# CodeScan Integration with ARM

ARM, an *Automated Release Management* solution built for the Salesforce platform, delivers fast CI/CD solutions for DevOps teams.

This offers you essential solutions to the [Salesforce DevOps](https://www.autorabit.com/blog/how-do-i-choose-the-best-salesforce-devops-tools/) ecosystem. [ARM](https://www.autorabit.com/products/automated-release-management/), partnered with our CodeScan automated code review and standardization, enables developers on the Salesforce platform to deliver new customer experiences with better quality, greater velocity, and increased security.

To integrate all the functionalities included in your CodeScan account with ARM, you need to integrate CodeScan as a plugin with your ARM account, which involves a few steps in your CodeScan as well as ARM account.

To integrate [CodeScan](https://www.codescan.io/) with the ARM, follow the procedure as described below.

### Create a CodeScan Token <a href="#create-a-codescan-token" id="create-a-codescan-token"></a>

1. Click [HERE](https://knowledgebase.autorabit.com/codescan/docs/generate-a-security-token) to see the documentation on how create a new security token.
2. Copy the **token**. This token will be used while storing your credential with [ARM](https://www.autorabit.com/).

### Store your CodeScan's credential in ARM <a href="#store-your-codescans-credential-in-arm" id="store-your-codescans-credential-in-arm"></a>

1. Login into your ARM account.
2. Go to the **Admin** module and click on **Credentials**.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2Fml9FCedrZrzJAp9D8bC9%2Fimage.png?alt=media&#x26;token=66173def-5796-4a92-9a22-cb4db6f5ed88" alt="" width="252"><figcaption></figcaption></figure>

3. Next, click on **Create Credential** from the right navigation bar.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FwC8mo3nh1yy96GjrQ2ov%2Fimage.png?alt=media&#x26;token=b7de9ef5-0f17-46d6-9803-9115c2674586" alt="" width="359"><figcaption></figcaption></figure>

4. On the next pop-up screen, enter the **Credential name**.
5. Choose the **Credential Type** as **Username with Password**.
6. Choose your **Credential Scope**,
   * **Global:** Credential can be accessed within the team
   * **Private:** Credential for private usage
7. **Username**: Enter the username for your CodeScan account.
8. **Password:** Use the copied token (CodeScan token) you made in the previous step as a password.\
   \
   **Note**: Please double check that you **use your CodeScan username** instead of the email address that you use to log in to CodeScan.
9. Click **Save**.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FRJ5dHSHsSDIugg18hMuy%2Fimage.png?alt=media&#x26;token=f4638966-83d0-4426-b068-a5317b8181d7" alt="" width="454"><figcaption></figcaption></figure>

### Integrate ARM with CodeScan <a href="#integrate-arm-with-codescan" id="integrate-arm-with-codescan"></a>

1. Go to **Admin > My Account** section.
2. Go to the **Plugins** section.
3. Select the **CodeScan** checkbox under **Static Code Analysis**.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FGE7eJO3mTM2sztXjV347%2Fimage.png?alt=media&#x26;token=961e3b94-e96f-4b5d-9481-4374cb2c2eee" alt=""><figcaption></figcaption></figure>

4. Fill in the following details:
   * Enter the CodeScan hosted URL.
   * For CodeScan cloud version use [https://app.codescan.io](https://app.codescan.io/).
   * Choose the **Host Type** i.e., Cloud or On-premises. For CodeScan hosted on the Cloud, you need to add the [**Organization Key**](https://knowledgebase.autorabit.com/codescan/docs/finding-your-organization-keys).\\

     <figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FdAQFwc61v4gRpFxpU1ir%2Fimage.png?alt=media&#x26;token=0a18c30e-ca20-4d78-b852-903d0c5a4fdf" alt=""><figcaption></figcaption></figure>
5. Select your **Credential** from the dropdown.
6. Click **Test Connection** to check if the connection has been authenticated or not. A success message is displayed after the authentication is completed.
7. Click **Save**.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2F3lpf1oF9mW7fJCgvYTz6%2Fimage.png?alt=media&#x26;token=c00da6fd-745c-4cc2-a118-b90d14b90308" alt="" width="422"><figcaption></figcaption></figure>

