running-code-analyzer

Salesforce static code analysis can be triggered from natural-language requests, which the tool translates into the correct `sf code-analyzer run` command with appropriate rule selectors and targets. It executes the scan via Bash and generates timestamped output files for your project.

Yes, security violations can be automatically fixed. The tool discovers deterministic fixes provided by engines like PMD or ESLint, asks for your explicit confirmation before applying any changes, and filters out likely third-party vendor files to prevent modifying external libraries.

Git diff scanning filters Salesforce code quality checks to only include changed files. This diff-aware logic limits the static analysis scope to your recent modifications, reducing scan time and focusing violation summaries strictly on newly introduced issues.

Supported static analysis engines include PMD, ESLint, CPD, RetireJS, Flow, SFGE, and ApexGuru. The tool automatically selects the appropriate engine and builds the correct invocation to scan for security vulnerabilities, code quality issues, and best-practice violations.

Violation reports are available in JSON, HTML, SARIF, CSV, and XML formats. The tool determines the output format based on the file extension specified in the `--output-file` flag, parsing results to summarize top findings by severity, rule frequency, and affected files.

The auto-fix workflow filters vendor files to reduce risk and avoid modifying third-party libraries. By excluding likely vendor violations before applying deterministic fixes, the tool ensures that automated code corrections only target your own Salesforce project source code.