how do we handle that?

abdeslamads · 2025-10-19T20:55:44Z

@echoix yes, you're absolutely right! I know this is a big change, and I'd love to have @nvuillam guidance on making the required changes. also I tried changing the old reference and syntax of sfdx-scanner to code-analyzer. I'll try building docker image and testing it with the changes (I'm relatively new to this)

nvuillam · 2025-10-20T12:50:19Z

megalinter/descriptors/salesforce.megalinter-descriptor.yml

-      - "scanner:run"
-      - "--engine"
-      - "eslint-lwc"
+      - "code-analyzer run"


@abdeslamads it's one line by argument, so in that can you'll need

code-analyzer

run

nvuillam · 2025-10-20T12:55:05Z

thanks for the PR :)

It seems you are going the right path :)

Tip: you can locally run the test classes so it might help ^^ -> https://megalinter.io/latest/contributing/#41-visual-studio-code-dev-containers + Python VsCode extensions, i'll try to document exactly how ASAP !

megalinter/descriptors/salesforce.megalinter-descriptor.yml

echoix · 2025-10-26T15:06:32Z

megalinter/descriptors/salesforce.megalinter-descriptor.yml

    cli_lint_mode: project
    cli_help_extra_args:
-      - "scanner:run"
+      - "code-analyzer run"


Maybe (I'm not sure though) that the two args can be together. I may depend by platform, but the container only runs on Linux, so only one OS to make it work

nvuillam · 2025-10-27T11:05:25Z

pyproject.toml

@@ -1,133 +1,5 @@
-[build-system]


@abdeslamads this is very strange to almost empty pyproject.toml ^^
cc @echoix

Are you up to date with main branch ?

I copied the file's content from the main branch after it has been updated automatically by the build script

echoix

I know it's getting a long review ping-pong game, but it's getting closer and closer.

.eslintignore

CHANGELOG.md

megalinter/descriptors/salesforce.megalinter-descriptor.yml

echoix · 2025-10-27T11:30:31Z

docs/descriptors/salesforce_sfdx_scanner_lwc.md

 # Linter install
 # renovate: datasource=npm depName=@salesforce/sfdx-scanner
-ARG SALESFORCE_SFDX_SCANNER_VERSION=4.12.0
+ARG SALESFORCE_SFDX_SCANNER_VERSION=5.5.0


I'm trying to find why it is bumped to 5.5.0, if reverted back to adding a new key for the code-analyzer version of the linters. That version doesn't exist in sfdx scanner.

echoix · 2025-10-27T14:56:25Z

/build

Command run output
Build command workflow started.
Installing dependencies
Running script ./build.sh
Build command workflow completed updating files.

echoix · 2025-10-27T15:13:25Z

Could you (or any other maintener on their computer) run the build with docs to get the changes from the previous iteration fixed up with the current iteration ?

And once merged, we might need to get the jsonschema html docs updated again

abdeslamads · 2025-10-27T17:29:03Z

Could you (or any other maintener on their computer) run the build with docs to get the changes from the previous iteration fixed up with the current iteration ?

And once merged, we might need to get the jsonschema html docs updated again

I ran the build with docs, and a lot of the docs files has been changed, should I commit and push all, or only the new generated files?

echoix · 2025-10-27T19:50:39Z

At least the parts that revert the changes of 4.12.0->5.5.0 in the existing (and deprecated with this PR) linters using sfdx-scanner. And having the code-analyzer ones. Probably the parts that update tables linking them all, but it's secondary.

echoix · 2025-10-29T11:16:55Z

/build

Command run output
Build command workflow started.
Installing dependencies
Running script ./build.sh
Build command workflow completed without updating files.

cursor · 2025-11-02T20:27:13Z

megalinter/descriptors/salesforce.megalinter-descriptor.yml

+
+      You can select categories and single rules by defining custom arguments (example: `SALESFORCE_SFDX_SCANNER_ARGUMENTS: -c "Best Practices,Security"`)
+
+      See more details in [Help](#help-content)


Bug: Misleading Env Vars in Linter Documentation

The documentation for the new code-analyzer-apex, code-analyzer-aura, and code-analyzer-lwc linters incorrectly references environment variables. It uses SALESFORCE_SFDX_SCANNER_DIRECTORY (and its _AURA/_LWC variants) and SALESFORCE_SFDX_SCANNER_ARGUMENTS, which are associated with the older sfdx-scanner linters. This can cause confusion for users trying to configure the new code-analyzer tools.

