> For the complete documentation index, see [llms.txt](https://docs.flosum.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.flosum.com/devops/pipeline/pipeline-operations/pipeline-operation-code-scan.md). # Pipeline Operation: Code Scan {% hint style="warning" %} #### Written for the Old UI This article was written for the old UI. The instructions are still usable, but the screenshots are outdated. In some cases, items referenced in the instructions have moved or changed. If you cannot find an item, see the [Where Did It Go](/devops/new-ui-ux-transition/where-did-it-go.md) article. {% endhint %} ## ![](https://1800549522-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2FRpUu5iMlzMFAudyBvMOl%2Fuploads%2FG5ZbxX918xOHwbAwAJ4n%2FSummary2-Small-Icon.svg?alt=media\&token=da26a67f-ff7f-47b3-8669-06be960dc2d7) Overview The **Code Scan** operation analyzes your Salesforce metadata to identify code quality issues before deployment. Through static code analysis, it reports rule violations in a branch’s Apex classes, triggers, and other components to confirm they meet your defined coding standards. The Code Scan rule set covers: * **Coding Style and Best Practices**: Improve readability, maintainability, and consistency across your codebase. * **Security Best Practices**: Identify common vulnerabilities and risky patterns in your code. * **Performance Suggestions**: Highlight inefficient logic before it affects end users. You can set a severity threshold to abort the pipeline when violations reach or exceed a specified level. Running Code Scans in your pipeline helps maintain consistent code quality and enables you to deploy reliable, secure, and responsive components. This article explains how to configure and use the Code Scan operation. See the following sections to learn more: * [#scan-types](#scan-types "mention") * [#severity-levels](#severity-levels "mention") * [#code-scan-operation-configuration](#code-scan-operation-configuration "mention") * [#code-scan-results-1](#code-scan-results-1 "mention") {% hint style="info" %} #### Best Practices * Run Code Scans automatically before every deployment. * Set severity thresholds based on CI/CD rules. * Regularly review the **Code Scan Result** and fix recurring issues. * Combine **Code Scan** with a **Manual Step** to require a review and approval before production deployment. * Maintain consistent **Code Scan** configurations across all environments. {% endhint %} ### Scan Types The Code Scan operation supports two scan types: **Apex PMD** and **Flosum Scan**. Review the descriptions below to choose the scan type that best matches your team's quality standards. In the Check type dropdown menu, Flosum Scan is listed as Flosum. #### Apex PMD **Apex PMD** is an open-source ruleset that detects common issues in Salesforce components. It includes fewer rules than Flosum Scan and completes scans faster, making it a lightweight option for quick feedback. Choose Apex PMD when its baseline checks meet your needs or you prefer to detect fewer issues. #### Flosum Scan **Flosum Scan** is DevOps' most comprehensive ruleset, built for teams that demand the highest standard of code quality. It includes every rule in Apex PMD plus hundreds of additional checks, roughly 6 times the coverage of Apex PMD, and it extends static analysis to languages that Apex PMD does not cover, including **Salesforce Flow** and **TypeScript**. This expanded coverage delivers deeper analysis and stricter validation, giving you greater confidence with every deployment. Choose Flosum Scan for the most thorough protection of your Salesforce code. {% hint style="info" %} #### Why Flosum Scan? * **Broader language coverage**: Adds first-class support for **Salesforce Flow** and **TypeScript**, neither of which is analyzed by **Apex PMD**. * **Deeper Lightning coverage**: Includes 381 rules for **JavaScript** and **Lightning Web Components**, compared to 19 in **Apex PMD**. * **Stronger metadata validation**: Applies 18 rules to **Salesforce Metadata**, compared to 2 in **Apex PMD**. * **Continuously expanded**: The **Flosum Scan** ruleset is maintained by Flosum and will grow to keep pace with Salesforce platform changes. {% endhint %} #### Rule Coverage by Language The table below lists the languages supported by each scan type. The chart compares the rule coverage for each scan type across the supported languages. Use this information to confirm that the scan type you select provides sufficient rulesets for the languages used in your branch.
LanguageApex PMDFlosum Scan
JavaScript / Lightning Web Components
TypeScript
Apex
Salesforce Metadata
HTML / Salesforce Lightning Design System
Salesforce Flow
Visualforce
### Severity Levels When the Code Scan finds an issue, it assigns a Severity Level that reflects how critical the issue is to the quality of your code. Use these levels to prioritize fixes and set the severity threshold that determines when the operation fails.
Severity LevelDescription
BlockerSevere security risks or critical bugs that can cause system failure or data loss.
CriticalSignificant issues that typically violate Salesforce AppExchange standards.
MajorBest-practice violations or performance issues that affect maintainability.
MinorLow-impact code-quality issues or stylistic inconsistencies.
InfoInformational messages that require no action.
## Code Scan Operation Configuration {% hint style="info" %} The instructions below apply to configuring this pipeline operation. For general instructions on adding a pipeline step and setting the next step, see the following article. [Adding a Pipeline Step](/devops/pipeline/configuring-pipeline-steps/adding-a-pipeline-step.md) {% endhint %} {% stepper %} {% step %} ### Select Operation and Type 1. Click the **Operation** dropdown menu. 2. Select **Code Scan**.
3. Click the **Check type** dropdown menu. 4. Select **Apex PMD** or **Flosum**. **Flosum** is the Flosum Scan type. See the Scan Types section above for more details.
{% endstep %} {% step %} ### Enter Description and Threshold 1. (Optional) In the **Description** textbox, enter a summary of what this Code Scan performs. 2. Click the **Severity threshold** dropdown menu. 3. Select the minimum severity level that will cause the Code Scan operation to fail. See the Severity Levels section above for more details.
{% hint style="info" %} The **Severity threshold** means that if an issue at or above the selected severity level is found, the Code Scan will fail. {% endhint %} {% endstep %} {% endstepper %} ## Code Scan Results {% hint style="info" %} Once a pipeline is started, its progress and results can be viewed from the **Activities** tab from the branch that ran the pipeline. The instructions below show you how to review the results of this operation. For general instructions on accessing pipeline results from the branch, see the following article. * [Viewing Pipeline Results](/devops/pipeline/pipeline-actions/viewing-pipeline-results.md) {% endhint %} {% stepper %} {% step %} ### Summary and Log Once the Code Scan is complete, you can view the results summary by selecting the **Code Scan** step from the pipeline results.
The **Summary** of the Code Scan results displays the following information:
FieldsDescription
Status

