# Code reviews, pull requests and Code Analyzer

*Platform Development Lifecycle and Deployment Architect Study Guide · Building · Last updated October 26, 2026 · https://www.certifyforce.com/study-guide/platform-development-lifecycle-and-deployment-architect/building/code-reviews-pull-requests-and-code-analyzer*

How to run pull requests and code reviews that catch real defects, and how Salesforce Code Analyzer v5 engines, severity thresholds, custom PMD rules, the VS Code extension and the GitHub Action automate coding standards before a human reviews the change.

- Certification: Salesforce Platform Development Lifecycle and Deployment Architect
- Exam section: Building
- Study guide: https://www.certifyforce.com/study-guide/platform-development-lifecycle-and-deployment-architect

**Official exam objective:**

> Describe the methods to ensure the delivery of quality code, such as coding standards, pull requests, code review and static code analysis.

## What the exam expects

- Design a review process: what every pull request must contain, how big it may be, who reviews it, and what reviewers check.
- Recognise review anti-patterns (rubber stamping, single reviewer, massive pull requests, ignored checks) and the matching fix.
- Pick the Salesforce Code Analyzer v5 engine that finds a given class of problem.
- Read a `sf code-analyzer run` command: rule selectors, severity threshold and the severity of custom PMD rules.
- Place Code Analyzer where feedback is fastest: the VS Code editor, the CLI in a pipeline and the GitHub Action.

Key terms: **pull request** (a proposed merge that is discussed, reviewed and approved before it lands), **static analysis** (examining code without executing it), **engine** (a Code Analyzer module that executes one kind of rule), **severity threshold** (the violation level that makes a scan exit with a non-zero code), **code-analyzer.yml** (the configuration file for rules, severities and engines).

## Key facts

| Fact | Detail | Source |
|---|---|---|
| Pull request size | Under 400 lines of meaningful change | [Operational Excellence - DevOps Patterns](https://architect.salesforce.com/docs/architect/well-architected/guide/operational-excellence-devops-patterns.html) |
| Review timing | Within one business day | [Operational Excellence - DevOps Patterns](https://architect.salesforce.com/docs/architect/well-architected/guide/operational-excellence-devops-patterns.html) |
| Pull request description | What changed, why, testing done, deployment or rollback notes | [Operational Excellence - DevOps Patterns](https://architect.salesforce.com/docs/architect/well-architected/guide/operational-excellence-devops-patterns.html) |
| Code Analyzer v4 | Retired August 2025; use v5 | [Overview of Salesforce Code Analyzer](https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/code-analyzer.html) |
| Built-in rules | Over 500 | [Overview of Salesforce Code Analyzer](https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/code-analyzer.html) |
| PMD default languages | Apex and Visualforce | [PMD](https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/engine-pmd.html) |
| Vulnerable JS libraries | RetireJS engine | [RetireJS](https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/engine-retire-js.html) |
| Severity threshold | Fails the command when a violation meets or exceeds the level | [code-analyzer Commands](https://developer.salesforce.com/docs/atlas.en-us.sfdx_cli_reference.meta/sfdx_cli_reference/cli_reference_code-analyzer_commands_unified.htm) |
| PMD priority 1 | Maps to severity 2 (High) | [PMD](https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/engine-pmd.html) |
| GitHub Action output | Results artifact plus job summary | [Overview of Salesforce Code Analyzer](https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/code-analyzer.html) |

## Check yourself

- Why should static analysis and unit tests run before a reviewer is asked to look?
- When does `sf code-analyzer run --severity-threshold 3` exit with a non-zero code?
- Which file registers a custom XPath PMD ruleset with Code Analyzer?
- How can the VS Code extension scan without a manual command?

## Sources

- [Operational Excellence - DevOps Patterns](https://architect.salesforce.com/docs/architect/well-architected/guide/operational-excellence-devops-patterns.html)
- [Overview of Salesforce Code Analyzer](https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/code-analyzer.html)
- [Engines](https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/engines.html)
- [PMD](https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/engine-pmd.html)
- [ESLint](https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/engine-eslint.html)
- [RetireJS](https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/engine-retire-js.html)
- [CPD](https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/engine-cpd.html)
- [Analyze Your Code in VS Code](https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/analyze-vscode.html)
- [code-analyzer Commands](https://developer.salesforce.com/docs/atlas.en-us.sfdx_cli_reference.meta/sfdx_cli_reference/cli_reference_code-analyzer_commands_unified.htm)
- [Work with the GitHub Workflow](https://trailhead.salesforce.com/content/learn/modules/git-and-git-hub-basics/work-with-the-git-hub-workflow)

## About the full unit

The "Core concepts", "Exam traps" and "Worked scenario" sections of this unit, its 10 linked practice questions, and unlimited timed mock exams are included with the Platform Development Lifecycle and Deployment Architect pack (USD $19): https://www.certifyforce.com/practice-exams