Code reviews, pull requests and Code Analyzer
How to run pull requests and code reviews that catch real defects, and how Salesforce Code Analyzer v5 engines, severity thresholds, custom PMD rules, the VS Code extension and the GitHub Action automate coding standards before a human reviews the change.
Describe the methods to ensure the delivery of quality code, such as coding standards, pull requests, code review and static code analysis.
~8 min read · 10 practice questions ·
What the exam expects
- Design a review process: what every pull request must contain, how big it may be, who reviews it, and what reviewers check.
- Recognise review anti-patterns (rubber stamping, single reviewer, massive pull requests, ignored checks) and the matching fix.
- Pick the Salesforce Code Analyzer v5 engine that finds a given class of problem.
- Read a
sf code-analyzer runcommand: rule selectors, severity threshold and the severity of custom PMD rules. - Place Code Analyzer where feedback is fastest: the VS Code editor, the CLI in a pipeline and the GitHub Action.
Key terms: pull request (a proposed merge that is discussed, reviewed and approved before it lands), static analysis (examining code without executing it), engine (a Code Analyzer module that executes one kind of rule), severity threshold (the violation level that makes a scan exit with a non-zero code), code-analyzer.yml (the configuration file for rules, severities and engines).
Key facts
- Detail
- Under 400 lines of meaningful change
- Detail
- Within one business day
- Detail
- What changed, why, testing done, deployment or rollback notes
- Detail
- Retired August 2025; use v5
- Detail
- Over 500
- Detail
- Apex and Visualforce
- Source
- PMD (opens in a new tab)
- Detail
- RetireJS engine
- Detail
- Fails the command when a violation meets or exceeds the level
- Detail
- Maps to severity 2 (High)
- Source
- PMD (opens in a new tab)
- Detail
- Results artifact plus job summary
Sources for this section (5)
- Operational Excellence - DevOps Patternsarchitect.salesforce.com (opens in a new tab)
- Overview of Salesforce Code Analyzerdeveloper.salesforce.com (opens in a new tab)
- PMDdeveloper.salesforce.com (opens in a new tab)
- RetireJSdeveloper.salesforce.com (opens in a new tab)
- code-analyzer Commandsdeveloper.salesforce.com (opens in a new tab)
- Why should static analysis and unit tests run before a reviewer is asked to look?
- When does
sf code-analyzer run --severity-threshold 3exit with a non-zero code? - Which file registers a custom XPath PMD ruleset with Code Analyzer?
- How can the VS Code extension scan without a manual command?
The questions are free to read. Answers with their sources and self-grading are included with the pack.
Keep reading with the Platform Development Lifecycle and Deployment Architect pack
- Core concepts
- Exam traps
- Worked scenario
The pack includes:
- All 26 lessons of the Platform Development Lifecycle and Deployment Architect guide, with reading progress
- Interactive decision walks and step-by-step sequence steppers
- Inline practice questions and one-click topic practice (10 questions for this lesson)
- An official source cited for every claim
- An AI tutor that answers from the guide
- Unlimited timed practice exams