From ceb594de50db4aeecda5a94d707dc9654392e086 Mon Sep 17 00:00:00 2001 From: Gabor Demeter Date: Mon, 15 Dec 2025 20:02:52 +0100 Subject: [PATCH 01/10] fix: Ensure pull request triggers include all relevant types for Salesforce Code Analyzer --- .github/workflows/salesforce-analyezer.yml | 38 ++++++++++++++++++++++ 1 file changed, 38 insertions(+) create mode 100644 .github/workflows/salesforce-analyezer.yml diff --git a/.github/workflows/salesforce-analyezer.yml b/.github/workflows/salesforce-analyezer.yml new file mode 100644 index 0000000..6f26920 --- /dev/null +++ b/.github/workflows/salesforce-analyezer.yml @@ -0,0 +1,38 @@ +name: Salesforce Code Analyzer Workflow +on: + pull_request: + types: [opened, synchronize, reopened] + +jobs: + # Option 1: Quality gate on ALL files in the repository + analyze-all-files: + uses: gforceinnovation/shared-github-action/.github/workflows/salesforce-code-analyzer.yml@main + permissions: + pull-requests: write + contents: read + actions: read + with: + workspace: "." + view: "detail" + output-file-html: "sfca_results.html" + output-file-json: "sfca_results.json" + results-artifact-name: "salesforce-code-analyzer-results" + fail-on-sev1-violations: true + fail-on-sev2-violations: true + max-violations: 10 + fail-on-changed-files-only: false + + # Option 2: Quality gate on CHANGED files only (useful for legacy codebases) + # Uncomment this job and comment out the one above if you want to only check changed files + # analyze-changed-files: + # uses: /shared-github-action/.github/workflows/salesforce-code-analyzer.yml@main + # permissions: + # pull-requests: write + # contents: read + # actions: read + # with: + # workspace: '.' + # view: 'detail' + # fail-on-changed-files-only: true + # fail-on-sev1-violations: true + # fail-on-sev2-violations: true From b593526288b670934498cb4207c59d4331bb37ec Mon Sep 17 00:00:00 2001 From: Gabor Demeter Date: Mon, 15 Dec 2025 20:23:47 +0100 Subject: [PATCH 02/10] feat: Add workflow_dispatch trigger to Salesforce Code Analyzer workflow --- .github/workflows/salesforce-analyezer.yml | 1 + 1 file changed, 1 insertion(+) diff --git a/.github/workflows/salesforce-analyezer.yml b/.github/workflows/salesforce-analyezer.yml index 6f26920..e9d2e0a 100644 --- a/.github/workflows/salesforce-analyezer.yml +++ b/.github/workflows/salesforce-analyezer.yml @@ -2,6 +2,7 @@ name: Salesforce Code Analyzer Workflow on: pull_request: types: [opened, synchronize, reopened] + workflow_dispatch: jobs: # Option 1: Quality gate on ALL files in the repository From a23517f44ea42266d7010020b4594fb4217ccf46 Mon Sep 17 00:00:00 2001 From: Gabor Demeter Date: Mon, 15 Dec 2025 20:25:17 +0100 Subject: [PATCH 03/10] fix: Correct path to shared GitHub actions in Salesforce Code Analyzer workflow --- .github/workflows/salesforce-analyezer.yml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.github/workflows/salesforce-analyezer.yml b/.github/workflows/salesforce-analyezer.yml index e9d2e0a..c4496dc 100644 --- a/.github/workflows/salesforce-analyezer.yml +++ b/.github/workflows/salesforce-analyezer.yml @@ -7,7 +7,7 @@ on: jobs: # Option 1: Quality gate on ALL files in the repository analyze-all-files: - uses: gforceinnovation/shared-github-action/.github/workflows/salesforce-code-analyzer.yml@main + uses: gforceinnovation/shared-github-actions/.github/workflows/salesforce-code-analyzer.yml@main permissions: pull-requests: write contents: read From 3afe8ecaec4447749c59b621fa2e34a02dca046b Mon Sep 17 00:00:00 2001 From: Gabor Demeter Date: Mon, 15 Dec 2025 20:29:37 +0100 Subject: [PATCH 04/10] test: Empty commit to trigger workflow From 6cd0b826bfd372827a4b00dfe948dbfc619d98fd Mon Sep 17 00:00:00 2001 From: Gabor Demeter Date: Mon, 15 Dec 2025 20:32:14 +0100 Subject: [PATCH 05/10] test: Empty commit to trigger workflow From ede03f321fb415c124324e0717e15efdeae62b9c Mon Sep 17 00:00:00 2001 From: Gabor Demeter Date: Mon, 15 Dec 2025 20:36:26 +0100 Subject: [PATCH 06/10] test: Empty commit to trigger workflow From 57e973210ec1ac9502c84bb307b9e43282eef14e Mon Sep 17 00:00:00 2001 From: Gabor Demeter Date: Mon, 15 Dec 2025 20:38:55 +0100 Subject: [PATCH 07/10] Add: Test workflow to validate shared workflow access --- .github/workflows/test-shared-workflow.yml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) create mode 100644 .github/workflows/test-shared-workflow.yml diff --git a/.github/workflows/test-shared-workflow.yml b/.github/workflows/test-shared-workflow.yml new file mode 100644 index 0000000..34439aa --- /dev/null +++ b/.github/workflows/test-shared-workflow.yml @@ -0,0 +1,20 @@ +name: Test Shared Workflow +on: + workflow_dispatch: + push: + branches: + - feature/salesforce-analyzer + +jobs: + test-shared: + uses: gforceinnovation/shared-github-actions/.github/workflows/test-simple.yml@main + with: + message: "Testing shared workflow permissions!" + + display-result: + needs: test-shared + runs-on: ubuntu-latest + steps: + - name: Show result + run: | + echo "Result from shared workflow: ${{ needs.test-shared.outputs.result }}" From 4a1af7fac1d3dbe33d3fe9f7bbdb7dbf5fac1672 Mon Sep 17 00:00:00 2001 From: Gabor Demeter Date: Mon, 15 Dec 2025 20:41:15 +0100 Subject: [PATCH 08/10] test: Empty commit to trigger workflow From d17207367197585d47c961152b1ec6ced17cc141 Mon Sep 17 00:00:00 2001 From: Gabor Demeter Date: Mon, 15 Dec 2025 20:47:35 +0100 Subject: [PATCH 09/10] Fix: Pass GITHUB_TOKEN secret to reusable workflow --- .github/workflows/salesforce-analyezer.