Additional Locations (5)

megalinter/descriptors/salesforce.megalinter-descriptor.yml#L135-L140

megalinter/descriptors/salesforce.megalinter-descriptor.yml#L215-L220

docs/descriptors/salesforce_code_analyzer_apex.md#L22-L25

docs/descriptors/salesforce_code_analyzer_aura.md#L23-L26

docs/descriptors/salesforce_code_analyzer_lwc.md#L24-L25

cursor · 2025-11-02T20:27:13Z

docs/descriptors/salesforce_sfdx_scanner_apex.md

 # Linter install
 # renovate: datasource=npm depName=@salesforce/sfdx-scanner
-ARG SALESFORCE_SFDX_SCANNER_VERSION=4.12.0
+ARG SALESFORCE_SFDX_SCANNER_VERSION=5.5.0


Bug: Version mismatch: scanner version misdocumented

The SALESFORCE_SFDX_SCANNER_VERSION was incorrectly updated to 5.5.0 in the sfdx-scanner documentation (apex.md, aura.md, lwc.md). This version is for the new code-analyzer plugin; sfdx-scanner should remain at 4.12.0 for backward compatibility. This causes a version mismatch and confusion.

Additional Locations (2)

docs/descriptors/salesforce_sfdx_scanner_lwc.md#L400-L402

docs/descriptors/salesforce_sfdx_scanner_aura.md#L400-L401

cursor · 2025-11-02T20:27:13Z

docs/descriptors/salesforce_code_analyzer_lwc.md

+
+If your root folder is not **force-app**, please set variable `SALESFORCE_SFDX_SCANNER_LWC_DIRECTORY`
+
+You can select categories and single rules by defining custom arguments (example: `SALESFORCE_SFDX_SCANNER_ARGUMENTS: -c "Best Practices,Security"`)


Bug: LWC Analyzer Config Names Naming Inconsistency

The code-analyzer-lwc documentation incorrectly references SALESFORCE_SFDX_SCANNER_LWC_DIRECTORY and SALESFORCE_SFDX_SCANNER_ARGUMENTS for its configuration. These variable names should align with the SALESFORCE_CODE_ANALYZER_LWC_... naming convention for this linter.

Additional Locations (1)

megalinter/descriptors/salesforce.megalinter-descriptor.yml#L215-L216

cursor · 2025-11-02T20:27:13Z

docs/descriptors/salesforce_sfdx_scanner_aura.md

 # Linter install
 # renovate: datasource=npm depName=@salesforce/sfdx-scanner
-ARG SALESFORCE_SFDX_SCANNER_VERSION=4.12.0
+ARG SALESFORCE_SFDX_SCANNER_VERSION=5.5.0


Bug: Incorrect scanner version regression in plugin updater

The SALESFORCE_SFDX_SCANNER_VERSION was incorrectly updated to 5.5.0. This variable should stay at 4.12.0 for the existing sfdx-scanner plugin, as 5.5.0 is intended for the new code-analyzer plugin. This change applies the wrong scanner version.

upgrade code analyzer to v5

3a3a468

abdeslamads requested review from Kurt-von-Laven, bdovaz, echoix and nvuillam as code owners October 19, 2025 20:24

abdeslamads added 2 commits October 20, 2025 10:21

change reference of sfdx-scanner dependency to code-analyzer

a324d80

updated commands syntax to the new syntax of code-analyzer v5

b14795a

This comment was marked as outdated.

Sign in to view

nvuillam reviewed Oct 20, 2025

View reviewed changes

abdeslamads temporarily deployed to dev October 20, 2025 12:50 — with GitHub Actions Inactive

Merge branch 'main' into fix/upgrade-salesforce-code-analyzer-version

15a3ce3

This comment was marked as outdated.

Sign in to view

nvuillam temporarily deployed to dev October 25, 2025 07:44 — with GitHub Actions Inactive

fix command argument per line issue

736fec3

This comment was marked as outdated.

Sign in to view

abdeslamads temporarily deployed to dev October 25, 2025 15:04 — with GitHub Actions Inactive

use new name of code-analyzer package name

4f74eea

This comment was marked as outdated.

