Pipeline Operation: Code Scan
Written for the Old UI
This article was written for the old UI. The instructions are still usable, but the screenshots are outdated. In some cases, items referenced in the instructions have moved or changed. If you cannot find an item, see the Where Did It Go article.
Overview
The Code Scan operation analyzes your Salesforce metadata to identify code quality issues before deployment. Through static code analysis, it reports rule violations in a branch’s Apex classes, triggers, and other components to confirm they meet your defined coding standards. The Code Scan rule set covers:
Coding Style and Best Practices: Improve readability, maintainability, and consistency across your codebase.
Security Best Practices: Identify common vulnerabilities and risky patterns in your code.
Performance Suggestions: Highlight inefficient logic before it affects end users.
You can set a severity threshold to abort the pipeline when violations reach or exceed a specified level. Running Code Scans in your pipeline helps maintain consistent code quality and enables you to deploy reliable, secure, and responsive components.
This article explains how to configure and use the Code Scan operation. See the following sections to learn more:
Best Practices
Run Code Scans automatically before every deployment.
Set severity thresholds based on CI/CD rules.
Regularly review the Code Scan Result and fix recurring issues.
Combine Code Scan with a Manual Step to require a review and approval before production deployment.
Maintain consistent Code Scan configurations across all environments.
Scan Types
The Code Scan operation supports two scan types: Apex PMD and Flosum Scan. Review the descriptions below to choose the scan type that best matches your team's quality standards.
Apex PMD
Apex PMD is an open-source ruleset that detects common issues in Salesforce components. It includes fewer rules than Flosum Scan and completes scans faster, making it a lightweight option for quick feedback. Choose Apex PMD when its baseline checks meet your needs or you prefer to detect fewer issues.
Flosum Scan
Flosum Scan is DevOps' most comprehensive ruleset, built for teams that demand the highest standard of code quality. It includes every rule in Apex PMD plus hundreds of additional checks, roughly 6 times the coverage of Apex PMD, and it extends static analysis to languages that Apex PMD does not cover, including Salesforce Flow and TypeScript. This expanded coverage delivers deeper analysis and stricter validation, giving you greater confidence with every deployment. Choose Flosum Scan for the most thorough protection of your Salesforce code.
Why Flosum Scan?
Broader language coverage: Adds first-class support for Salesforce Flow and TypeScript, neither of which is analyzed by Apex PMD.
Deeper Lightning coverage: Includes 381 rules for JavaScript and Lightning Web Components, compared to 19 in Apex PMD.
Stronger metadata validation: Applies 18 rules to Salesforce Metadata, compared to 2 in Apex PMD.
Continuously expanded: The Flosum Scan ruleset is maintained by Flosum and will grow to keep pace with Salesforce platform changes.
Rule Coverage by Language
The table below lists the languages supported by each scan type. The chart compares the rule coverage for each scan type across the supported languages. Use this information to confirm that the scan type you select provides sufficient rulesets for the languages used in your branch.
JavaScript / Lightning Web Components
TypeScript
Apex
Salesforce Metadata
HTML / Salesforce Lightning Design System
Salesforce Flow
Visualforce
Severity Levels
When the Code Scan finds an issue, it assigns a Severity Level that reflects how critical the issue is to the quality of your code. Use these levels to prioritize fixes and set the severity threshold that determines when the operation fails.
Blocker
Severe security risks or critical bugs that can cause system failure or data loss.
Critical
Significant issues that typically violate Salesforce AppExchange standards.
Major
Best-practice violations or performance issues that affect maintainability.
Minor
Low-impact code-quality issues or stylistic inconsistencies.
Info
Informational messages that require no action.
Code Scan Operation Configuration
Select Operation and Type
Click the Operation dropdown menu.
Select Code Scan.
Click the Check type dropdown menu.
Select the type of code scan to perform. See the Pipeline Operation: Code Scan section above for more details.
Enter Description and Threshold
(Optional) In the Description textbox, enter a summary of what this Code Scan performs.
Click the Severity threshold dropdown menu.
Select the minimum severity level that will cause the Code Scan operation to fail. See the Pipeline Operation: Code Scan section above for more details.
Code Scan Results
Summary and Log
Once the Code Scan is complete, you can view the results summary by selecting the Code Scan step from the pipeline results.
The Summary of the Code Scan results displays the following information:
Status
Completed if all issues found are below the set Severity Threshold.
Exception if any issue meets or exceeds the Severity Threshold.
Duration
Time the Code Scan took to complete, shown in hours, minutes, and seconds.
Date started/finished
The date and time the Code Scan started and finished.
Issues Found
Number of issues found at each Severity Level.
Log
Log entries for the Code Scan job. Use the log to review the job's status and any error messages.
Example of a Code Scan log:
Code Scan Results
You can view the Code Scan Results to see which files in your branch the scan found issues with and how many of each Severity Level were found.
Click See result.
At the top of the results page is the total number of issues found for each Severity Level. Under the totals is a list of component files with issues, along with a bar graph of issues organized by Severity.
File-Level Results
The file-level results explain the cause of each issue and where it occurs in the source file. Review each issue and, when applicable, make the required changes to the component.
Click a file from the list to view the full list of issues.
If available, click Show more to view more issues found in this file.
The screenshot and table below explain the information displayed for each issue.
Severity Level
A colored circle with a letter inside indicates the Severity Level. The letter matches the first letter of the Severity Level name, and the color matches the level. Note: Major and Minor both start with M, but Major is orange and Minor is green.
Rule Name
The name of the rule that flagged the issue.
Violation Description
A description of the issue's cause.
Violation Location
The line and column number where the issue was found.
Last updated
Was this helpful?