Completed if all issues found are below the set Severity Threshold.

Exception if any issue meets or exceeds the Severity Threshold.

DurationTime the Code Scan took to complete, shown in hours, minutes, and seconds.
Date started/finishedThe date and time the Code Scan started and finished.
Issues FoundNumber of issues found at each Severity Level.
LogLog entries for the Code Scan job. Use the log to review the job's status and any error messages.
Example of a Code Scan log: {% code overflow="wrap" expandable="true" %} ``` [May 22, 2026 1:09 PM]: [info] Job started [May 22, 2026 1:09 PM]: [info] Create salesforce project started [May 22, 2026 1:09 PM]: [info] Create salesforce project completed [May 22, 2026 1:09 PM]: [info] Retrieve salesforce components started [May 22, 2026 1:09 PM]: [info] Retrieve salesforce components completed [May 22, 2026 1:09 PM]: [info] Code analyzer started [May 22, 2026 1:10 PM]: [info] Code analyzer completed [May 22, 2026 1:10 PM]: [error] Job failed: Code scan exceeded the allowed value: "Minor" ``` {% endcode %} {% endstep %} {% step %} ### Code Scan Results You can view the Code Scan Results to see which files in your branch the scan found issues with and how many of each Severity Level were found. 1. Click **See result**.
{% hint style="info" %} Currently, the Severity Level labels on the **Code Scan Result** page differ from the labels used in other Code Scan sections. This minor issue will be resolved soon. In the meantime, use the following mapping to translate the Severity Levels: * **Critical → Blocker** * **High → Critical** * **Medium → Major** * **Low → Minor** * **Minor → Info** {% endhint %} At the top of the results page is the total number of issues found for each Severity Level. Under the totals is a list of component files with issues, along with a bar graph of issues organized by Severity.
{% endstep %} {% step %} ### File-Level Results The file-level results explain the cause of each issue and where it occurs in the source file. Review each issue and, when applicable, make the required changes to the component. 1. Click a file from the list to view the full list of issues.
2. If available, click **Show more** to view more issues found in this file. The screenshot and table below explain the information displayed for each issue.
ColumnDescription
Severity LevelA colored circle with a letter inside indicates the Severity Level. The letter matches the first letter of the Severity Level name, and the color matches the level. Note: Major and Minor both start with M, but Major is orange and Minor is green.
Rule NameThe name of the rule that flagged the issue.
Violation DescriptionA description of the issue's cause.
Violation LocationThe line and column number where the issue was found.
{% endstep %} {% endstepper %} --- # Agent Instructions This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com. ## Querying This Documentation If you need additional information that is not directly available in this page, you can query the documentation by asking a question. Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters: ``` GET https://docs.flosum.com/devops/pipeline/pipeline-operations/pipeline-operation-code-scan.md?ask=&goal= ``` `ask` is the immediate question: it should be specific, self-contained, and written in natural language. `goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case. The response will contain a direct answer to the question and relevant excerpts and sources from the documentation. Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.