CodeScan Integration with ARM
Last updated
Last updated
ARM, an Automated Release Management solution built for the Salesforce platform, delivers fast CI/CD solutions for DevOps teams.
This offers you essential solutions to the Salesforce DevOps ecosystem. ARM, partnered with our CodeScan automated code review and standardization, enables developers on the Salesforce platform to deliver new customer experiences with better quality, greater velocity, and increased security.
To integrate all the functionalities included in your CodeScan account with ARM, you need to integrate CodeScan as a plugin with your ARM account, which involves a few steps in your CodeScan as well as ARM account.
To integrate CodeScan with the ARM, follow the procedure as described below.
Click HERE to see the documentation on how create a new security token.
Copy the token. This token will be used while storing your credential with ARM.
Login into your ARM account.
Go to the Admin module and click on Credentials.
Next, click on Create Credential from the right navigation bar.
On the next pop-up screen, enter the Credential name.
Choose the Credential Type as Username with Password.
Choose your Credential Scope,
Global: Credential can be accessed within the team
Private: Credential for private usage
Username: Enter the username for your CodeScan account.
Password: Use the copied token (CodeScan token) you made in the previous step as a password. Note: Please double check that you use your CodeScan username instead of the email address that you use to log in to CodeScan.
Click Save.
Go to Admin > My Account section.
Go to the Plugins section.
Select the CodeScan checkbox under Static Code Analysis.
Fill in the following details:
Enter the CodeScan hosted URL.
For CodeScan cloud version use https://app.codescan.io.
Choose the Host Type i.e., Cloud or On-premises. For CodeScan hosted on the Cloud, you need to add the Organization Key.
Select your Credential from the dropdown.
Click Test Connection to check if the connection has been authenticated or not. A success message is displayed after the authentication is completed.
Click Save.
Click on Save again and your CodeScan integration is all set.
Go to Admin > My Account section.
Next, navigate to the Validation Criteria-Static Code Analysis section.
Select the Enable checkbox.
Enable the CodeScan checkbox and assign the Quality Gate status for all your projects. By default, it is set to ERROR, however, you can choose the criteria of your own. If the Quality Gate matches with the status assigned to the projects on your CodeScan tool, the validation process gets failed and the build aborts.
Click Save.
Next, go to section Commit Validation - Approval Settings. In this section, you can allow CodeScan tools to identify potential software quality issues before the code moves to production and abort the commit process if the Quality Gate set earlier matches the status in CodeScan.
Select the checkbox to Enable Criteria-Based Review Process.
Enable the Should pass validation criteria for Static Code Analysis checkbox and then select the below checkboxes:
CodeScan
Auto reject commit process if the criteria are not met
Click Save.
Similar to CodeScan criteria globally configured in ARM for the Commit operation, you can even set the same for Merge process.
Go to next section: Merge Settings.
Select the Enable Criteria-Based Review Process checkbox.
Under Should pass validation criteria for Static Code Analysis, select the CodeScan checkbox.
Now, click on Save.
After integrating ARM with the CodeScan plugin, select CodeScan as your static code analysis tool to detect bugs, code smells, and security vulnerabilities before the code moves to production on ARM.
With ARM integration, CodeScan only scans the components that are part of the commit, merge, or deployment. However, when the scan is triggered from SCA reports, it scans the entire org/repository.
On the Deployment Settings screen, choose CodeScan/Lint as an SCA tool.
AutoRABIT has a provision for you to freeze or stop the deployment if the build doesn't meet the global criteria set under My Account > Validation Criteria-Static Code Analysis settings.
Select the recipients for the SCA alerts. To do so, enter the recipient's email address to indicate who should be notified about the alert in the SCA Mail Notification field.
Once the deployment is done, you can find the detailed SCA Report for the deployment process under Deployment History.
While merging Salesforce records between two Version Control branches, you can allow CodeScan to check for any bugs, code smells, and security vulnerabilities.
In the New EZ-Merge screen, go to the Prevalidate Merge section.
Select CodeScan/Lint as an SCA tool.
To run CodeScan on all the Apex Classes, Triggers, Apex Pages & AuraDefinitionBundles, select the checkbox for All Supported Metadata Types.
Proceed with the merge process.
Find the detailed SCA Report under Commits screen.
While performing a validation deployment before actually committing the changes, you can allow CodeScan to check for any bugs, code smells and security vulnerabilities.
In the Submit for Validation screen, go to the Validation Reports section.
Select CodeScan/Lint as an SCA tool.
Here, you will have provision to set the condition for running the CodeScan SCA tool, i.e., running for all the Apex Classes, Triggers, Apex Pages & AuraDefinitionBundles components or stating the time period for which it will run.
Proceed with the Prevalidate Commit process.
Find the detailed SCA Report under Commits screen.
While carrying out the CI Job process, you can configure CodeScan to check for any bugs, code smells and security vulnerabilities.
In the Create CI Job screen, search for the Run Code Analysis Report checkbox under the Build section.
Enable the checkbox: Run Code Analysis Report.
Select CodeScan/Lint as a SCA tool.
Here, you will have provision to set the condition for running CodeScan SCA tool, i.e, running for all the Apex Classes, Triggers, Apex Pages & AuraDefinitionBundles components or from the full source or stating the time period from where it will run.
Also, you can set the priority, which means if the priority set is not achieved, the current build is unstable.
Find the detailed SCA report in CI Job Results screen under the Build Details section.
During the implementation phase of a Security Development Lifecycle (SDL), Static Code Analysis is usually performed as part of a Code Review.
CodeScan being a Static Analysis tool continuously detects and reports on data flow problems, software defects, language implementation errors, inconsistencies, dangerous usage, coding standard violations, and security vulnerabilities.
ARM generates a detailed SCA result report and the Lint runs by default every time you run a static code analysis. Lint analyzes source code to flag programming errors, bugs, stylistic errors, and suspicious constructs.
Lint Report will only display information about AuraBundle components.
These reports will have information about the files that were reviewed and its related violations.
To display CodeScan results that are applicable for all kinds of tools (CodeScan, Checkmarx, Apex PMD, Salesforce Scanner, SonarQube), you will be presented with the following screens:
Components and Layout:
Left Sidebar:
Metadata List: Display a list of all metadata types.
Fields List: The corresponding fields will be displayed when a user clicks on a specific metadata type.
Right Pane:
Issues List: Display a list of issues related to the selected metadata and fields.
Code Lines: When a user clicks on an issue, display the relevant lines of code where the issue occurs.
Top Section:
Grid View: Display an overview grid containing information such as files, violations, and other relevant statistics.
Details in Grid View:
Files: List of scanned files.
Violations: Total number of violations, categorized by severity (e.g., critical, major, minor).
User Interactions:
Metadata Navigation: Users can browse and select metadata types from the left sidebar.
Field Display: Upon selecting a metadata type, fields related to that metadata type will be displayed.
Issue Details: Clicking on a field will show issues related to that field on the right pane.
Code View: Clicking on an issue will display the specific lines of code related to that issue on the right pane.
Top Grid Interaction: The grid at the top allows users to get an overview and drill down into specific files and their violations.
Note: In CodeScan, when you select the baseline branch for the analysis from ARM, the branches will be listed under Comparison Branches. If the baseline is not selected, they will be listed under Standard Branches.
Click on the link at the bottom of the page as in the image below which will redirect you to CodeScan Analysis Dashboard page to compare the SCA report in your CodeScan account.
