salesforce-code-analyzer.yml

name: Salesforce Code Analyzer (Reusable)

on:
  workflow_call:
    secrets:
      github-token:
        description: 'GitHub token for PR comments and access'
        required: true
    inputs:
      workspace:
        description: 'Workspace path to analyze'
        required: false
        default: '.'
        type: string
      view:
        description: 'View type for output (detail, summary)'
        required: false
        default: 'detail'
        type: string
      output-file-html:
        description: 'HTML output file name'
        required: false
        default: 'sfca_results.html'
        type: string
      output-file-json:
        description: 'JSON output file name'
        required: false
        default: 'sfca_results.json'
        type: string
      results-artifact-name:
        description: 'Name for the results artifact'
        required: false
        default: 'salesforce-code-analyzer-results'
        type: string
      fail-on-sev1-violations:
        description: 'Fail workflow if severity 1 violations are found'
        required: false
        default: true
        type: boolean
      fail-on-sev2-violations:
        description: 'Fail workflow if severity 2 violations are found'
        required: false
        default: true
        type: boolean
      max-violations:
        description: 'Maximum number of violations allowed (0 = unlimited)'
        required: false
        default: 0
        type: number
      fail-on-changed-files-only:
        description: 'Only fail on violations in changed files'
        required: false
        default: false
        type: boolean
      node-version:
        description: 'Node.js version to use'
        required: false
        default: '20.9.0'
        type: string
      java-version:
        description: 'Java version to use'
        required: false
        default: '11'
        type: string
      python-version:
        description: 'Python version to use'
        required: false
        default: '3.10'
        type: string
    outputs:
      exit-code:
        description: 'Exit code from the code analyzer'
        value: ${{ jobs.analyze.outputs.exit-code }}
      num-violations:
        description: 'Total number of violations'
        value: ${{ jobs.analyze.outputs.num-violations }}
      num-sev1-violations:
        description: 'Number of severity 1 violations'
        value: ${{ jobs.analyze.outputs.num-sev1-violations }}
      num-sev2-violations:
        description: 'Number of severity 2 violations'
        value: ${{ jobs.analyze.outputs.num-sev2-violations }}

jobs:
  analyze:
    runs-on: ubuntu-latest
    outputs:
      exit-code: ${{ steps.run-code-analyzer.outputs.exit-code }}
      num-violations: ${{ steps.run-code-analyzer.outputs.num-violations }}
      num-sev1-violations: ${{ steps.run-code-analyzer.outputs.num-sev1-violations }}
      num-sev2-violations: ${{ steps.run-code-analyzer.outputs.num-sev2-violations }}
    permissions:
      pull-requests: write
      contents: read
      actions: read
    steps:
      - name: Check out files
        uses: actions/checkout@v5

      - name: Verify workspace
        run: |
          echo "Current directory: $PWD"
          echo "Workspace input: ${{ inputs.workspace }}"
          ls -la
          if [ -f "sfdx-project.json" ]; then
            echo "✅ Found sfdx-project.json"
            cat sfdx-project.json
          else
            echo "⚠️ No sfdx-project.json found"
          fi

      # PREREQUISITES
      - name: Setup Node.js
        uses: actions/setup-node@v5
        with:
          node-version: ${{ inputs.node-version }}

      - name: Setup Java
        uses: actions/setup-java@v5
        with:
          java-version: ${{ inputs.java-version }}
          distribution: "zulu"

      - name: Setup Python
        uses: actions/setup-python@v6
        with:
          python-version: ${{ inputs.python-version }}

      - name: Install Salesforce CLI
        run: npm install -g @salesforce/cli@latest

      - name: Install Salesforce Code Analyzer Plugin
        run: sf plugins install code-analyzer@latest

      - name: Run Salesforce Code Analyzer
        id: run-code-analyzer
        uses: forcedotcom/run-code-analyzer@v2
        with:
          run-arguments: --workspace ${{ inputs.workspace }} --view ${{ inputs.view }} --output-file ${{ inputs.output-file-html }} --output-file ${{ inputs.output-file-json }}
          results-artifact-name: ${{ inputs.results-artifact-name }}
          github-token: ${{ secrets.github-token }}

      # Quality gate on ALL files in the repository
      - name: Check Violations (All Files)
        if: ${{ !inputs.fail-on-changed-files-only }}
        run: |
          EXIT_CODE=${{ steps.run-code-analyzer.outputs.exit-code }}
          SEV1=${{ steps.run-code-analyzer.outputs.num-sev1-violations }}
          SEV2=${{ steps.run-code-analyzer.outputs.num-sev2-violations }}
          TOTAL=${{ steps.run-code-analyzer.outputs.num-violations }}
          MAX=${{ inputs.max-violations }}
          
          echo "Exit Code: $EXIT_CODE"
          echo "Severity 1 Violations: $SEV1"
          echo "Severity 2 Violations: $SEV2"
          echo "Total Violations: $TOTAL"
          echo "Max Allowed Violations: $MAX"
          
          SHOULD_FAIL=false
          
          if [ "$EXIT_CODE" -gt 0 ]; then
            echo "❌ Code analyzer exited with error code: $EXIT_CODE"
            SHOULD_FAIL=true
          fi
          
          if [ "${{ inputs.fail-on-sev1-violations }}" == "true" ] && [ "$SEV1" -gt 0 ]; then
            echo "❌ Found $SEV1 severity 1 violations"
            SHOULD_FAIL=true
          fi
          
          if [ "${{ inputs.fail-on-sev2-violations }}" == "true" ] && [ "$SEV2" -gt 0 ]; then
            echo "❌ Found $SEV2 severity 2 violations"
            SHOULD_FAIL=true
          fi
          
          if [ "$MAX" -gt 0 ] && [ "$TOTAL" -gt "$MAX" ]; then
            echo "❌ Total violations ($TOTAL) exceed maximum allowed ($MAX)"
            SHOULD_FAIL=true
          fi
          
          if [ "$SHOULD_FAIL" == "true" ]; then
            exit 1
          else
            echo "✅ Code quality checks passed"
          fi

      # Quality gate on CHANGED files only
      - name: Check Violations (Changed Files Only)
        if: ${{ inputs.fail-on-changed-files-only }}
        run: |
          SEV1_CHANGED=${{ steps.run-code-analyzer.outputs.num-sev1-violations-in-changed-files }}
          SEV2_CHANGED=${{ steps.run-code-analyzer.outputs.num-sev2-violations-in-changed-files }}
          
          echo "Severity 1 Violations in Changed Files: $SEV1_CHANGED"
          echo "Severity 2 Violations in Changed Files: $SEV2_CHANGED"
          
          SHOULD_FAIL=false
          
          if [ "${{ inputs.fail-on-sev1-violations }}" == "true" ] && [ "$SEV1_CHANGED" -gt 0 ]; then
            echo "❌ Found $SEV1_CHANGED severity 1 violations in changed files"
            SHOULD_FAIL=true
          fi
          
          if [ "${{ inputs.fail-on-sev2-violations }}" == "true" ] && [ "$SEV2_CHANGED" -gt 0 ]; then
            echo "❌ Found $SEV2_CHANGED severity 2 violations in changed files"
            SHOULD_FAIL=true
          fi
          
          if [ "$SHOULD_FAIL" == "true" ]; then
            exit 1
          else
            echo "✅ Code quality checks passed for changed files"
          fi