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/salesforce-analyezer.yml b/.github/workflows/salesforce-analyezer.yml index c4496dc..1c16614 100644 --- a/.github/workflows/salesforce-analyezer.yml +++ b/.github/workflows/salesforce-analyezer.yml @@ -12,6 +12,8 @@ jobs: pull-requests: write contents: read actions: read + secrets: + github-token: ${{ secrets.GITHUB_TOKEN }} with: workspace: "." view: "detail" From f61563e4ab1e3db251d7095592970ca64e9fd2a4 Mon Sep 17 00:00:00 2001 From: Gabor Demeter Date: Mon, 15 Dec 2025 21:31:33 +0100 Subject: [PATCH 10/10] Add: Update Salesforce Code Analyzer workflow to include detailed output and improved violation checks --- .github/workflows/salesforce-analyezer.yml | 87 +++++++++++++--------- 1 file changed, 52 insertions(+), 35 deletions(-) diff --git a/.github/workflows/salesforce-analyezer.yml b/.github/workflows/salesforce-analyezer.yml index 1c16614..3e36a99 100644 --- a/.github/workflows/salesforce-analyezer.yml +++ b/.github/workflows/salesforce-analyezer.yml @@ -1,41 +1,58 @@ name: Salesforce Code Analyzer Workflow on: pull_request: - types: [opened, synchronize, reopened] - workflow_dispatch: - jobs: - # Option 1: Quality gate on ALL files in the repository - analyze-all-files: - uses: gforceinnovation/shared-github-actions/.github/workflows/salesforce-code-analyzer.yml@main + salesforce-code-analyzer-workflow: permissions: - pull-requests: write - contents: read - actions: read - secrets: - github-token: ${{ secrets.GITHUB_TOKEN }} - with: - workspace: "." - view: "detail" - output-file-html: "sfca_results.html" - output-file-json: "sfca_results.json" - results-artifact-name: "salesforce-code-analyzer-results" - fail-on-sev1-violations: true - fail-on-sev2-violations: true - max-violations: 10 - fail-on-changed-files-only: false + pull-requests: write # Grants permission to create a pull request review. Only necessary if running against pull requests. + contents: read # Grants permission to check out the repository. Only necessary for private repos. + actions: read # Grants permission to read the in-progress actions. Only necessary for private repos. + runs-on: ubuntu-latest + steps: + - name: Check out files + uses: actions/checkout@v5 + + # PREREQUISITES - Only needed if the runner doesn't already satisfy these requirements. + - name: Ensure node v20.9.0 or greater + uses: actions/setup-node@v5 + with: + node-version: ">=20.9.0" + - name: Ensure java v11 or greater + uses: actions/setup-java@v5 + with: + java-version: ">=11" + distribution: "zulu" + - name: Ensure python v3.10 or greater + uses: actions/setup-python@v6 + with: + python-version: ">=3.10" + + - name: Install Salesforce CLI + run: npm install -g @salesforce/cli@latest + + - name: Install Latest Salesforce Code Analyzer CLI Plugin + run: sf plugins install code-analyzer@latest + + - name: Run Salesforce Code Analyzer + id: run-code-analyzer + uses: forcedotcom/run-code-analyzer@v2 + with: + run-arguments: --workspace . --view detail --output-file sfca_results.html --output-file sfca_results.json + results-artifact-name: salesforce-code-analyzer-results + github-token: ${{ github.token }} + + # Option 1: Quality gate on ALL files in the repository + - name: Fail on Critical/High Violations (All Files) + if: | + steps.run-code-analyzer.outputs.exit-code > 0 || + steps.run-code-analyzer.outputs.num-sev1-violations > 0 || + steps.run-code-analyzer.outputs.num-sev2-violations > 0 || + steps.run-code-analyzer.outputs.num-violations > 10 + run: exit 1 - # Option 2: Quality gate on CHANGED files only (useful for legacy codebases) - # Uncomment this job and comment out the one above if you want to only check changed files - # analyze-changed-files: - # uses: /shared-github-action/.github/workflows/salesforce-code-analyzer.yml@main - # permissions: - # pull-requests: write - # contents: read - # actions: read - # with: - # workspace: '.' - # view: 'detail' - # fail-on-changed-files-only: true - # fail-on-sev1-violations: true - # fail-on-sev2-violations: true + # Option 2: Quality gate on CHANGED files only (useful for legacy codebases) + - name: Fail on Critical/High Violations (Changed Files Only) + if: | + steps.run-code-analyzer.outputs.num-sev1-violations-in-changed-files > 0 || + steps.run-code-analyzer.outputs.num-sev2-violations-in-changed-files > 0 + run: exit 1