8. Click on **Save** again and your CodeScan integration is all set.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2F7tnUBEggJDfDgYfQIcZc%2Fimage.png?alt=media&#x26;token=bbce69fa-1e68-4088-a911-130ee0db9462" alt=""><figcaption><p>Click Save</p></figcaption></figure>

### Integration for baseline folder in a non-SFDX structure

When the baseline folder is in a non-SFDX structure and you perform an EZ-Commit with the All Supported Metadata option, it scans the entire Apex Class. This happens because the process generates a new SFDX-formatted structure under force-app/main/default, causing the system to treat it as a new file, which leads to a full scan.

To avoid this, we recommend aligning the baseline structure to the SFDX format to ensure accurate file comparisons and prevent unnecessary full metadata scans.

### Configuring CodeScan's Global Criteria in ARM <a href="#configuring-codescans-global-criteria-in-arm" id="configuring-codescans-global-criteria-in-arm"></a>

1. Go to **Admin > My Account** section.
2. Next, navigate to the **Validation Criteria-Static Code Analysis** section.
3. Select the **Enable** checkbox.
4. Enable the **CodeScan** checkbox and assign the Quality Gate status for all your projects. By default, it is set to **ERROR**, however, you can choose the criteria of your own. If the Quality Gate matches with the status assigned to the projects on your CodeScan tool, the validation process gets failed and the build aborts.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FMiHVyu3GqWQUFOBhT9N7%2Fimage.png?alt=media&#x26;token=324bd055-f257-4fe3-be4d-8653fc8870d1" alt="" width="308"><figcaption></figcaption></figure>

5. Click **Save**.
6. Next, go to section **Commit Validation - Approval Settings**. In this section, you can allow CodeScan tools to identify potential software quality issues before the code moves to production and abort the commit process if the Quality Gate set earlier matches the status in CodeScan.
7. Select the checkbox to **Enable Criteria-Based Review Process.**
8. Enable the **Should pass validation criteria for Static Code Analysis** checkbox and then select the below checkboxes:

   * CodeScan
   * Auto reject commit process if the criteria are not met

   <figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2F7c62VUAwQvkKjvqsYZIL%2Fimage.png?alt=media&#x26;token=0a820492-b505-4088-a9be-f05040845f29" alt=""><figcaption></figcaption></figure>
9. Click **Save**.
10. Similar to CodeScan criteria globally configured in ARM for the Commit operation, you can even set the same for Merge process.
11. Go to next section: **Merge Settings.**
12. Select the **Enable Criteria-Based Review Process** checkbox.
13. Under **Should pass validation criteria for Static Code Analysis**, select the **CodeScan** checkbox.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2F9928AclpDzroixOKgIyU%2Fimage.png?alt=media&#x26;token=df794464-0b95-4daa-9c5c-0b1e81fc40ba" alt=""><figcaption></figcaption></figure>

14. Now, click on **Save**.

## Running CodeScan SCA in ARM <a href="#running-codescan-sca-in-arm" id="running-codescan-sca-in-arm"></a>

After integrating ARM with the CodeScan plugin, select **CodeScan** as your static code analysis tool to detect bugs, code smells, and security vulnerabilities before the code moves to production on ARM.

