# Chapter 4 - Base Project Setup This chapter covers everything needed to make the `bitbucket-pipelines.yml` operational, and explains what the pipeline does and when. Once completed, these configurations rarely need modification. ## 4.1 Repository Setup ### SFDX Project Creation Create the base Salesforce DX project structure: ```bash # Create new SFDX project sf project generate --name "your-project-name" --template standard # Navigate to project directory cd your-project-name # Initialize Git repository git init git add . git commit -m "Initial SFDX project setup" ``` ### Required Project Structure Your project should have this structure. Note the extra Config elements - we'll set these up here. They're used for the scratch org creation mostly. ```lua your-project-name/ ├── config/ │ ├── project-scratch-def.json │ ├── packagestoinstall.txt │ ├── permsets.txt │ ├── codeanalyzer/ │ │ └── code-analyzer.yml │ ├── sfdmu-currency/ │ ├── sfdmu-demodata/ │ └── payload.json.template.* ├── force-app/ │ └── main/ │ └── default/ ├── pre-deploy-dependencies/ ├── scripts/ ├── tests/ ├── .forceignore ├── .gitignore ├── .sgdignore ├── bitbucket-pipelines.yml ├── package.json └── sfdx-project.json ``` ### Essential Configuration Files **.forceignore** - Exclude metadata from deployments: ```c # List files or directories below to ignore them when running force:source:push, force:source:pull, and force:source:status # More information: https://developer.salesforce.com/docs/atlas.en-us.sfdx_dev.meta/sfdx_dev/sfdx_dev_exclude_source.htm # Package.xml and autogenerated package files package.xml package/** # LWC configuration files **/jsconfig.json **/.eslintrc.json # LWC Jest **/__tests__/** # Standard Elements that should never be retrieved *.flexipages/LightningSalesConsole_UtilityBar** # These metadata files are ignored when promoting (deploying) **/appMenus/** **/appSwitcher/** **/fieldRestrictionRules/** **/settings/** **/AuthProvider/** # User Access Policies error on Deploy due to a KI https://issues.salesforce.com/issue/a028c00000zKnmrAAC/undefined **/useraccesspolicies/** # These metadata files are ignored when pulling (retrieving) and are mostly things that are not deployable *.appMenu *.appSwitcher *.rule *.AuthProvider *.featureParameters # *.featureParametersInteger # *.featureParametersBoolean # Settings can cause issues # *.settings # Profiles are negated except the ones we want # *.profile **/profiles/** !**/profiles/Admin* !**/profiles/Read* # Permissions on retrieve *.sharingRules **/sharingRules/** *.profilePasswordPolicy *.profileSessionSetting # Permissions on deploy **/profilePasswordPolicy/** **/profileSessionSetting/** # Translations # .objectTranslations # **/objectTranslations/** # Project-Specific Exclusions **/duplicateRules/** ``` **.gitignore** - Exclude files from version control: ```c # Salesforce cache .sf/ .sfdx/ .localdevserver/ # IDE files .vscode/ *.log .DS_Store # Node modules node_modules/ ``` **.sgdignore** - Exclude from SGD delta deployments: ```c # Exclude profiles and permission sets from delta **/profiles/** **/permissionsets/** # UAPs don't deploy well via MDAPI, and there's a KI for UAPs with Groups **/useraccesspolicies/** ``` .**sgddestrdignore -** Tells SGD which files should **never** appear in destructive changes, even if deleted from the repo. ```c # Never auto-delete objects or their fields force-app/main/default/objects/ # Never auto-delete permission sets force-app/main/default/permissionsets/ ```

Be conservative here. It is always safer to block a destructive change and apply it manually than to accidentally delete a field in production.

## 4.2 Bitbucket Repository Integration ### 4.2.1 Create Bitbucket Repository 1. **In Bitbucket workspace:** - Create new repository: `your-project-name` - Access level: Private - **Do not** include README or .gitignore (we have our own) 2. **Link local project to remote:**
Bash
``` git remote add origin https://bitbucket.org/your-workspace/your-project-name.git git push -u origin main ``` ### 4.2.2 Repository Variables Configuration Repository variables are accessible by all pipelines and users with push permissions. Configure these in **Repository Settings → Pipelines → Repository variables**. #### Core Authentication Variables
Variable NameTypeDescriptionExample Value
`DEVHUB_TOKEN`SecuredSFDX authentication URL for Dev Hub org`force://PlatformCLI::...`
`ACCESS_TOKEN`SecuredDefault authentication token for deployments`force://PlatformCLI::...`
#### Notification & Communication
Variable NameTypeDescriptionExample Value
`TEAMS_WEBHOOK`SecuredMicrosoft Teams webhook URL for notifications`https://outlook.office.com/webhook/...`
`BB_EMAIL`UnsecuredEmail for Bitbucket operations`cicd_projectnameb@company.com`
`BB_EMAIL_PASSWORD`SecuredPassword for Bitbucket email account`••••••`
#### Code Quality & Testing
Variable NameTypeDescriptionExample Value
`SEV_THRESH`UnsecuredCode Analyzer severity threshold (1-3)`1`
#### Scratch Org Management
Variable NameTypeDescriptionExample Value
`SNAPSHOT_NAME`UnsecuredName for scratch org snapshotsClient\_Project\_Snap
`SF_DISABLE_SOURCE_MEMBER_POLLING`UnsecuredDisable source member polling for performance`TRUE`
#### Setting Up Repository Variables 1. **Navigate to Repository Settings:** - Go to your Bitbucket repository - Click **Repository settings** in the left sidebar - Select **Pipelines** → **Repository variables** 2. **Add Each Variable:** - Click **Add** button - Enter **Name** (exactly as shown in table) - Enter **Value** - Check **Secured** checkbox for sensitive values - Click **Add** 3. **Security Best Practices:** - **Always secure** authentication tokens, passwords, and webhook URLs - **Leave unsecured** only configuration values that are safe to display in logs - **Test variables** by running a simple pipeline that echoes non-secured values ### 4.3 Deployment Environments Configure in **Repository Settings → Deployments.** These are environment-specific variables and allow for example storing Salesforce login information.
ariable NameTypeDescriptionExample Value
`ACCESS_TOKEN`SecuredAuthentication URL`force://PlatformCLI::...`
`INSTANCE_URL`UnsecuredSalesforce instance URL`https://stuff--dev.sandbox.my.salesforce.com`
`TESTLEVEL`UnsecuredTest execution level for deployments`NoTestRun`
### 4.4 Salesforce Environment Setup ### Authentication Token Generation #### For Salesforce Orgs 1. **Generate SFDX Auth URL:** ```bash # Login to the target org sf org login web --alias target-org # Generate auth URL sf org display --target-org target-org --verbose # Copy the "Sfdx Auth Url" value ``` 2. **Format for Bitbucket:** - The auth URL format: `force://PlatformCLI::5Aep861...::user@example.com` - Use this complete string as the `ACCESS_TOKEN` value - **Always mark as Secured** #### For Dev Hub 1. **Enable Dev Hub in Production:** - Setup → Dev Hub → Enable Dev Hub - Enable Source Tracking in Developer Sandboxes 2. **Generate Dev Hub Token:** ```bash # Login to Production org (Dev Hub) sf org login web --alias devhub --set-default-dev-hub # Get auth URL sf org display --target-org devhub --verbose ``` #### Dev Hub Configuration In your Production org: 1. Navigate to **Setup → Dev Hub** 2. Enable **"Enable Dev Hub"** 3. Enable **"Enable Source Tracking in Developer and Developer Pro Sandboxes"** ## 4.5 Teams Webhook Configuration #### Create Teams Webhook 1. **In Microsoft Teams:** - Navigate to your project channel - Click **⋯** (More options) → **Connectors** - Search for "Incoming Webhook" - Click **Configure** 2. **Configure Webhook:** - Name: `Salesforce CI/CD Pipeline` - Upload icon (optional) - Click **Create** - **Copy the webhook URL** 3. **Add to Bitbucket:** - Use the webhook URL as `TEAMS_WEBHOOK` value - **Always mark as Secured** ## 4.6 Scratch Org Definition Create `config/project-scratch-def.json`. The documentation for scratch org [ features](https://developer.salesforce.com/docs/atlas.en-us.sfdx_dev.meta/sfdx_dev/sfdx_dev_scratch_orgs_def_file_config_values.htm) are listed here, and [settings](https://developer.salesforce.com/docs/atlas.en-us.260.0.api_meta.meta/api_meta/meta_settings.htm) are here. [Trailhead about Scratch orgs](https://trailhead.salesforce.com/fr/content/learn/projects/quick-start-salesforce-dx/create-and-test-our-scratch-org). ```json { "orgName": "My Project Name Scratch Org", "adminEmail":"myprojectalias@company.com", "country":"US", "language":"en_US", "description": "Scratch Org for project blablabla.", "hasSampleData": true, "edition": "Enterprise", "features": [ "ContactsToMultipleAccounts", "DebugApex", "EnableSetPasswordInApi", "EntityTranslation", "Entitlements", "ForceComPlatform", "Interaction", "FlowSites", "FieldService:5", "FieldServiceDispatcherUser:5", "FieldServiceMobileExtension", "FieldServiceMobileUser:5", "FieldServiceSchedulingUser:5", "LiveAgent", "MarketingUser", "SalesUser", "SalesforceContentUser", "StateAndCountryPicklist", "RecordTypes", "RefreshOnInvalidSession", "ServiceCloud", "ServiceUser" ], "settings": { "caseSettings": { "closeCaseThroughStatusChange" : true }, "CustomAddressFieldSettings": { "enableCustomAddressField" : true }, "userManagementSettings": { "permsetsInFieldCreation": true, "userAccessPoliciesEnabled" : true }, "currencySettings":{ "enableMultiCurrency": true }, "languageSettings": { "enableTranslationWorkbench": true }, "pathAssistantSettings": { "pathAssistantEnabled": true }, "lightningExperienceSettings": { "enableS1DesktopEnabled": true, "enableUsersAreLightningOnly": true, "enableLexEndUsersNoSwitching": true }, "mobileSettings": { "enableS1EncryptedStoragePref2": false }, "opportunitySettings": { "enableOpportunityTeam": true }, "quoteSettings": { "enableQuote": true, "enableQuotesWithoutOppEnabled": true }, "securitySettings": { "enableAdminLoginAsAnyUser": true, "passwordPolicies": { "expiration": "Never", "historyRestriction": "0" }, "sessionSettings": { "sessionTimeout": "TwelveHours" } }, "sharingSettings": { "enableAssetSharing": true }, "fieldServiceSettings": { "enableDocumentBuilder": true, "enableWorkOrders": true, "fieldServiceNotificationsOrgPref": true, "fieldServiceOrgPref": true }, "chatterSettings": { "enableChatter": true } }, "objectSettings": { "product2": { "sharingModel": "read" }, "account": { "sharingModel": "read" }, "asset": { "sharingModel": "ControlledByParent" }, "contact": { "sharingModel": "Private" } } } ``` ### Package Installation List Create `config/packagestoinstall.txt`: ```ini # List package IDs to install in scratch orgs # One per line, comments start with # 04t000000000000AAA 04t000000000001AAA ``` ### Permission Set Assignment Create `config/permsets.txt`:
Plaintext
