# Static Code Analysis

### Overview <a href="#overview" id="overview"></a>

Static code analysis, or static analysis, is a software verification activity that analyzes source code for quality, reliability, and security without executing the code. Using static analysis, you can identify defects and security vulnerabilities that could compromise the safety and security of your application. Static analysis can be a cost-effective approach to measuring and tracking software quality metrics without the overhead of writing test cases or instrumenting your code.

Static analysis is generally good at finding coding issues, such as:

* Programming errors
* Coding standard violations
* Undefined values
* Syntax violations
* Security vulnerabilities

### Run Static Code Analysis <a href="#run-static-code-analysis" id="run-static-code-analysis"></a>

To run a static code tool on your [Salesforce Org](https://knowledgebase.autorabit.com/~/revisions/Sxgg9jAjbkdELNi4g1n4/product-guides/arm/arm-features/reports/broken-reference) or Version Control Branch, follow the below steps:

1. Hover your mouse over the **REPORTS** module and choose the option: [**STATIC CODE ANALYSIS**](https://www.autorabit.com/products/codescan/)

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FqG6FvTv1QjsWsZjDhn6j%2Fimage.png?alt=media&#x26;token=057fa1ea-5e1c-4343-b845-c5c0613fe61c" alt="" width="323"><figcaption></figcaption></figure>

2. Click on the **NEW STATIC CODE ANALYSIS** button at the top right corner of the screen.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FvAClGPZkG8gqrVjXPNq2%2Fimage.png?alt=media&#x26;token=424fd690-c7ff-4ba4-8bed-f870fabf138d" alt=""><figcaption></figcaption></figure>

3. On the next screen, enter a **Label Name**.
4. Choose **Source** as **Salesforce Org** or **Version Control**.

   * For **Salesforce Org** selection, choose the Salesforce Org for which the SCA will be performed.

   <figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FujOsGJ5i2mjgUWDGYkmM%2Fimage.png?alt=media&#x26;token=292d585c-7a3a-454b-b0db-1cce9f5d7509" alt="" width="535"><figcaption></figcaption></figure>

   * For [**Version Control**](https://knowledgebase.autorabit.com/~/revisions/Sxgg9jAjbkdELNi4g1n4/product-guides/arm/arm-features/version-control) selection, choose your source **Repository** and **Branch**.

   <figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2F79cNE4voYGB8cWgbg30V%2Fimage.png?alt=media&#x26;token=8e7ebea4-fc5c-4e59-ba24-6a244d8077f3" alt="" width="532"><figcaption></figcaption></figure>

   * Select **Source** as **Salesforce org**, then new options become available:

   <figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2F4SpJ3qk64FLMPkwr1xsy%2Fimage.png?alt=media&#x26;token=f24991c5-c079-4caf-8bf5-3f3a36a39824" alt="" width="563"><figcaption></figcaption></figure>

* When performing a prevalidation commit with SCA analysis in DX format on the respective SF Org and package directory, consistency with previously executed analyses for this SF Org and related directory is crucial. Choosing the appropriate comparison branch is essential for accurate evaluations.
* Existing analyses lack branch tracking, limiting the effectiveness of the fix to new analyses if transitioning from a base scan in mdapi to DX, project deletion, and rerun become necessary for recreation in the DX source structure.
* Building on point #1, achieving the described outcome is unattainable with different structures but aligns seamlessly within a single structure per project.
* Depending on the need, a Salesforce or a repository must be bonded with either mdapi or DX source structure but not with both.

5. Select the SCA tool from the drop-down list. For example, [*CodeScan*](https://www.codescan.io/), *ApexPMD, Checkmarx, Salesforce Scanner, or SonarQube*.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FemSgM3aCopANYsd56lDc%2Fimage.png?alt=media&#x26;token=f01f8b87-3bb3-4a24-a60a-e28fee1d6467" alt="" width="563"><figcaption></figcaption></figure>

{% hint style="info" %}
**Note:** Before running the **Static Code Analysis** tool, you must enable them under the **My Account > Plugins** section.
{% endhint %}

6. The list of respective **Metadata Types** is displayed for the selected SCA tool. By default, all are selected. You can unselect certain metadata types as per your requirements.\
   Supported Metadata Types:
   * For **ApexPMD, Checkmarx, SonarQube**: *Apex Classes, Apex Triggers, Apex Pages, AuraDefinitionBundle, LightningComponentBundle.*
   * For **Codescan, Salesforce Scanner**: *ApexClasses, ApexPages, ApexTriggers, AuraDefinitionBundle, CustomObjects, Flow, LightningComponentBundle, PermissionSets, Profiles, Settings, SharingRules, Workflows, StaticResource.*
7. For **CodeScan** or **SonarQube**, choose the **Baseline Branch** if you want to run comparisons between reports.<br>

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FeIJlV6GuvmI2dAHpuAzi%2Fimage.png?alt=media&#x26;token=dbb76dc7-cedd-4a02-b7ec-edb92338f82c" alt="" width="432"><figcaption></figcaption></figure>

8. Select the recipients for the alert under the **Notifications** field. Multiple recipients can be added here.
9. Next, choose the frequency for SCA to run, i.e., daily, weekly, or at any specific interval. For example, if you want the SCA tool to run daily at **10 AM**, select the **Daily** option and set the fixed time to 10.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FNTLkYP2vOBuDvrhX6Ys0%2Fimage.png?alt=media&#x26;token=f0ac8904-cc21-4482-a9d0-0da5571510f1" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FhRU7nrtPwbP7eHqkiiV4%2Fimage.png?alt=media&#x26;token=5306c098-3984-4eb3-92ff-8c5ba4e160f0" alt=""><figcaption></figcaption></figure>