{% hint style="info" %}
With ARM integration, CodeScan only scans the components that are part of the commit, merge, or deployment. However, when the scan is triggered from SCA reports, it scans the entire org/repository.
{% endhint %}

### During the Deployment Process <a href="#during-deployment-process" id="during-deployment-process"></a>

1. On the Deployment Settings screen, choose **CodeScan/Lint** as an **SCA tool**.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2F1rzbiEUD3cOpeMTmiQgh%2Fimage.png?alt=media&#x26;token=d38f011d-f3f2-40af-b9fe-14a54e954a68" alt="" width="563"><figcaption></figcaption></figure>

2. AutoRABIT has a provision for you to freeze or stop the deployment if the build doesn't meet the global criteria set under **My Account > Validation Criteria-Static Code Analysis settings**.
3. Select the **recipients** for the SCA alerts. To do so, enter the **recipient's email address** to indicate who should be notified about the alert in the SCA Mail Notification field.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2F3MDqTqlYDgafCYjjSvke%2Fimage.png?alt=media&#x26;token=01f80e70-3252-45b8-b6ae-e2392921ca3a" alt=""><figcaption></figcaption></figure>

4. Once the deployment is done, you can find the detailed **SCA Report** for the deployment process under **Deployment History**.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FfeHJbRkwaVOCR7nFpAJu%2Fimage.png?alt=media&#x26;token=22882cc6-8703-4766-b6a4-03efb14af0bd" alt=""><figcaption></figcaption></figure>

### During the EZ-Merge Process <a href="#during-ez-merge-process" id="during-ez-merge-process"></a>

While merging Salesforce records between two Version Control branches, you can allow CodeScan to check for any bugs, code smells, and security vulnerabilities.

1. In the **New EZ-Merge** screen, go to the **Prevalidate Merge** section.
2. Select **CodeScan/Lint** as an **SCA tool**.
3. To run CodeScan on all the **Apex Classes, Triggers, Apex Pages & AuraDefinitionBundles**, select the checkbox for **All Supported Metadata Types**.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FXhXUzbCo7roImaDsEGzo%2Fimage.png?alt=media&#x26;token=0908c941-d14b-4413-bd73-41156237741a" alt=""><figcaption></figcaption></figure>

4. Proceed with the merge process.
5. Find the detailed **SCA Report** under **Commits** screen.

### During the Commit Process <a href="#during-commit-process" id="during-commit-process"></a>

While performing a validation deployment before actually committing the changes, you can allow CodeScan to check for any bugs, code smells, and security vulnerabilities.

1. In the Submit for Validation screen, go to the **Validation Reports** section.
2. Select **CodeScan/Lint** as an **SCA tool**.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FThV81E7QSLhQmS5OjS6o%2Fimage.png?alt=media&#x26;token=c8852c8c-9c2c-4378-ad59-2c4a71d2dffd" alt="" width="563"><figcaption></figcaption></figure>

3. Here, you will have provision to set the condition for running the CodeScan SCA tool, i.e., running for all the **Apex Classes, Triggers, Apex Pages & AuraDefinitionBundles** components or stating the time period for which it will run.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2F0aIwAVpYULGdtqZ7VpaM%2Fimage.png?alt=media&#x26;token=e93b76e6-235d-41fc-a58f-b3ba9af54709" alt="" width="563"><figcaption></figcaption></figure>

4. Proceed with the Prevalidate Commit process.
5. Find the detailed **SCA Report** under **Commits** screen.

### During a CI Job <a href="#during-ci-job" id="during-ci-job"></a>

While carrying out the CI Job process, you can configure CodeScan to check for any bugs, code smells, and security vulnerabilities.

1. In the **Create CI Job** screen, search for the **Run Code Analysis Report** checkbox under the **Build** section.

   * Enable the checkbox: **Run Code Analysis Report**.
   * Select **CodeScan/Lint** as a **SCA tool**.

   <figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FsB0XmwP785qVNhkk72QN%2Fimage.png?alt=media&#x26;token=530138a7-039d-4e9a-80cd-4ca5292e6de8" alt="" width="563"><figcaption></figcaption></figure>
2. Here, you will have provision to set the condition for running CodeScan SCA tool, i.e, running for all the **Apex Classes, Triggers, Apex Pages & AuraDefinitionBundles** components or from the full source or stating the time period from where it will run.
3. Also, you can set the priority, which means if the priority set is not achieved, the current build is unstable.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FFmCnHgM52PkmiBW1izPb%2Fimage.png?alt=media&#x26;token=66bd6b49-5b4b-4850-9557-03ac9d6b17e6" alt=""><figcaption></figcaption></figure>

