---
schema_version: "1"
id: 6c9d44d4d8a5ba5c8748c6750f2afa442a43487df3e049b3282a7663ee6c7a66
title: CI/CD Integration with Code Analyzer (Retired)
collection: developer
version: current
locale: en-us
portal_url: https://docs.salesforce.com/developer/current/en-us/code-analyzer/salesforce-code-analyzer/guides/v3x/ci-cd-integration.md
canonical_url: https://developer.salesforce.com/docs/platform/salesforce-code-analyzer/guide/ci-cd-integration.html
source_site: developer.salesforce.com
content_type: documentation
content_hash: 34d8bb846ada47ca53981cd2c53a4150642b6201a25112a7af8b618e09356b0c
products:
  - Salesforce Code Analyzer
---
# CI/CD Integration with Code Analyzer (Retired)

We recommend that you integrate Salesforce Code Analyzer into your Continuous Integration/Continuous Development (CI/CD) process to scan your code regularly for potential problems. Code Analyzer makes it easier to identify issues ahead of submitting your code for the AppExchange Security Review.

## Call Code Analyzer

To integrate Code Analyzer into your CI/CD tool, call the appropriate `run` command in any scripts used by your tool. We recommend that you call:

- `sf scanner run` whenever CI/CD detects changes to code.
- `sf scanner run dfa` with `--target {all_classes}` on a scheduled basis, such as nightly.
  Why do we recommend that `sf scanner run dfa` is executed only on a scheduled basis? Depending on the number of paths it generates, Salesforce Graph Engine can take some time to execute when you include all target classes. Alternatively, you can limit the number of paths and speed up Graph Engine execution in your CI/CD by reducing the number of targets using the flag `--target {specific_class}` as you can see [here](https://forcedotcom.github.io/sfdx-scanner/en/v3.x/scanner-commands/dfa/).

### Replace this value:

- `<all classes>`, `<specific class>`: The source code location.

Follow these CI/CD best practices.

- Use the `--format junit` flag, a standard format used by the CI/CD tool.
- To write your results to a file and produce a results artifact for use with your CI/CD tool, use the `-o/--outfile {name}.xml` flag.
- To cause a non-zero exit code when any violations meet or exceed the provided value, use the `-s/–severity-threshold` flag. Many CI/CD tools require thresholds.

### Replace this value:

- `<name>.xml`: The location where to write the output file.

## Accelerate Your CI/CD Integration

To accelerate your continuous integration/continuous (CI/CD) development, create a GitHub Action workflow that uses the `run-code-analyzer` GitHub Action. GitHub Action workflows provide opportunities to automate your entire pipeline, from building and testing to deployment. The `run-code-analyzer` GitHub Action scans your code for violations using Salesforce Code Analyzer, uploads the results as an artifact, and displays the results as a job summary.

If you’re using DevOps Center, you can use the `run-code-analyzer` GitHub Action as you promote changes, helping you identify and address issues earlier in your development pipeline.

With the `run-code-analyzer` Action, you can customize:

- Which Salesforce Code Analyzer command to run: run or run dfa
- What arguments to pass with your scan
- The name of the results artifact

With `run-code-analyzer`, take control of your workflow’s next steps with these outputs:

- The Salesforce Code Analyzer execution exit code
- The total number of violations found
- The number of normalized low-, medium-, and high-severity violations found

For usage info on the `run-code-analyzer` GitHub Action, read [run-code-analyzer documentation](https://github.com/marketplace/actions/run-salesforce-code-analyzer) on the [GitHub Actions Marketplace](https://github.com/marketplace).

## Other CI/CD Tools

Our community of users continues to develop templates and tools that help you speed up Code Analyzer integration into your CI/CD process.

Try these community tools:

- [SFDX Scan Pull Request](https://github.com/marketplace/actions/sfdx-scan-pull-request) by Mitchell Spano
- [Pull Request SFDX Code Review](https://github.com/marketplace/actions/pull-request-sfdx-code-review) by Aleš Remta