```ini # Permission sets to assign after deployment # One per line MyCustomPermissionSet AnotherPermissionSet ``` ## 4.5 Code Quality Configuration ### Code Analyzer Setup Create `config/codeanalyzer/code-analyzer.yml`:
Yaml
```bash # ====================================================================== # CODE ANALYZER CONFIGURATION # To learn more about this configuration, visit: # https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/config-custom.html # ====================================================================== # The absolute folder path to which all other path values in this configuration may be relative to. # If unspecified, or if specified as null, then the value is automatically chosen to be the parent folder of your Code Analyzer # configuration file if it exists, or the current working directory otherwise. config_root: null # Folder where to store log files. May be an absolute path or a path relative to config_root. # If unspecified, or if specified as null, then the value is automatically chosen to be your machine's default temporary directory. # log_folder: "./config/codeanalyzer/logs/" # Level at which to log messages to log files. # Possible values are: # 1 or 'Error' - Includes only error messages in the log. # 2 or 'Warn' - Includes warning and error messages in the log. # 3 or 'Info' - Includes informative, warning, and error messages in the log. # 4 or 'Debug' - Includes debug, informative, warning, and error messages in the log. # 5 or 'Fine' - Includes fine detail, debug, informative, warning, and error messages in the log. # If unspecified, or if specified as null, then the 'Debug' log level will be used. log_level: 1 # Rule override settings of the format rules.{engine_name}.{rule_name}.{property_name} = {override_value} where: # {engine_name} is the name of the engine containing the rule that you want to override. # {rule_name} is the name of the rule that you want to override. # {property_name} can either be: # 'severity' - [Optional] The severity level value that you want to use to override the default severity level for the rule # Possible values: 1 or 'Critical', 2 or 'High', 3 or 'Moderate', 4 or 'Low', 5 or 'Info' # 'tags' - [Optional] The string array of tag values that you want to use to override the default tags for the rule # ---- [Example usage]: --------------------- # rules: # eslint: # sort-vars: # severity: "Info" # tags: ["Recommended", "Suggestion"] # ------------------------------------------- rules: # ====================================================================== # ESLINT ENGINE RULE OVERRIDES # ====================================================================== eslint: "@lwc/lwc-platform/no-aura": severity: 3 tags: - Recommended - LWC - ErrorProne - JavaScript "@lwc/lwc-platform/no-aura-libs": severity: 3 tags: - Recommended - LWC - ErrorProne - JavaScript "@lwc/lwc-platform/no-community-import": severity: 3 tags: - Recommended - LWC - ErrorProne - JavaScript "@lwc/lwc-platform/no-create-context-provider": severity: 3 tags: - Recommended - LWC - BestPractices - JavaScript "@lwc/lwc-platform/no-deprecated-module-import": severity: 3 tags: - Recommended - LWC - BestPractices - JavaScript "@lwc/lwc-platform/no-dynamic-import-identifier": severity: 3 tags: - Recommended - LWC - BestPractices - JavaScript "@lwc/lwc-platform/no-inline-disable": severity: 3 tags: - Recommended - LWC - BestPractices - JavaScript "@lwc/lwc-platform/no-interop": severity: 3 tags: - Recommended - LWC - BestPractices - JavaScript "@lwc/lwc-platform/no-interop-create": severity: 3 tags: - Recommended - LWC - BestPractices - JavaScript "@lwc/lwc-platform/no-interop-dispatch": severity: 3 tags: - Recommended - LWC - BestPractices - JavaScript "@lwc/lwc-platform/no-interop-execute": severity: 3 tags: - Recommended - LWC - BestPractices - JavaScript "@lwc/lwc-platform/no-interop-execute-privileged": severity: 3 tags: - Recommended - LWC - BestPractices - JavaScript "@lwc/lwc-platform/no-interop-execute-raw-response": severity: 3 tags: - Recommended - LWC - BestPractices - JavaScript "@lwc/lwc-platform/no-interop-get-event": severity: 3 tags: - Recommended - LWC - BestPractices - JavaScript "@lwc/lwc-platform/no-interop-get-module": severity: 3 tags: - Recommended - LWC - BestPractices - JavaScript "@lwc/lwc-platform/no-interop-is-external-definition": severity: 3 tags: - Recommended - LWC - BestPractices - JavaScript "@lwc/lwc-platform/no-interop-load-definitions": severity: 3 tags: - Recommended - LWC - BestPractices - JavaScript "@lwc/lwc-platform/no-interop-module-instrumentation": severity: 3 tags: - Recommended - LWC - BestPractices - JavaScript "@lwc/lwc-platform/no-interop-module-storage": severity: 3 tags: - Recommended - LWC - BestPractices - JavaScript "@lwc/lwc-platform/no-interop-register": severity: 3 tags: - Recommended - LWC - BestPractices - JavaScript "@lwc/lwc-platform/no-interop-render": severity: 3 tags: - Recommended - LWC - BestPractices - JavaScript "@lwc/lwc-platform/no-interop-sanitize": severity: 3 tags: - Recommended - LWC - BestPractices - JavaScript "@lwc/lwc-platform/no-process-env": severity: 3 tags: - Recommended - LWC - BestPractices - JavaScript "@lwc/lwc-platform/no-restricted-namespaces": severity: 3 tags: - Recommended - LWC - ErrorProne - JavaScript "@lwc/lwc-platform/no-site-import": severity: 3 tags: - Recommended - LWC - ErrorProne - JavaScript "@lwc/lwc-platform/no-wire-service": severity: 3 tags: - Recommended - LWC - ErrorProne - JavaScript "@lwc/lwc-platform/valid-dynamic-import-hint": severity: 3 tags: - Recommended - LWC - BestPractices - JavaScript "@lwc/lwc/no-api-reassignments": severity: 3 tags: - Recommended - LWC - BestPractices - JavaScript "@lwc/lwc/no-async-operation": severity: 3 tags: - Recommended - LWC - BestPractices - JavaScript "@lwc/lwc/no-attributes-during-construction": severity: 3 tags: - Recommended - LWC - ErrorProne - JavaScript "@lwc/lwc/no-deprecated": severity: 3 tags: - Recommended - LWC - BestPractices - JavaScript "@lwc/lwc/no-disallowed-lwc-imports": severity: 3 tags: - Recommended - LWC - BestPractices - JavaScript "@lwc/lwc/no-document-query": severity: 3 tags: - Recommended - LWC - ErrorProne - JavaScript "@lwc/lwc/no-inner-html": severity: 2 tags: - Recommended - LWC - Security - JavaScript "@lwc/lwc/no-leading-uppercase-api-name": severity: 3 tags: - Recommended - LWC - ErrorProne - JavaScript "@lwc/lwc/no-template-children": severity: 3 tags: - Recommended - LWC - ErrorProne - JavaScript "@lwc/lwc/no-unexpected-wire-adapter-usages": severity: 3 tags: - Recommended - LWC - BestPractices - JavaScript "@lwc/lwc/no-unknown-wire-adapters": severity: 3 tags: - Recommended - LWC - BestPractices - JavaScript "@lwc/lwc/prefer-custom-event": severity: 3 tags: - Recommended - LWC - BestPractices - JavaScript "@lwc/lwc/valid-api": severity: 3 tags: - Recommended - LWC - ErrorProne - JavaScript "@lwc/lwc/valid-graphql-wire-adapter-callback-parameters": severity: 3 tags: - Recommended - LWC - ErrorProne - JavaScript "@lwc/lwc/valid-track": severity: 3 tags: - Recommended - LWC - ErrorProne - JavaScript "@lwc/lwc/valid-wire": severity: 3 tags: - Recommended - LWC - ErrorProne - JavaScript "@salesforce/lightning/valid-apex-method-invocation": severity: 3 tags: - Recommended - LWC - ErrorProne - JavaScript "@typescript-eslint/adjacent-overload-signatures": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/array-type": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/await-thenable": severity: 2 tags: - ErrorProne - TypeScript "@typescript-eslint/ban-ts-comment": severity: 2 tags: - Recommended - ErrorProne - TypeScript "@typescript-eslint/ban-tslint-comment": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/class-literal-property-style": severity: 2 tags: - ErrorProne - TypeScript "@typescript-eslint/class-methods-use-this": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/consistent-generic-constructors": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/consistent-indexed-object-style": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/consistent-return": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/consistent-type-assertions": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/consistent-type-definitions": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/consistent-type-exports": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/consistent-type-imports": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/default-param-last": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/dot-notation": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/explicit-function-return-type": severity: 2 tags: - ErrorProne - TypeScript "@typescript-eslint/explicit-member-accessibility": severity: 2 tags: - ErrorProne - TypeScript "@typescript-eslint/explicit-module-boundary-types": severity: 2 tags: - ErrorProne - TypeScript "@typescript-eslint/init-declarations": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/max-params": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/member-ordering": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/method-signature-style": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/naming-convention": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/no-array-constructor": severity: 3 tags: - Recommended - BestPractices - TypeScript "@typescript-eslint/no-array-delete": severity: 2 tags: - ErrorProne - TypeScript "@typescript-eslint/no-base-to-string": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/no-confusing-non-null-assertion": severity: 2 tags: - ErrorProne - TypeScript "@typescript-eslint/no-confusing-void-expression": severity: 2 tags: - ErrorProne - TypeScript "@typescript-eslint/no-deprecated": severity: 2 tags: - ErrorProne - TypeScript "@typescript-eslint/no-dupe-class-members": severity: 2 tags: - ErrorProne - TypeScript "@typescript-eslint/no-duplicate-enum-values": severity: 2 tags: - Recommended - ErrorProne - TypeScript "@typescript-eslint/no-duplicate-type-constituents": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/no-dynamic-delete": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/no-empty-function": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/no-empty-object-type": severity: 3 tags: - Recommended - BestPractices - TypeScript "@typescript-eslint/no-explicit-any": severity: 3 tags: - Recommended - BestPractices - TypeScript "@typescript-eslint/no-extra-non-null-assertion": severity: 2 tags: - Recommended - ErrorProne - TypeScript "@typescript-eslint/no-extraneous-class": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/no-floating-promises": severity: 2 tags: - ErrorProne - TypeScript "@typescript-eslint/no-for-in-array": severity: 2 tags: - ErrorProne - TypeScript "@typescript-eslint/no-implied-eval": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/no-import-type-side-effects": severity: 2 tags: - ErrorProne - TypeScript "@typescript-eslint/no-inferrable-types": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/no-invalid-this": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/no-invalid-void-type": severity: 2 tags: - ErrorProne - TypeScript "@typescript-eslint/no-loop-func": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/no-magic-numbers": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/no-meaningless-void-operator": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/no-misused-new": severity: 2 tags: - Recommended - ErrorProne - TypeScript "@typescript-eslint/no-misused-promises": severity: 2 tags: - ErrorProne - TypeScript "@typescript-eslint/no-misused-spread": severity: 2 tags: - ErrorProne - TypeScript "@typescript-eslint/no-mixed-enums": severity: 2 tags: - ErrorProne - TypeScript "@typescript-eslint/no-namespace": severity: 3 tags: - Recommended - BestPractices - TypeScript "@typescript-eslint/no-non-null-asserted-nullish-coalescing": severity: 2 tags: - ErrorProne - TypeScript "@typescript-eslint/no-non-null-asserted-optional-chain": severity: 2 tags: - Recommended - ErrorProne - TypeScript "@typescript-eslint/no-non-null-assertion": severity: 2 tags: - ErrorProne - TypeScript "@typescript-eslint/no-redeclare": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/no-redundant-type-constituents": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/no-require-imports": severity: 2 tags: - Recommended - ErrorProne - TypeScript "@typescript-eslint/no-restricted-imports": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/no-restricted-types": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/no-shadow": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/no-this-alias": severity: 3 tags: - Recommended - BestPractices - TypeScript "@typescript-eslint/no-unnecessary-boolean-literal-compare": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/no-unnecessary-condition": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/no-unnecessary-parameter-property-assignment": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/no-unnecessary-qualifier": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/no-unnecessary-template-expression": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/no-unnecessary-type-arguments": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/no-unnecessary-type-assertion": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/no-unnecessary-type-constraint": severity: 3 tags: - Recommended - BestPractices - TypeScript "@typescript-eslint/no-unnecessary-type-parameters": severity: 2 tags: - ErrorProne - TypeScript "@typescript-eslint/no-unsafe-argument": severity: 2 tags: - ErrorProne - TypeScript "@typescript-eslint/no-unsafe-assignment": severity: 2 tags: - ErrorProne - TypeScript "@typescript-eslint/no-unsafe-call": severity: 2 tags: - ErrorProne - TypeScript "@typescript-eslint/no-unsafe-declaration-merging": severity: 2 tags: - Recommended - ErrorProne - TypeScript "@typescript-eslint/no-unsafe-enum-comparison": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/no-unsafe-function-type": severity: 2 tags: - Recommended - ErrorProne - TypeScript "@typescript-eslint/no-unsafe-member-access": severity: 2 tags: - ErrorProne - TypeScript "@typescript-eslint/no-unsafe-return": severity: 2 tags: - ErrorProne - TypeScript "@typescript-eslint/no-unsafe-type-assertion": severity: 2 tags: - ErrorProne - TypeScript "@typescript-eslint/no-unsafe-unary-minus": severity: 2 tags: - ErrorProne - TypeScript "@typescript-eslint/no-unused-expressions": severity: 3 tags: - Recommended - BestPractices - TypeScript "@typescript-eslint/no-unused-vars": severity: 2 tags: - Recommended - ErrorProne - TypeScript "@typescript-eslint/no-use-before-define": severity: 2 tags: - ErrorProne - TypeScript "@typescript-eslint/no-useless-constructor": severity: 2 tags: - ErrorProne - TypeScript "@typescript-eslint/no-useless-empty-export": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/no-wrapper-object-types": severity: 2 tags: - Recommended - ErrorProne - TypeScript "@typescript-eslint/non-nullable-type-assertion-style": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/only-throw-error": severity: 2 tags: - ErrorProne - TypeScript "@typescript-eslint/parameter-properties": severity: 2 tags: - ErrorProne - TypeScript "@typescript-eslint/prefer-as-const": severity: 3 tags: - Recommended - BestPractices - TypeScript "@typescript-eslint/prefer-destructuring": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/prefer-enum-initializers": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/prefer-find": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/prefer-for-of": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/prefer-function-type": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/prefer-includes": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/prefer-literal-enum-member": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/prefer-namespace-keyword": severity: 3 tags: - Recommended - BestPractices - TypeScript "@typescript-eslint/prefer-nullish-coalescing": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/prefer-optional-chain": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/prefer-promise-reject-errors": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/prefer-readonly": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/prefer-readonly-parameter-types": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/prefer-reduce-type-parameter": severity: 2 tags: - ErrorProne - TypeScript "@typescript-eslint/prefer-regexp-exec": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/prefer-return-this-type": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/prefer-string-starts-ends-with": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/promise-function-async": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/related-getter-setter-pairs": severity: 2 tags: - ErrorProne - TypeScript "@typescript-eslint/require-array-sort-compare": severity: 2 tags: - ErrorProne - TypeScript "@typescript-eslint/require-await": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/restrict-plus-operands": severity: 2 tags: - ErrorProne - TypeScript "@typescript-eslint/restrict-template-expressions": severity: 2 tags: - ErrorProne - TypeScript "@typescript-eslint/return-await": severity: 2 tags: - ErrorProne - TypeScript "@typescript-eslint/strict-boolean-expressions": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/switch-exhaustiveness-check": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/triple-slash-reference": severity: 3 tags: - Recommended - BestPractices - TypeScript "@typescript-eslint/typedef": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/unbound-method": severity: 2 tags: - ErrorProne - TypeScript "@typescript-eslint/unified-signatures": severity: 3 tags: - BestPractices - TypeScript "@typescript-eslint/use-unknown-in-catch-callback-variable": severity: 3 tags: - BestPractices - TypeScript "accessor-pairs": severity: 3 tags: - BestPractices - JavaScript - TypeScript "array-callback-return": severity: 2 tags: - ErrorProne - JavaScript - TypeScript "arrow-body-style": severity: 3 tags: - BestPractices - JavaScript - TypeScript "block-scoped-var": severity: 3 tags: - BestPractices - JavaScript - TypeScript "camelcase": severity: 3 tags: - BestPractices - JavaScript - TypeScript "capitalized-comments": severity: 3 tags: - BestPractices - JavaScript - TypeScript "class-methods-use-this": severity: 3 tags: - BestPractices - JavaScript "complexity": severity: 3 tags: - BestPractices - JavaScript - TypeScript "consistent-return": severity: 3 tags: - BestPractices - JavaScript "consistent-this": severity: 3 tags: - BestPractices - JavaScript - TypeScript "constructor-super": severity: 2 tags: - Recommended - ErrorProne - JavaScript "curly": severity: 3 tags: - BestPractices - JavaScript - TypeScript "default-case": severity: 3 tags: - BestPractices - JavaScript - TypeScript "default-case-last": severity: 3 tags: - BestPractices - JavaScript - TypeScript "default-param-last": severity: 3 tags: - BestPractices - JavaScript "dot-notation": severity: 3 tags: - BestPractices - JavaScript "eqeqeq": severity: 3 tags: - BestPractices - JavaScript - TypeScript "for-direction": severity: 2 tags: - Recommended - ErrorProne - JavaScript - TypeScript "func-name-matching": severity: 3 tags: - BestPractices - JavaScript - TypeScript "func-names": severity: 3 tags: - BestPractices - JavaScript - TypeScript "func-style": severity: 3 tags: - BestPractices - JavaScript - TypeScript "getter-return": severity: 2 tags: - Recommended - ErrorProne - JavaScript "grouped-accessor-pairs": severity: 3 tags: - BestPractices - JavaScript - TypeScript "guard-for-in": severity: 3 tags: - BestPractices - JavaScript - TypeScript "id-denylist": severity: 3 tags: - BestPractices - JavaScript - TypeScript "id-length": severity: 3 tags: - BestPractices - JavaScript - TypeScript "id-match": severity: 3 tags: - BestPractices - JavaScript - TypeScript "init-declarations": severity: 3 tags: - BestPractices - JavaScript "line-comment-position": severity: 4 tags: - CodeStyle - JavaScript - TypeScript "logical-assignment-operators": severity: 3 tags: - BestPractices - JavaScript - TypeScript "max-classes-per-file": severity: 3 tags: - BestPractices - JavaScript - TypeScript "max-depth": severity: 3 tags: - BestPractices - JavaScript - TypeScript "max-lines": severity: 3 tags: - BestPractices - JavaScript - TypeScript "max-lines-per-function": severity: 3 tags: - BestPractices - JavaScript - TypeScript "max-nested-callbacks": severity: 3 tags: - BestPractices - JavaScript - TypeScript "max-params": severity: 3 tags: - BestPractices - JavaScript "max-statements": severity: 3 tags: - BestPractices - JavaScript - TypeScript "multiline-comment-style": severity: 3 tags: - BestPractices - JavaScript - TypeScript "new-cap": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-alert": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-array-constructor": severity: 3 tags: - BestPractices - JavaScript "no-async-promise-executor": severity: 2 tags: - Recommended - ErrorProne - JavaScript - TypeScript "no-await-in-loop": severity: 2 tags: - ErrorProne - JavaScript - TypeScript "no-bitwise": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-caller": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-case-declarations": severity: 3 tags: - Recommended - BestPractices - JavaScript - TypeScript "no-class-assign": severity: 2 tags: - Recommended - ErrorProne - JavaScript "no-compare-neg-zero": severity: 2 tags: - Recommended - ErrorProne - JavaScript - TypeScript "no-cond-assign": severity: 2 tags: - Recommended - ErrorProne - JavaScript - TypeScript "no-console": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-const-assign": severity: 2 tags: - Recommended - ErrorProne - JavaScript "no-constant-binary-expression": severity: 2 tags: - ErrorProne - JavaScript - TypeScript "no-constant-condition": severity: 2 tags: - Recommended - ErrorProne - JavaScript - TypeScript "no-constructor-return": severity: 2 tags: - ErrorProne - JavaScript - TypeScript "no-continue": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-control-regex": severity: 2 tags: - Recommended - ErrorProne - JavaScript - TypeScript "no-debugger": severity: 2 tags: - Recommended - ErrorProne - JavaScript - TypeScript "no-delete-var": severity: 3 tags: - Recommended - BestPractices - JavaScript - TypeScript "no-div-regex": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-dupe-args": severity: 2 tags: - Recommended - ErrorProne - JavaScript "no-dupe-class-members": severity: 2 tags: - Recommended - ErrorProne - JavaScript "no-dupe-else-if": severity: 2 tags: - Recommended - ErrorProne - JavaScript - TypeScript "no-dupe-keys": severity: 2 tags: - Recommended - ErrorProne - JavaScript "no-duplicate-case": severity: 2 tags: - Recommended - ErrorProne - JavaScript - TypeScript "no-duplicate-imports": severity: 2 tags: - ErrorProne - JavaScript - TypeScript "no-else-return": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-empty": severity: 3 tags: - Recommended - BestPractices - JavaScript - TypeScript "no-empty-character-class": severity: 2 tags: - Recommended - ErrorProne - JavaScript - TypeScript "no-empty-function": severity: 3 tags: - BestPractices - JavaScript "no-empty-pattern": severity: 2 tags: - Recommended - ErrorProne - JavaScript - TypeScript "no-empty-static-block": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-eq-null": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-eval": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-ex-assign": severity: 2 tags: - Recommended - ErrorProne - JavaScript - TypeScript "no-extend-native": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-extra-bind": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-extra-boolean-cast": severity: 3 tags: - Recommended - BestPractices - JavaScript - TypeScript "no-extra-label": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-fallthrough": severity: 2 tags: - Recommended - ErrorProne - JavaScript - TypeScript "no-func-assign": severity: 2 tags: - Recommended - ErrorProne - JavaScript "no-global-assign": severity: 3 tags: - Recommended - BestPractices - JavaScript - TypeScript "no-implicit-coercion": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-implicit-globals": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-implied-eval": severity: 3 tags: - BestPractices - JavaScript "no-import-assign": severity: 2 tags: - Recommended - ErrorProne - JavaScript "no-inline-comments": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-inner-declarations": severity: 2 tags: - Recommended - ErrorProne - JavaScript - TypeScript "no-invalid-regexp": severity: 2 tags: - Recommended - ErrorProne - JavaScript - TypeScript "no-invalid-this": severity: 3 tags: - BestPractices - JavaScript "no-irregular-whitespace": severity: 2 tags: - Recommended - ErrorProne - JavaScript - TypeScript "no-iterator": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-label-var": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-labels": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-lone-blocks": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-lonely-if": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-loop-func": severity: 3 tags: - BestPractices - JavaScript "no-loss-of-precision": severity: 2 tags: - Recommended - ErrorProne - JavaScript - TypeScript "no-magic-numbers": severity: 3 tags: - BestPractices - JavaScript "no-misleading-character-class": severity: 2 tags: - Recommended - ErrorProne - JavaScript - TypeScript "no-multi-assign": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-multi-str": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-negated-condition": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-nested-ternary": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-new": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-new-func": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-new-native-nonconstructor": severity: 2 tags: - ErrorProne - JavaScript "no-new-symbol": severity: 2 tags: - Recommended - ErrorProne - JavaScript "no-new-wrappers": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-nonoctal-decimal-escape": severity: 3 tags: - Recommended - BestPractices - JavaScript - TypeScript "no-obj-calls": severity: 2 tags: - Recommended - ErrorProne - JavaScript "no-object-constructor": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-octal": severity: 2 tags: - Recommended - ErrorProne - JavaScript - TypeScript "no-octal-escape": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-param-reassign": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-plusplus": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-promise-executor-return": severity: 2 tags: - ErrorProne - JavaScript - TypeScript "no-proto": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-prototype-builtins": severity: 2 tags: - Recommended - ErrorProne - JavaScript - TypeScript "no-redeclare": severity: 3 tags: - Recommended - BestPractices - JavaScript "no-regex-spaces": severity: 3 tags: - Recommended - BestPractices - JavaScript - TypeScript "no-restricted-exports": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-restricted-globals": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-restricted-imports": severity: 3 tags: - BestPractices - JavaScript "no-restricted-properties": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-restricted-syntax": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-return-assign": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-script-url": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-self-assign": severity: 2 tags: - Recommended - ErrorProne - JavaScript - TypeScript "no-self-compare": severity: 2 tags: - ErrorProne - JavaScript - TypeScript "no-sequences": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-setter-return": severity: 2 tags: - Recommended - ErrorProne - JavaScript "no-shadow": severity: 3 tags: - BestPractices - JavaScript "no-shadow-restricted-names": severity: 3 tags: - Recommended - BestPractices - JavaScript - TypeScript "no-sparse-arrays": severity: 2 tags: - Recommended - ErrorProne - JavaScript - TypeScript "no-template-curly-in-string": severity: 2 tags: - ErrorProne - JavaScript - TypeScript "no-ternary": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-this-before-super": severity: 2 tags: - Recommended - ErrorProne - JavaScript "no-throw-literal": severity: 3 tags: - BestPractices - JavaScript "no-undef": severity: 2 tags: - Recommended - ErrorProne - JavaScript "no-undef-init": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-undefined": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-underscore-dangle": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-unexpected-multiline": severity: 2 tags: - Recommended - ErrorProne - JavaScript - TypeScript "no-unmodified-loop-condition": severity: 2 tags: - ErrorProne - JavaScript - TypeScript "no-unneeded-ternary": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-unreachable": severity: 2 tags: - Recommended - ErrorProne - JavaScript "no-unreachable-loop": severity: 2 tags: - ErrorProne - JavaScript - TypeScript "no-unsafe-finally": severity: 2 tags: - Recommended - ErrorProne - JavaScript - TypeScript "no-unsafe-negation": severity: 2 tags: - Recommended - ErrorProne - JavaScript "no-unsafe-optional-chaining": severity: 2 tags: - Recommended - ErrorProne - JavaScript - TypeScript "no-unused-expressions": severity: 3 tags: - BestPractices - JavaScript "no-unused-labels": severity: 3 tags: - Recommended - BestPractices - JavaScript - TypeScript "no-unused-private-class-members": severity: 2 tags: - ErrorProne - JavaScript - TypeScript "no-unused-vars": severity: 2 tags: - Recommended - ErrorProne - JavaScript "no-use-before-define": severity: 2 tags: - ErrorProne - JavaScript "no-useless-backreference": severity: 2 tags: - Recommended - ErrorProne - JavaScript - TypeScript "no-useless-call": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-useless-catch": severity: 3 tags: - Recommended - BestPractices - JavaScript - TypeScript "no-useless-computed-key": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-useless-concat": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-useless-constructor": severity: 3 tags: - BestPractices - JavaScript "no-useless-escape": severity: 3 tags: - Recommended - BestPractices - JavaScript - TypeScript "no-useless-rename": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-useless-return": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-var": severity: 3 tags: - Recommended - BestPractices - JavaScript - TypeScript "no-void": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-warning-comments": severity: 3 tags: - BestPractices - JavaScript - TypeScript "no-with": severity: 3 tags: - Recommended - BestPractices - JavaScript "object-shorthand": severity: 3 tags: - BestPractices - JavaScript - TypeScript "one-var": severity: 3 tags: - BestPractices - JavaScript - TypeScript "operator-assignment": severity: 3 tags: - BestPractices - JavaScript - TypeScript "prefer-arrow-callback": severity: 3 tags: - BestPractices - JavaScript - TypeScript "prefer-const": severity: 3 tags: - Recommended - BestPractices - JavaScript - TypeScript "prefer-destructuring": severity: 3 tags: - BestPractices - JavaScript "prefer-exponentiation-operator": severity: 3 tags: - BestPractices - JavaScript - TypeScript "prefer-named-capture-group": severity: 3 tags: - BestPractices - JavaScript - TypeScript "prefer-numeric-literals": severity: 3 tags: - BestPractices - JavaScript - TypeScript "prefer-object-has-own": severity: 3 tags: - BestPractices - JavaScript - TypeScript "prefer-object-spread": severity: 3 tags: - BestPractices - JavaScript - TypeScript "prefer-promise-reject-errors": severity: 3 tags: - BestPractices - JavaScript "prefer-regex-literals": severity: 3 tags: - BestPractices - JavaScript - TypeScript "prefer-rest-params": severity: 3 tags: - Recommended - BestPractices - JavaScript - TypeScript "prefer-spread": severity: 3 tags: - Recommended - BestPractices - JavaScript - TypeScript "prefer-template": severity: 3 tags: - BestPractices - JavaScript - TypeScript "radix": severity: 3 tags: - BestPractices - JavaScript - TypeScript "require-atomic-updates": severity: 2 tags: - ErrorProne - JavaScript - TypeScript "require-await": severity: 3 tags: - BestPractices - JavaScript "require-unicode-regexp": severity: 3 tags: - BestPractices - JavaScript - TypeScript "require-yield": severity: 3 tags: - Recommended - BestPractices - JavaScript - TypeScript "sort-imports": severity: 3 tags: - BestPractices - JavaScript - TypeScript "sort-keys": severity: 3 tags: - BestPractices - JavaScript - TypeScript "sort-vars": severity: 3 tags: - BestPractices - JavaScript - TypeScript "strict": severity: 3 tags: - BestPractices - JavaScript - TypeScript "symbol-description": severity: 3 tags: - BestPractices - JavaScript - TypeScript "unicode-bom": severity: 4 tags: - CodeStyle - JavaScript - TypeScript "use-isnan": severity: 2 tags: - Recommended - ErrorProne - JavaScript - TypeScript "valid-typeof": severity: 2 tags: - Recommended - ErrorProne - JavaScript - TypeScript "vars-on-top": severity: 3 tags: - BestPractices - JavaScript - TypeScript "yoda": severity: 3 tags: - BestPractices - JavaScript - TypeScript # ====================================================================== # RETIRE-JS ENGINE RULE OVERRIDES # ====================================================================== retire-js: "LibraryWithKnownCriticalSeverityVulnerability": severity: 1 tags: - Recommended - Security - JavaScript "LibraryWithKnownHighSeverityVulnerability": severity: 2 tags: - Recommended - Security - JavaScript "LibraryWithKnownMediumSeverityVulnerability": severity: 3 tags: - Recommended - Security - JavaScript "LibraryWithKnownLowSeverityVulnerability": severity: 4 tags: - Recommended - Security - JavaScript # ====================================================================== # REGEX ENGINE RULE OVERRIDES # ====================================================================== regex: "NoTrailingWhitespace": severity: 5 tags: - Recommended - CodeStyle - Apex "AvoidTermsWithImplicitBias": severity: 5 tags: - Recommended - BestPractices "AvoidOldSalesforceApiVersions": severity: 2 tags: - Recommended - Security - XML "AvoidGetHeapSizeInLoop": severity: 2 tags: - Recommended - Performance - Apex "MinVersionForAbstractVirtualClassesWithPrivateMethod": severity: 2 tags: - Recommended - BestPractices - Apex # ====================================================================== # CPD ENGINE RULE OVERRIDES # ====================================================================== cpd: "DetectCopyPasteForApex": severity: 5 tags: - Recommended - Design - Apex "DetectCopyPasteForHtml": severity: 5 tags: - Design - Html "DetectCopyPasteForJavascript": severity: 5 tags: - Recommended - Design - Javascript "DetectCopyPasteForTypescript": severity: 5 tags: - Recommended - Design - Typescript "DetectCopyPasteForVisualforce": severity: 5 tags: - Recommended - Design - Visualforce "DetectCopyPasteForXml": severity: 5 tags: - Design - Xml # ====================================================================== # PMD ENGINE RULE OVERRIDES # ====================================================================== pmd: "ApexAssertionsShouldIncludeMessage": severity: 3 tags: - BestPractices - Apex "ApexBadCrypto": severity: 2 tags: - Recommended - Security - Apex "ApexCRUDViolation": severity: 2 tags: - Recommended - Security - Apex "ApexCSRF": severity: 1 tags: - Recommended - Security - Apex "ApexDangerousMethods": severity: 3 tags: - Recommended - Security - Apex "ApexDoc": severity: 4 tags: - Recommended - Documentation - Apex "ApexInsecureEndpoint": severity: 2 tags: - Recommended - Security - Apex "ApexOpenRedirect": severity: 2 tags: - Recommended - Security - Apex "ApexSharingViolations": severity: 3 tags: - Recommended - Security - Apex "ApexSOQLInjection": severity: 2 tags: - Recommended - Security - Apex "ApexSuggestUsingNamedCred": severity: 2 tags: - Recommended - Security - Apex "ApexUnitTestClassShouldHaveAsserts": severity: 3 tags: - Recommended - BestPractices - Apex "ApexUnitTestClassShouldHaveRunAs": severity: 4 tags: - Recommended - BestPractices - Apex "ApexUnitTestMethodShouldHaveIsTestAnnotation": severity: 2 tags: - Recommended - BestPractices - Apex "ApexUnitTestShouldNotUseSeeAllDataTrue": severity: 2 tags: - Recommended - BestPractices - Apex "ApexXSSFromEscapeFalse": severity: 2 tags: - Recommended - Security - Apex "ApexXSSFromURLParam": severity: 2 tags: - Recommended - Security - Apex "AssignmentInOperand": severity: 3 tags: - CodeStyle - JavaScript "AvoidApiSessionId": severity: 2 tags: - AppExchange - Security - XML "AvoidAuraWithLockerDisabled": severity: 1 tags: - AppExchange - Security - XML "AvoidChangeProtectionUnprotected": severity: 1 tags: - AppExchange - Security - Apex "AvoidConsoleStatements": severity: 3 tags: - Performance - JavaScript "AvoidCreateElementScriptLinkTag": severity: 2 tags: - AppExchange - Security - Visualforce "AvoidDebugStatements": severity: 4 tags: - Recommended - Performance - Apex "AvoidDeeplyNestedIfStmts": severity: 3 tags: - Recommended - Design - Apex "AvoidDirectAccessTriggerMap": severity: 3 tags: - Recommended - ErrorProne - Apex "AvoidDisableProtocolSecurityRemoteSiteSetting": severity: 3 tags: - AppExchange - Security - XML "AvoidGetInstanceWithTaint": severity: 3 tags: - AppExchange - Security - Apex "AvoidGlobalInstallUninstallHandlers": severity: 1 tags: - AppExchange - Security - Apex "AvoidGlobalModifier": severity: 3 tags: - Recommended - BestPractices - Apex "AvoidHardCodedCredentialsInAura": severity: 2 tags: - AppExchange - Security - HTML "AvoidHardcodedCredentialsInFieldDecls": severity: 3 tags: - AppExchange - Security - Apex "AvoidHardcodedCredentialsInHttpHeader": severity: 3 tags: - AppExchange - Security - Apex "AvoidHardcodedCredentialsInSetPassword": severity: 1 tags: - AppExchange - Security - Apex "AvoidHardcodedCredentialsInVarAssign": severity: 3 tags: - AppExchange - Security - Apex "AvoidHardcodedCredentialsInVarDecls": severity: 3 tags: - AppExchange - Security - Apex "AvoidHardcodedSecretsInVFAttrs": severity: 2 tags: - AppExchange - Security - Visualforce "AvoidHardcodingId": severity: 3 tags: - Recommended - ErrorProne - Apex "AvoidInlineStyles": severity: 4 tags: - BestPractices - HTML "AvoidInsecureHttpRemoteSiteSetting": severity: 3 tags: - AppExchange - Security - XML "AvoidInvalidCrudContentDistribution": severity: 3 tags: - AppExchange - Security - Apex "AvoidJavaScriptCustomObject": severity: 2 tags: - AppExchange - Security - XML "AvoidJavaScriptHomePageComponent": severity: 2 tags: - AppExchange - Security - XML "AvoidJavaScriptInUrls": severity: 1 tags: - AppExchange - Security - XML "AvoidJavaScriptWebLink": severity: 2 tags: - AppExchange - Security - XML "AvoidLmcIsExposedTrue": severity: 2 tags: - AppExchange - Security - XML "AvoidLogicInTrigger": severity: 3 tags: - Recommended - BestPractices - Apex "AvoidLwcBubblesComposedTrue": severity: 3 tags: - AppExchange - Security - JavaScript "AvoidNonExistentAnnotations": severity: 4 tags: - Recommended - ErrorProne - Apex "AvoidNonRestrictiveQueries": severity: 4 tags: - Recommended - Performance - Apex "AvoidSControls": severity: 1 tags: - AppExchange - Security - XML "AvoidSecurityEnforcedOldApiVersion": severity: 3 tags: - AppExchange - Security - Apex "AvoidStatefulDatabaseResult": severity: 3 tags: - Recommended - ErrorProne - Apex "AvoidTrailingComma": severity: 2 tags: - ErrorProne - JavaScript "AvoidUnauthorizedApiSessionIdInApex": severity: 3 tags: - AppExchange - Security - Apex "AvoidUnauthorizedApiSessionIdInVisualforce": severity: 3 tags: - AppExchange - Security - Visualforce "AvoidUnauthorizedGetSessionIdInApex": severity: 3 tags: - AppExchange - Security - Apex "AvoidUnauthorizedGetSessionIdInVisualforce": severity: 2 tags: - AppExchange - Security - Visualforce "AvoidUnescapedHtmlInAura": severity: 2 tags: - AppExchange - Security - HTML "AvoidUnsafePasswordManagementUse": severity: 1 tags: - AppExchange - Security - Apex "AvoidWithStatement": severity: 2 tags: - BestPractices - JavaScript "ClassNamingConventions": severity: 3 tags: - Recommended - CodeStyle - Apex "CognitiveComplexity": severity: 3 tags: - Recommended - Design - Apex "ConsistentReturn": severity: 3 tags: - BestPractices - JavaScript "CyclomaticComplexity": severity: 3 tags: - Recommended - Design - Apex "DebugsShouldUseLoggingLevel": severity: 4 tags: - Recommended - BestPractices - Apex "EagerlyLoadedDescribeSObjectResult": severity: 2 tags: - Recommended - Performance - Apex "EmptyCatchBlock": severity: 2 tags: - Recommended - ErrorProne - Apex "EmptyIfStmt": severity: 3 tags: - Recommended - ErrorProne - Apex "EmptyStatementBlock": severity: 3 tags: - Recommended - ErrorProne - Apex "EmptyTryOrFinallyBlock": severity: 3 tags: - Recommended - ErrorProne - Apex "EmptyWhileStmt": severity: 3 tags: - Recommended - ErrorProne - Apex "EqualComparison": severity: 3 tags: - ErrorProne - JavaScript "ExcessiveClassLength": severity: 3 tags: - Recommended - Design - Apex "ExcessiveParameterList": severity: 3 tags: - Recommended - Design - Apex "ExcessivePublicCount": severity: 3 tags: - Recommended - Design - Apex "FieldDeclarationsShouldBeAtStart": severity: 3 tags: - Recommended - CodeStyle - Apex "FieldNamingConventions": severity: 3 tags: - Recommended - CodeStyle - Apex "ForLoopsMustUseBraces": severity: 3 tags: - Recommended - CodeStyle - Apex "ForLoopsMustUseBraces-javascript": severity: 3 tags: - CodeStyle - JavaScript "FormalParameterNamingConventions": severity: 3 tags: - Recommended - CodeStyle - Apex "GlobalVariable": severity: 2 tags: - BestPractices - JavaScript "IfElseStmtsMustUseBraces": severity: 3 tags: - Recommended - CodeStyle - Apex "IfElseStmtsMustUseBraces-javascript": severity: 3 tags: - CodeStyle - JavaScript "IfStmtsMustUseBraces": severity: 3 tags: - Recommended - CodeStyle - Apex "IfStmtsMustUseBraces-javascript": severity: 3 tags: - CodeStyle - JavaScript "InaccessibleAuraEnabledGetter": severity: 3 tags: - Recommended - ErrorProne - Apex "InaccurateNumericLiteral": severity: 3 tags: - ErrorProne - JavaScript "LimitConnectedAppScope": severity: 3 tags: - AppExchange - Security - XML "LoadCSSApexStylesheet": severity: 2 tags: - AppExchange - Security - Visualforce "LoadCSSLinkHref": severity: 2 tags: - AppExchange - Security - Visualforce "LoadJavaScriptHtmlScript": severity: 2 tags: - AppExchange - Security - Visualforce "LoadJavaScriptIncludeScript": severity: 2 tags: - AppExchange - Security - Visualforce "LocalVariableNamingConventions": severity: 3 tags: - Recommended - CodeStyle - Apex "MethodNamingConventions": severity: 3 tags: - Recommended - CodeStyle - Apex "MethodWithSameNameAsEnclosingClass": severity: 3 tags: - Recommended - ErrorProne - Apex "MissingEncoding": severity: 3 tags: - BestPractices - XML "MistypedCDATASection": severity: 3 tags: - ErrorProne - XML "NcssConstructorCount": severity: 4 tags: - Recommended - Design - Apex "NcssMethodCount": severity: 4 tags: - Recommended - Design - Apex "NcssTypeCount": severity: 4 tags: - Design - Apex "NoElseReturn": severity: 3 tags: - CodeStyle - JavaScript "OneDeclarationPerLine": severity: 3 tags: - Recommended - CodeStyle - Apex "OperationWithHighCostInLoop": severity: 3 tags: - Recommended - Performance - Apex "OperationWithLimitsInLoop": severity: 3 tags: - Recommended - Performance - Apex "OverrideBothEqualsAndHashcode": severity: 2 tags: - Recommended - ErrorProne - Apex "PropertyNamingConventions": severity: 3 tags: - Recommended - CodeStyle - Apex "ProtectSensitiveData": severity: 3 tags: - AppExchange - Security - XML "QueueableWithoutFinalizer": severity: 4 tags: - Recommended - BestPractices - Apex "ScopeForInVariable": severity: 2 tags: - BestPractices - JavaScript "StdCyclomaticComplexity": severity: 3 tags: - Design - Apex "TestMethodsMustBeInTestClasses": severity: 3 tags: - Recommended - ErrorProne - Apex "TooManyFields": severity: 3 tags: - Recommended - Design - Apex "UnnecessaryBlock": severity: 3 tags: - CodeStyle - JavaScript "UnnecessaryParentheses": severity: 4 tags: - CodeStyle - JavaScript "UnnecessaryTypeAttribute": severity: 3 tags: - BestPractices - HTML "UnreachableCode": severity: 2 tags: - CodeStyle - JavaScript "UnusedLocalVariable": severity: 3 tags: - Recommended - BestPractices - Apex "UnusedMethod": severity: 3 tags: - Recommended - Design - Apex "UseAltAttributeForImages": severity: 3 tags: - BestPractices - HTML "UseBaseWithParseInt": severity: 2 tags: - BestPractices - JavaScript "UseHttpsCallbackUrlConnectedApp": severity: 3 tags: - AppExchange - Security - XML "VfCsrf": severity: 2 tags: - Recommended - Security - Visualforce "VfHtmlStyleTagXss": severity: 2 tags: - Recommended - Security - Visualforce "VfUnescapeEl": severity: 2 tags: - Recommended - Security - Visualforce "WhileLoopsMustUseBraces": severity: 3 tags: - Recommended - CodeStyle - Apex "WhileLoopsMustUseBraces-javascript": severity: 3 tags: - CodeStyle - JavaScript # ====================================================================== # SFGE ENGINE RULE OVERRIDES # ====================================================================== sfge: "ApexFlsViolation": severity: 2 tags: - DevPreview - Security - Apex "ApexNullPointerException": severity: 3 tags: - DevPreview - ErrorProne - Apex "AvoidDatabaseOperationInLoop": severity: 2 tags: - DevPreview - Performance - Apex "AvoidMultipleMassSchemaLookups": severity: 2 tags: - DevPreview - Performance - Apex "DatabaseOperationsMustUseWithSharing": severity: 2 tags: - DevPreview - Security - Apex "MissingNullCheckOnSoqlVariable": severity: 3 tags: - DevPreview - Performance - Apex "UnimplementedType": severity: 4 tags: - DevPreview - Performance - Apex # Engine specific custom configuration settings of the format engines.{engine_name}.{property_name} = {value} where: # {engine_name} is the name of the engine containing the setting that you want to override. # {property_name} is the name of a property that you would like to override. # Each engine may have its own set of properties available to help customize that particular engine's behavior. engines: # ====================================================================== # FLOW SCANNER ENGINE CONFIGURATION # To learn more about this configuration, visit: # https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/engine-flow.html#flow-scanner-configuration-reference # ====================================================================== flow: # Whether to turn off the 'flow' engine so that it is not included when running Code Analyzer commands. disable_engine: false # Indicates the specific Python command to use for the 'Flow Scanner' engine. # May be provided as the name of a command that exists on the path, or an absolute file path location. # If unspecified, or specified as null, then an attempt will be made to automatically discover a Python command from your environment. python_command: null # ====================================================================== # ESLINT ENGINE CONFIGURATION # To learn more about this configuration, visit: # https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/engine-eslint.html#eslint-configuration-reference # ====================================================================== eslint: # Whether to turn off the 'eslint' engine so that it is not included when running Code Analyzer commands. disable_engine: false # Your project's main ESLint configuration file. May be an absolute path or a path relative to the config_root. # If null and auto_discover_eslint_config is true, then Code Analyzer will attempt to discover/apply it automatically. # Currently only legacy ESLInt config files are supported. # See https://eslint.org/docs/v8.x/use/configure/configuration-files to learn more. eslint_config_file: null # Your project's ".eslintignore" file. May be an absolute path or a path relative to the config_root. # If null and auto_discover_eslint_config is true, then Code Analyzer will attempt to discover/apply it automatically. # See https://eslint.org/docs/v8.x/use/configure/ignore#the-eslintignore-file to learn more. eslint_ignore_file: null # Whether to have Code Analyzer automatically discover/apply any ESLint configuration and ignore files from your workspace. auto_discover_eslint_config: false # Whether to turn off the default base configuration that supplies the standard ESLint rules for JavaScript files. disable_javascript_base_config: false # Whether to turn off the default base configuration that supplies the LWC rules for JavaScript files. disable_lwc_base_config: false # Whether to turn off the default base configuration that supplies the standard rules for TypeScript files. disable_typescript_base_config: false # Extensions of the files in your workspace that will be used to discover rules. # To associate file extensions to the standard ESLint JavaScript rules, LWC rules, or custom JavaScript-based # rules, add them under the 'javascript' language. To associate file extensions to the standard TypeScript # rules or custom TypeScript-based rules, add them under the 'typescript' language. To allow for the # discovery of custom rules that are associated with any other language, then add the associated file # extensions under the 'other' language. file_extensions: javascript: - .js - .cjs - .mjs typescript: - .ts other: [] # ====================================================================== # RETIRE-JS ENGINE CONFIGURATION # To learn more about this configuration, visit: # https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/engine-retire-js.html#retirejs-configuration-reference # ====================================================================== retire-js: # Whether to turn off the 'retire-js' engine so that it is not included when running Code Analyzer commands. disable_engine: false # ====================================================================== # REGEX ENGINE CONFIGURATION # To learn more about this configuration, visit: # https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/engine-regex.html#regex-configuration-reference # ====================================================================== regex: # Whether to turn off the 'regex' engine so that it is not included when running Code Analyzer commands. disable_engine: false # Custom rules to be added to the 'regex' engine of the format custom_rules.{rule_name}.{rule_property_name} = {value} where: # {rule_name} is the name you would like to give to your custom rule # {rule_property_name} is the name of one of the rule properties. You may specify the following rule properties: # 'regex' - The regular expression that triggers a violation when matched against the contents of a file. # 'file_extensions' - The extensions of the files that you would like to test the regular expression against. # 'description' - A description of the rule's purpose # 'violation_message' - [Optional] The message emitted when a rule violation occurs. # This message is intended to help the user understand the violation. # Default: 'A match of the regular expression {regex} was found for rule {rule_name}: {description}' # 'severity' - [Optional] The severity level to apply to this rule by default. # Possible values: 1 or 'Critical', 2 or 'High', 3 or 'Moderate', 4 or 'Low', 5 or 'Info' # Default: 3 # 'tags' - [Optional] The string array of tag values to apply to this rule by default. # Default: ['Recommended'] # ---- [Example usage]: --------------------- # engines: # regex: # custom_rules: # "NoTodoComments": # regex: /\/\/[ \t]*TODO/gi # file_extensions: [".apex", ".cls", ".trigger"] # description: "Prevents TODO comments from being in apex code." # violation_message: "A comment with a TODO statement was found. Please remove TODO statements from your apex code." # severity: "Info" # tags: ["TechDebt"] # ------------------------------------------- custom_rules: # Object naming conventions "ObjectNamingConvention": regex: /\s*(?!([A-Z][a-zA-Z0-9]*__c))<\/fullName>/g file_extensions: [".xml"] description: "Object API names must follow naming conventions." violation_message: "Custom object API names must be in PascalCase with __c suffix." severity: "High" tags: ["NamingConvention"] # Field PascalCase validation "FieldPascalCaseValidation": regex: /]*>[\s\S]*?(?!([A-Z][a-zA-Z0-9]*)(__c)?)<\/fullName>/g file_extensions: [".xml"] description: "Field API names must be in PascalCase." violation_message: "Field API names must follow PascalCase convention." severity: "High" tags: ["NamingConvention"] # Boolean field naming (must start with Is or IsCan) "BooleanFieldNaming": regex: /]*>[\s\S]*?Checkbox<\/type>[\s\S]*?(?!(Is|IsCan)[A-Za-z0-9]*(__c)?)<\/fullName>/g file_extensions: [".xml"] description: "Boolean fields must start with 'Is' or 'IsCan'." violation_message: "Boolean field API names must start with 'Is' or 'IsCan'." severity: "High" tags: ["NamingConvention"] # Lookup field naming (must end with Ref) "LookupFieldNaming": regex: /]*>[\s\S]*?Lookup<\/type>[\s\S]*?(?!.*Ref(__c)?)[A-Za-z0-9_]*<\/fullName>/g file_extensions: [".xml"] description: "Lookup fields must end with 'Ref'." violation_message: "Lookup field API names must end with 'Ref__c'." severity: "High" tags: ["NamingConvention"] # Master-Detail field naming (must end with Ref) "MasterDetailFieldNaming": regex: /]*>[\s\S]*?MasterDetail<\/type>[\s\S]*?(?!.*Ref(__c)?)[A-Za-z0-9_]*<\/fullName>/g file_extensions: [".xml"] description: "Master-Detail fields must end with 'Ref'." violation_message: "Master-Detail field API names must end with 'Ref__c'." severity: "High" tags: ["NamingConvention"] # Formula field naming (must end with Auto) "FormulaFieldNaming": regex: /]*>[\s\S]*?Formula<\/type>[\s\S]*?(?!.*Auto(__c)?)[A-Za-z0-9_]*<\/fullName>/g file_extensions: [".xml"] description: "Formula fields must end with 'Auto'." violation_message: "Formula field API names must end with 'Auto__c'." severity: "High" tags: ["NamingConvention"] # Rollup Summary field naming (must end with Auto) "RollupSummaryFieldNaming": regex: /]*>[\s\S]*?Summary<\/type>[\s\S]*?(?!.*Auto(__c)?)[A-Za-z0-9_]*<\/fullName>/g file_extensions: [".xml"] description: "Rollup Summary fields must end with 'Auto'." violation_message: "Rollup Summary field API names must end with 'Auto__c'." severity: "Moderate" tags: ["NamingConvention"] # Picklist field naming (must end with Pick) "PicklistFieldNaming": regex: /]*>[\s\S]*?Picklist<\/type>[\s\S]*?(?![A-Za-z0-9_]*Pick__c)[A-Za-z0-9_]+__c<\/fullName>/g file_extensions: [".xml"] description: "Picklist fields must end with 'Pick'." violation_message: "Picklist field API names must end with 'Pick__c'." severity: "High" tags: ["NamingConvention"] # Multipicklist field naming (must end with Pick) "MultipicklistFieldNaming": regex: /]*>[\s\S]*?Picklist<\/type>[\s\S]*?(?![A-Za-z0-9_]*Pick__c)[A-Za-z0-9_]+__c<\/fullName>/g file_extensions: [".xml"] description: "Multipicklist fields must end with 'Pick'." violation_message: "Multipicklist field API names must end with 'Pick__c'." severity: "High" tags: ["NamingConvention"] # Field filled by automation (must end with Trig) "AutomationFieldNaming": regex: /]*>[\s\S]*?(?=.*\b(filled by apex|trigger|automation)\b)[\s\S]*?<\/description>[\s\S]*?(?!.*Trig(__c)?)[A-Za-z0-9_]*<\/fullName>/gi file_extensions: [".xml"] description: "Fields filled by automation must end with 'Trig'." violation_message: "Fields filled by automation must end with 'Trig__c'." severity: "Moderate" tags: ["NamingConvention"] # Technical fields (must start with TECH_) "TechnicalFieldNaming": regex: /]*>[\s\S]*?(?!TECH_)[A-Za-z0-9_]*<\/fullName>[\s\S]*?(?=.*\b(technical|not displayed|shouldn't display)\b)[\s\S]*?<\/description>/gi file_extensions: [".xml"] description: "Technical fields must start with 'TECH_'." violation_message: "Technical field API names must start with 'TECH_'." severity: "Moderate" tags: ["NamingConvention"] # Enforce description for custom fields "CustomFieldDescription": regex: /]*>(?![\s\S]*?[^<]+<\/description>)[\s\S]*?(?!\w+__\w+__c)[^<]*__c<\/fullName>[\s\S]*?