4. Find the detailed **SCA report** in CI Job Results screen under the **Build Details** section.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FNV83SEqFholkKd6oGfXR%2Fimage.png?alt=media&#x26;token=0400ee58-2f95-4c64-8761-7c5d16db6033" alt=""><figcaption></figcaption></figure>

## CodeScan SCA Results <a href="#codescan-sca-results" id="codescan-sca-results"></a>

During the implementation phase of a Security Development Lifecycle (SDL), [Static Code Analysis](https://www.autorabit.com/products/codescan/) is usually performed as part of a Code Review.

* CodeScan being a Static Analysis tool continuously detects and reports on data flow problems, software defects, language implementation errors, inconsistencies, dangerous usage, coding standard violations, and security vulnerabilities.
* ARM generates a detailed SCA result report and the Lint runs by default every time you run a [static code analysis](https://knowledgebase.autorabit.com/docs/static-code-analysis). Lint analyzes source code to flag programming errors, bugs, stylistic errors, and suspicious constructs.
* Lint Report will only display information about AuraBundle components.

These reports will have information about the files that were reviewed and its related violations.

To display CodeScan results that are applicable for all kinds of tools (CodeScan, Checkmarx, Apex PMD, Salesforce Scanner, SonarQube), you will be presented with the following screens:

1. **Components and Layout**:
   * **Left Sidebar**:
     * **Metadata List**: Display a list of all metadata types.
     * **Fields List**: The corresponding fields will be displayed when a user clicks on a specific metadata type.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2FrqPP0ykiMNjLtxtIBRAE%2Fimage-20240612-161907.png?alt=media&#x26;token=f16d108b-1bd7-4416-a718-a8ed68ea773d" alt=""><figcaption></figcaption></figure>

* **Right Pane**:
  * **Issues List**: Display a list of issues related to the selected metadata and fields.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2Fr5IG3J72Uaoa2mj9WCiY%2Fimage-20240612-161928.png?alt=media&#x26;token=1f90c326-5926-4bbc-a285-b47cd691caed" alt=""><figcaption></figcaption></figure>

**Code Lines**: When a user clicks on an issue, display the relevant lines of code where the issue occurs.

**Top Section**:

* **Grid View**: Display an overview grid containing information such as files, violations, and other relevant statistics.
* **Details in Grid View**:
  * **Files**: List of scanned files.
  * **Violations**: Total number of violations, categorized by severity (e.g., critical, major, minor).

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2Fbbb4mLCLbe96c41l02tn%2Fimage-20240612-162042.png?alt=media&#x26;token=538b533c-ea82-448a-bf1c-70589d37f852" alt=""><figcaption></figcaption></figure>

2. **User Interactions**:
   * **Metadata Navigation**: Users can browse and select metadata types from the left sidebar.
   * **Field Display**: Upon selecting a metadata type, fields related to that metadata type will be displayed.
   * **Issue Details**: Clicking on a field will show issues related to that field on the right pane.
   * **Code View**: Clicking on an issue will display the specific lines of code related to that issue on the right pane.
   * **Top Grid Interaction**: The grid at the top allows users to get an overview and drill down into specific files and their violations.

{% hint style="info" %}
**Note**: In CodeScan, when you select the baseline branch for the analysis from ARM, the branches will be listed under Comparison Branches. If the baseline is not selected, they will be listed under Standard Branches.
{% endhint %}

## **CodeScan Analysis Dashboard**

* Click on the **link** at the bottom of the page as in the image below which will redirect you to CodeScan Analysis Dashboard page to compare the SCA report in your CodeScan account.

<figure><img src="https://1912836914-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F9vAxMuDrkUkB4OXlH9CL%2Fuploads%2Fl6bjSKsWHLFeGCEpxS54%2Fimage.png?alt=media&#x26;token=98afbe3f-cdfa-4ddb-8185-bb12139d3b04" alt=""><figcaption></figcaption></figure>
