Any thoughts on Salesforce Code Analyzer?

[marcosboger]

Creating the discussion here as I consider sfdx-git-delta a key project in the DevOps community.

Does anyone have thoughts and impressions on the Salesforce Code Analyzer?
We are thinking about using it as our main SAST tool for Salesforce developments, but mainly worried about the rules coverage and if it's good enough to be the sole SAST tool in our Dev setup.

@scolladon welcome to hear your thoughts (if any 😊)

[scolladon]

Hi,

Personally I use it on my projects.
I think it is good enough, it has a few quirks (it works differently than apex pmd for the severity mapping if I remember correctly) but is highly maintained and improved (apex guru and scale center may land there as a new engine, I hope)

This blog is very nice to step into it (locally and in the CI)