diff --git a/.github/workflows/salesforce-analyezer.yml b/.github/workflows/salesforce-analyezer.yml new file mode 100644 index 0000000..3e36a99 --- /dev/null +++ b/.github/workflows/salesforce-analyezer.yml @@ -0,0 +1,58 @@ +name: Salesforce Code Analyzer Workflow +on: + pull_request: +jobs: + salesforce-code-analyzer-workflow: + permissions: + pull-requests: write # Grants permission to create a pull request review. Only necessary if running against pull requests. + contents: read # Grants permission to check out the repository. Only necessary for private repos. + actions: read # Grants permission to read the in-progress actions. Only necessary for private repos. + runs-on: ubuntu-latest + steps: + - name: Check out files + uses: actions/checkout@v5 + + # PREREQUISITES - Only needed if the runner doesn't already satisfy these requirements. + - name: Ensure node v20.9.0 or greater + uses: actions/setup-node@v5 + with: + node-version: ">=20.9.0" + - name: Ensure java v11 or greater + uses: actions/setup-java@v5 + with: + java-version: ">=11" + distribution: "zulu" + - name: Ensure python v3.10 or greater + uses: actions/setup-python@v6 + with: + python-version: ">=3.10" + + - name: Install Salesforce CLI + run: npm install -g @salesforce/cli@latest + + - name: Install Latest Salesforce Code Analyzer CLI Plugin + run: sf plugins install code-analyzer@latest + + - name: Run Salesforce Code Analyzer + id: run-code-analyzer + uses: forcedotcom/run-code-analyzer@v2 + with: + run-arguments: --workspace . --view detail --output-file sfca_results.html --output-file sfca_results.json + results-artifact-name: salesforce-code-analyzer-results + github-token: ${{ github.token }} + + # Option 1: Quality gate on ALL files in the repository + - name: Fail on Critical/High Violations (All Files) + if: | + steps.run-code-analyzer.outputs.exit-code > 0 || + steps.run-code-analyzer.outputs.num-sev1-violations > 0 || + steps.run-code-analyzer.outputs.num-sev2-violations > 0 || + steps.run-code-analyzer.outputs.num-violations > 10 + run: exit 1 + + # Option 2: Quality gate on CHANGED files only (useful for legacy codebases) + - name: Fail on Critical/High Violations (Changed Files Only) + if: | + steps.run-code-analyzer.outputs.num-sev1-violations-in-changed-files > 0 || + steps.run-code-analyzer.outputs.num-sev2-violations-in-changed-files > 0 + run: exit 1 diff --git a/.github/workflows/test-shared-workflow.yml b/.github/workflows/test-shared-workflow.yml new file mode 100644 index 0000000..34439aa --- /dev/null +++ b/.github/workflows/test-shared-workflow.yml @@ -0,0 +1,20 @@ +name: Test Shared Workflow +on: + workflow_dispatch: + push: + branches: + - feature/salesforce-analyzer + +jobs: + test-shared: + uses: gforceinnovation/shared-github-actions/.github/workflows/test-simple.yml@main + with: + message: "Testing shared workflow permissions!" + + display-result: + needs: test-shared + runs-on: ubuntu-latest + steps: + - name: Show result + run: | + echo "Result from shared workflow: ${{ needs.test-shared.outputs.result }}"