Any thoughts on Salesforce Code Analyzer?

[marcosboger]

Creating the discussion here as I consider sfdx-hardis a key project in the DevOps community.

Does anyone have thoughts and impressions on the Salesforce Code Analyzer?
We are thinking about using it as our main SAST tool for Salesforce developments, but mainly worried about the rules coverage and if it's good enough to be the sole SAST tool in our Dev setup.

@nvuillam welcome to hear your thoughts (if any 😊)

[nvuillam]

@marcosboger as it embeds PMD & eslint, it's pretty good for your Apex, Aura & LWC :)

in sfdx-hardis CI/CD, code-analyzer is embedded via MegaLinter by Ox Security, with other linters, including copy-paste detectors, security linters (avoid credentials hardcoded in your repo... )

Note: Current version embeds sfdx-scanner, the previous version of code-analyzer, but very soon there will be a new release with code-analyzer, it's already available in current beta :)