JSON Run Output Schema Reference

This example shows how to create a JSON-formatted output file when using the --output-file flag of the code-analyzer run command.

sf code-analyzer run --output-file results.json

Sample JSON Run Output

This sample output shows 3 violations with different severities from different engines.

{
  "runDir": "/Users/lisa.simpson/sfdx/coral-cloud-afdx/",
  "violationCounts": {
    "total": 3,
    "sev1": 0,
    "sev2": 1,
    "sev3": 1,
    "sev4": 1,
    "sev5": 0
  },
  "versions": {
    "code-analyzer": "0.25.1",
    "eslint": "0.20.1",
    "retire-js": "0.18.1",
    "regex": "0.18.1",
    "flow": "0.18.1",
    "pmd": "0.21.0"
  },
  "violations": [
    {
      "rule": "@lwc/lwc/no-inner-html",
      "engine": "eslint",
      "severity": 2,
      "tags": ["Recommended", "LWC", "Security", "Javascript"],
      "primaryLocationIndex": 0,
      "locations": [
        {
          "file": "force-app/main/default/staticresources/highlight/highlight/prism.js",
          "startLine": 571,
          "startColumn": 17,
          "endLine": 571,
          "endColumn": 26
        }
      ],
      "message": "Using 'innerHTML/outputHTML/insertAdjacentHTML' is not allowed",
      "resources": [
        "https://github.com/salesforce/eslint-plugin-lwc/blob/v2.1.0/docs/rules/no-inner-html.md"
      ]
    },
    {
      "rule": "PreventPassingUserDataIntoElementWithSharing",
      "engine": "flow",
      "severity": 4,
      "tags": ["Recommended", "Security", "Xml"],
      "primaryLocationIndex": 1,
      "locations": [
        {
          "file": "force-app/main/default/flows/Get_Customer_Details.flow-meta.xml",
          "startLine": 90,
          "startColumn": 1,
          "comment": "email.email: Initialization"
        },
        {
          "file": "force-app/main/default/flows/Get_Customer_Details.flow-meta.xml",
          "startLine": 41,
          "startColumn": 1,
          "comment": "email.email influences Get_Contact_by_Email_and_Member_Number.Email: flow into recordLookups via influence over Email in run mode SystemModeWithSharing"
        }
      ],
      "message": "User controlled data flows into recordLookups element selector in run mode: SystemModeWithSharing",
      "resources": []
    },
    {
      "rule": "ApexSharingViolations",
      "engine": "pmd",
      "severity": 3,
      "tags": ["Recommended", "Security", "Apex"],
      "primaryLocationIndex": 0,
      "locations": [
        {
          "file": "force-app/main/default/classes/ExperienceBookingHelper.cls",
          "startLine": 1,
          "startColumn": 1,
          "endLine": 1,
          "endColumn": 7
        }
      ],
      "message": "Apex classes should declare a sharing model if DML or SOQL/SOSL is used",
      "resources": [
        "https://docs.pmd-code.org/pmd-doc-7.11.0/pmd_rules_apex_security.html#apexsharingviolations"
      ]
    }
  ]
}

Top-Level Properties and Objects

Property Name	Data Type	Description
`runDir`	string	The directory from which the Code Analyzer analysis ran.
`violationCounts`	Object	Object that contains the total number of violations and the aggregate counts for each severity level. See violationCounts Object Properties for details.
`versions`	Object	Object that contains the versions of the core Code Analyzer module and each engine module that ran in the analysis. See versions Object Properties for details.
`violations`	Object[]	An array of objects, where each object corresponds to a violation that was detected in the analysis. See violations Object Properties for details.

violationCounts Object Properties

Property Name	Data Type	Description
`total`	number	Total number of violations found in the analysis.
`sev1`	number	Number of severity 1 (Critical) violations found.
`sev2`	number	Number of severity 2 (High) violations found.
`sev3`	number	Number of severity 3 (Moderate) violations found.
`sev4`	number	Number of severity 4 (Low) violations found.
`sev5`	number	Number of severity 5 (Info) violations found.

versions Object Properties

Property Name	Data Type	Description
`code-analyzer`	string	Version of the core Code Analyzer module.
`cpd`	string	Version of the CPD module.
`eslint`	string	Version of the ESLint module.
`flow`	string	Version of the Flow Scanner module.
`pmd`	string	Version of the PMD module.
`retire-js`	string	Version of the RetireJS module.
`regex`	string	Version of the Regex module.
`sfge`	string	Version of the Salesforce Graph module.

violations Object Properties

Property Name	Data Type	Description
`rule`	string	The name of the rule that's associated with the violation.
`engine`	string	The engine that's associated with the violation.
`severity`	number	The severity level of the violation: 1 (Critical), 2 (High), 3 (Moderate), 4 (Low), 5 (Info)
`tags`	string[]	An array of tags that are associated with the rule that's associated with the violation.
`primaryLocationIndex`	number	The index of the primary code location within the code locations array.
`locations`	Object[]	An array of objects, where each object corresponds to a location in your code that's associated with the violation. See locations Object Properties for details.
`message`	string	The violation message.
`resources`	string[]	An array of URLs for additional resources and information about the violation.

locations Object Properties

Some rules, such as those that have a PathBased tag, can produce multiple code locations. These code locations make up the code path associated with the violation.

Property Name	Data Type	Description
`file`	string	The pathname of the file in which the violation occurred, relative to the `runDir` directory.
`startLine`	number	The line where the violating code starts.
`startColumn`	number	The column in the `startLine` where the violating code starts.
`endLine`	number	The line where the violating code ends.
`endColumn`	number	The column in the `endLine` where the violating code ends.
`comment`	string	Comment that provides additional context associated with this line or block of code.