10. Click on **SAVE**.
11. Upon confirmation, you'll be redirected to the home page, where you can find your recently configured SCA.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2F7viOV3SxY2zWRXwRwzy0%2Fimage.png?alt=media&#x26;token=e049277f-2b88-4184-9364-4c6d1c7b872a" alt=""><figcaption></figcaption></figure>

{% hint style="info" %}
**Important Note:** When the analysis is run on a zip file, the content is not visible in UI. But Salesforce Scanner can scan the zipped file and provide the vulnerabilities. However, the file contents for **Static Resource** metadata type are empty.
{% endhint %}

#### Additional options on this page <a href="#additional-options-on-this-page" id="additional-options-on-this-page"></a>

1. **Editing the Schedule:** Locate the edit schedule icon.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FUFmLlKqNiFMyKUm3H2dd%2Fimage.png?alt=media&#x26;token=65b5e6f4-f423-45d4-9778-5f1d3fada500" alt=""><figcaption></figcaption></figure>

2. Choose the desired report frequency (daily, weekly, monthly, etc.).
3. Specify the exact times for reports to run.
4. Please add/remove an email If you want to send/not send the notification.
5. Click on **UPDATE** to save and confirm the changes made to the schedule.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2Fp2AsL8F4BjyiPJ3vQsYS%2Fimage.png?alt=media&#x26;token=a51512e3-e3d5-46dc-bc10-8fee5922b3ae" alt=""><figcaption></figcaption></figure>

6. **Running On-demand SCA**: To run the SCA tool before the scheduled time frame, click on the     **Run (**![](https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FiMcmgzbwLE3sRNSx8tcZ%2Fimage.png?alt=media\&token=e61ac7e5-ae61-44e9-898b-16abe64a89b0)**)** button.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FejnSZCr0qt68jW1pfo6g%2Fimage.png?alt=media&#x26;token=abef871e-44f6-4372-bc65-5075f809edd8" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2Fc7CqP427wbYgBjpseMmc%2Fimage.png?alt=media&#x26;token=192b3d1b-62d4-44d8-be9f-459bfda10fd7" alt="" width="362"><figcaption></figcaption></figure>

7. **Log**: Click on the **Log** (![](https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FfxnZWDt5RPlS0xwJxnOg%2Fimage.png?alt=media\&token=0b60aa27-a3a7-49e4-91d7-10510fb694af)) icon to find the detailed log report.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FC98c7dLjNCPu6MBpL2pY%2Fimage.png?alt=media&#x26;token=07de7e3a-b6d1-4ac1-9cfb-21890c6cd8d8" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2F0SyORaNRJgeQKr21iG24%2Fimage.png?alt=media&#x26;token=e83bec8a-1c3c-46d9-9d7b-329aabf7860c" alt="" width="563"><figcaption></figcaption></figure>

8. **SCA Result**: ARM generates a detailed SCA report whenever you run static code analysis. This report will have info about the reviewed files and the related violations. Click on each file to view its related violations at the bottom right side of the page. If you click on any violation, it will take you to the respective line (in the black screen on the right side) where the violation occurred.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2F3plFObAtYUzgCwjQ8V76%2Fimage.png?alt=media&#x26;token=37eb45ab-5e2f-4c50-9365-4ede76138714" alt=""><figcaption></figcaption></figure>

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2Fwupz3UgMUC64bBat955x%2Fimage.png?alt=media&#x26;token=9c2604b8-007d-472e-b700-1bfa2130c480" alt=""><figcaption></figcaption></figure>

9. **Download SCA Report**: Click on the **Download** (![](https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2Fy6a7EC4IWVy8nh4K88BU%2Fimage.png?alt=media\&token=1c5e33b7-0673-4c3b-855e-6275e8aa9820)) icon to download the report in CSV format on your local device.
10. **Delete SCA process**: Click on the **Delete (**![](https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FbFVeoElQjSgwdckt5CP6%2Fimage.png?alt=media\&token=90cfd86b-a72f-485b-b821-815358c0d0b6)**)** icon to delete the SCA process configured for your org/anch. This cannot be undone.
11. **View the SCA run details**: To view the list of SCA runs to date along with individual SCA results, click on the **Label Name**. The main screen shows the last details of the SCA run.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2F2r1rxl26UTARe1uMrqmr%2Fimage.png?alt=media&#x26;token=335494cf-e049-4c99-88d7-30619441818e" alt="" width="559"><figcaption></figcaption></figure>

### **Points to Note:** <a href="#points-to-note" id="points-to-note"></a>

We are utilizing **\<sforgname>** or **\<reponame>** as the project’s unique identifier, and we’re creating short-lived branches for each run. Thus, the technique builds a single project for a single Salesforce Org or Version Control Repo/branch and then executes the analysis on the short-lived branches.

The naming convention for the short-lived branches: **\<jobname\_branchname>**

The short-lived branches are active for a limited time (30 days by default, depending on *SonarQube/CodeScan* configuration), after which they will be automatically deleted. The report will remain on ARM. However, the branch will be removed from the *SonarQube/CodeScan* side.

Scans will run only on the **source**, whether the source is **VC Repo** or **SF Org**. The scan results will then be available in the **Reports** module. Users can trace the job that is run in ARM to the scan using the unique identifier.

{% hint style="info" %}
**Important Note:**

If there is no **master analysis** available, you will get the following message on the screen:&#x20;

*You do not have a Master analysis. We recommend you run the Master (baseline) analysis from the Static Code Analysis (hyperlink) section in the Reports module before you proceed. If you do not run the Master analysis, the analysis from this job will become your Master (baseline) analysis.*

Click **Continue anyway** to proceed with the new analysis as Master.
{% endhint %}