Sign in to view

abdeslamads had a problem deploying to dev October 25, 2025 21:03 — with GitHub Actions Error

Merge branch 'main' into fix/upgrade-salesforce-code-analyzer-version

297dd0e

nvuillam temporarily deployed to dev October 25, 2025 21:04 — with GitHub Actions Inactive

echoix reviewed Oct 26, 2025

View reviewed changes

This comment was marked as outdated.

Sign in to view

revise entrypoint and pyproject

107bb0b

This comment was marked as outdated.

Sign in to view

nvuillam reviewed Oct 27, 2025

View reviewed changes

abdeslamads temporarily deployed to dev October 27, 2025 11:06 — with GitHub Actions Inactive

echoix requested changes Oct 27, 2025

View reviewed changes

abdeslamads added 4 commits October 27, 2025 12:42

Delete .eslintignore

d04ae85

revert changelog

afddb25

move lightning flow scanner under sfdx scanner

6f1d5b6

fix one line per argument

e5cb09b

This comment was marked as outdated.

Sign in to view

[build-command] Update generated files

c0c6495

This comment was marked as outdated.

Sign in to view

echoix closed this Oct 27, 2025

echoix reopened this Oct 27, 2025

echoix temporarily deployed to dev October 27, 2025 15:13 — with GitHub Actions Inactive

This comment was marked as outdated.

Sign in to view

Merge branch 'main' into fix/upgrade-salesforce-code-analyzer-version

a92768e

echoix temporarily deployed to dev October 29, 2025 11:33 — with GitHub Actions Inactive

abdeslamads added 2 commits November 1, 2025 19:34

generate documenation for new linter (code-analyzer)

9a955f5

fix descriptor

7ea6c41

cursor bot reviewed Nov 2, 2025

View reviewed changes


		You can select categories and single rules by defining custom arguments (example: `SALESFORCE_SFDX_SCANNER_ARGUMENTS: -c "Best Practices,Security"`)

		See more details in [Help](#help-content)


		If your root folder is not force-app, please set variable `SALESFORCE_SFDX_SCANNER_LWC_DIRECTORY`

		You can select categories and single rules by defining custom arguments (example: `SALESFORCE_SFDX_SCANNER_ARGUMENTS: -c "Best Practices,Security"`)

Uh oh!

upgrade code analyzer to v5 #6386

Are you sure you want to change the base?

upgrade code analyzer to v5 #6386

Conversation

abdeslamads commented Oct 19, 2025 • edited by cursor bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

echoix commented Oct 19, 2025

Uh oh!

abdeslamads commented Oct 19, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

nvuillam Oct 20, 2025

Choose a reason for hiding this comment

Uh oh!

nvuillam commented Oct 20, 2025

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

Uh oh!

Uh oh!

echoix Oct 26, 2025

Choose a reason for hiding this comment

Uh oh!

This comment was marked as outdated.

Uh oh!

This comment was marked as outdated.

Uh oh!

nvuillam Oct 27, 2025

Choose a reason for hiding this comment

Uh oh!

abdeslamads Oct 27, 2025

Choose a reason for hiding this comment

Uh oh!

echoix left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

echoix Oct 27, 2025

Choose a reason for hiding this comment

Uh oh!

This comment was marked as outdated.

Uh oh!

echoix commented Oct 27, 2025 • edited by github-actions bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

This comment was marked as outdated.

Uh oh!

echoix commented Oct 27, 2025

Uh oh!

This comment was marked as outdated.

Uh oh!

abdeslamads commented Oct 27, 2025

Uh oh!

echoix commented Oct 27, 2025

Uh oh!

echoix commented Oct 29, 2025 • edited by github-actions bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

cursor bot Nov 2, 2025

Choose a reason for hiding this comment

Bug: Misleading Env Vars in Linter Documentation

Uh oh!

cursor bot Nov 2, 2025

Choose a reason for hiding this comment

Bug: Version mismatch: scanner version misdocumented

Uh oh!

cursor bot Nov 2, 2025

Choose a reason for hiding this comment

Bug: LWC Analyzer Config Names Naming Inconsistency

Uh oh!

abdeslamads commented Oct 19, 2025 •

edited by cursor bot

Loading

abdeslamads commented Oct 19, 2025 •

edited

Loading

echoix commented Oct 27, 2025 •

edited by github-actions bot

Loading

echoix commented Oct 29, 2025 •

edited by github-actions bot

Loading