<\/CustomField>/g file_extensions: [".xml"] description: "Custom fields must have a non-empty description." violation_message: "Custom field must have a non-empty description. Add a meaningful description to explain the field's purpose." severity: "High" tags: ["Documentation", "NamingConvention"] # ====================================================================== # CPD ENGINE CONFIGURATION # To learn more about this configuration, visit: # https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/engine-cpd.html#cpd-configuration-reference # ====================================================================== cpd: # Whether to turn off the 'cpd' engine so that it is not included when running Code Analyzer commands. disable_engine: true # Indicates the specific 'java' command associated with the JRE or JDK to use for the 'cpd' engine. # May be provided as the name of a command that exists on the path, or an absolute file path location. # If unspecified, or specified as null, then an attempt will be made to automatically discover a 'java' command from your environment. java_command: null # Last calculated by the config command as: "java" # Specifies the list of file extensions to associate to each rule language. # The rule(s) associated with a given language will run against all the files in your workspace containing one of # the specified file extensions. Each file extension can only be associated to one language. If a specific language # is not specified, then a set of default file extensions for that language will be used. file_extensions: apex: - .cls - .trigger html: - .html - .htm - .xhtml - .xht - .shtml - .cmp javascript: - .js - .cjs - .mjs typescript: - .ts visualforce: - .page - .component xml: - .xml # Specifies the minimum tokens threshold for each rule language. # The minimum tokens threshold is the number of tokens required to be in a duplicate block of code in order to be # reported as a violation. The concept of a token may be defined differently per language, but in general it is a # distinct basic element of source code. For example, this could be language specific keywords, identifiers, # operators, literals, and more. See https://docs.pmd-code.org/latest/pmd_userdocs_cpd.html to learn more. # If a value for a language is unspecified, then the default value of 100 will be used for that language. minimum_tokens: apex: 100 html: 100 javascript: 100 typescript: 100 visualforce: 100 xml: 100 # Indicates whether to ignore multiple copies of files of the same name and length. skip_duplicate_files: false # ====================================================================== # PMD ENGINE CONFIGURATION # To learn more about this configuration, visit: # https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/engine-pmd.html#pmd-configuration-reference # ====================================================================== pmd: # Whether to turn off the 'pmd' engine so that it is not included when running Code Analyzer commands. disable_engine: false # Indicates the specific 'java' command associated with the JRE or JDK to use for the 'pmd' engine. # May be provided as the name of a command that exists on the path, or an absolute file path location. # If unspecified, or specified as null, then an attempt will be made to automatically discover a 'java' command from your environment. java_command: null # Last calculated by the config command as: "java" # Specifies the list of file extensions to associate to each rule language. # The rule(s) associated with a given language will run against all the files in your workspace containing one of # the specified file extensions. Each file extension can only be associated to one language. If a specific language # is not specified, then a set of default file extensions for that language will be used. file_extensions: apex: - .cls - .trigger html: - .html - .htm - .xhtml - .xht - .shtml - .cmp javascript: - .js - .cjs - .mjs typescript: - .ts visualforce: - .page - .component xml: - .xml # List of jar files and/or folders to add the Java classpath when running PMD. # Each entry may be given as an absolute path or a relative path to 'config_root'. # This field is primarily used to supply custom Java based rule definitions to PMD. # See https://pmd.github.io/pmd/pmd_userdocs_extending_writing_java_rules.html java_classpath_entries: [] # List of xml ruleset files containing custom PMD rules to be made available for rule selection. # Each ruleset must be an xml file that is either: # - on disk (provided as an absolute path or a relative path to 'config_root') # - or a relative resource found on the Java classpath. # Not all custom rules can be fully defined within an xml ruleset file. For example, Java based rules may be defined in jar files. # In these cases, you will need to also add your additional files to the Java classpath using the 'java_classpath_entries' field. # See https://pmd.github.io/pmd/pmd_userdocs_making_rulesets.html to learn more about PMD rulesets. custom_rulesets: [] # ====================================================================== # SFGE ENGINE CONFIGURATION # This engine is in Developer Preview and is subject to change. # To learn more about this configuration, visit: # [PLACEHOLDER LINK] # ====================================================================== sfge: # Whether to turn off the 'sfge' engine so that it is not included when running Code Analyzer commands. disable_engine: false # Whether to prevent 'sfge' from throwing LimitReached violations for complex paths. # By default, Salesforce Graph Engine attempts to detect complex paths that might cause OutOfMemory errors, # and throws LimitReached violations for these paths to continue evaluating other paths safely. The allowed # complexity is dynamically calculated based on the max Java heap size available, but in some cases you may # desire to disable this check in addition to increasing java_max_heap_size. disable_limit_reached_violations: false # Indicates the specific 'java' command associated with the JRE or JDK to use for the 'sfge' engine. # May be provided as the name of a command that exists on the path, or an absolute file path location. # If unspecified, or specified as null, then an attempt will be made to automatically discover a 'java' command from your environment. java_command: null # Last calculated by the config command as: "java" # Specifies the maximum size (in bytes) of the Java heap. The specified value is appended to the '-Xmx' Java # command option. The value must be a multiple of 1024, and greater than 2MB. Append the letters 'k', 'K', 'kb', # or 'KB' to indicate kilobytes, 'm', 'M', 'mb', or 'MB' to indicate megabytes, and 'g', 'G', 'gb', or 'GB' to # indicate gigabytes. If unspecified, or specified as null, then the JVM will dynamically choose a default value # at runtime based on system configuration. java_max_heap_size: null # Specifies the number of Java threads available for parallel execution. Increasing the thread count allows for # Salesforce Graph Engine to evaluate more paths at the same time. java_thread_count: 4 # Specifies the maximum time (in milliseconds) a specific Java thread may execute before Salesforce Graph Engine # issues a Timeout violation. java_thread_timeout: 900000 # ====================================================================== # END OF CODE ANALYZER CONFIGURATION # ====================================================================== ``` ## 4.6 JIRA Integration ##### Project Setup 1. **Create JIRA project** with these issue types: - Epic - Story - Bug - Task 2. **Configure workflow states:** ``` Backlog → In Progress → In Review → Ready for Deploy → Done ``` 3. **Link to Bitbucket:** - Enable Development integration in JIRA project settings - Connect to your Bitbucket repository ##### Smart Commits Configuration Enable automatic JIRA transitions based on commit messages: ``` # Commit message format git commit -m "PROJ-123: Add validation rule to Account object - Added required field validation - Updated test classes - Ready for UAT testing" ``` ## 4.7 Notification Setup ### Microsoft Teams Integration 1. [**Create Teams webhook**](https://learn.microsoft.com/en-us/microsoftteams/platform/webhooks-and-connectors/how-to/add-incoming-webhook) in your project channel 2. **Add webhook URL** to Bitbucket environment variables 3. **Configure notification templates** in `config/` directory: ```json { "type":"message", "attachments":[ { "contentType":"application/vnd.microsoft.card.adaptive", "contentUrl":null, "content":{ "$schema":"http://adaptivecards.io/schemas/adaptive-card.json", "type":"AdaptiveCard", "version": "1.4", "body": [ { "type": "Container", "items": [ { "type": "TextBlock", "text": "$TITLE", "weight": "Bolder", "size": "Medium", "color": "Good" }, { "type": "ColumnSet", "columns": [ { "type": "Column", "width": "auto", "items": [ { "type": "Image", "url": "https://cdn-icons-png.flaticon.com/512/1907/1907742.png", "altText": "Pipeline Logo", "size": "Small" } ] }, { "type": "Column", "width": "stretch", "items": [ { "type": "TextBlock", "text": "Scratch Org Creation", "weight": "Bolder", "wrap": true }, { "type": "TextBlock", "spacing": "None", "text": "$STATUS on $BITBUCKET_BRANCH", "isSubtle": true, "wrap": true, "color": "Good" } ] } ] } ] }, { "type": "Container", "items": [ { "type": "TextBlock", "text": "The Login URL for the login command is ", "wrap": true }, { "type": "TextBlock", "text": "$SF_SCRATCH_AUTH", "wrap": true, "spacing": "Small", "fontType": "Monospace", "isSubtle": true, "color": "Dark", "weight": "Bolder" }, { "type": "TextBlock", "text": "Please login using the command in your terminal", "wrap": true }, { "type": "TextBlock", "text": "echo URL | sf org login sfdx-url --alias ALIAS --sfdx-url-stdin ", "wrap": true, "spacing": "Small", "spacing": "Small", "fontType": "Monospace", "isSubtle": true, "color": "Dark", "weight": "Bolder" }, { "type": "TextBlock", "text": "where URL is the URL above and ALIAS is your choice of alias to log in.", "wrap": true }, { "type": "TextBlock", "text": "If you prefer to use the VSCode, please select", "wrap": true, "weight": "Bolder" }, { "type": "TextBlock", "text": "'Authorize an Org using SessionId'", "wrap": true }, { "type": "TextBlock", "text": "and paste the following token.", "wrap": true }, { "type": "TextBlock", "text": "$SF_SCRATCH_TOKEN", "wrap": true, "spacing": "Small", "spacing": "Small", "fontType": "Monospace", "isSubtle": true, "color": "Dark", "weight": "Bolder" }, { "type": "FactSet", "facts": [ { "title": "Status:", "value": "Success" } ] } ] } ] } } ] } ```