Skip to main content

Baselines

A baseline lets existing findings stay while every new change is held to a clean bar. In vulkro-sf the baseline is a git ref: the scan compares the working tree with that ref and fails only on findings the change introduced.

vulkro-sf scan ./force-app --gate-vs origin/main

--gate-vs <ref> runs a second scan of the same paths at <ref> (a branch, tag or commit), compares the two finding sets by file, line and rule, and exits 1 only when the working tree has findings the ref does not. Findings already present on the ref keep the exit code at 0. The ref must resolve with git rev-parse, so CI needs the full history (fetch-depth: 0 on GitHub). Setting VULKRO_SF_GATE_BASE turns on the same gate.

Review a change​

vulkro-sf review shows only the findings on lines your change touched, tagged NEW or existing, plus any access the change grants (for example a guest user gaining read on a sensitive field).

vulkro-sf review --range origin/main...HEAD --fail-on high
vulkro-sf review --range origin/main...HEAD --baseline origin/main   # exact NEW vs existing, slower

--fail-on (critical, high, medium, low or none) sets which NEW findings gate. Without --baseline, a finding on an added line counts as NEW; with it, the base ref is scanned and findings are matched by fingerprint.

Accept one finding​

To accept a specific finding on purpose, add a comment on or above its line:

// vulkro:disable next-line apex-dyn-exec-soql
Database.query(q);

// vulkro:disable-line <rule-id> and // vulkro:disable-file <rule-id> also work, and <!-- ... --> in XML and HTML. Document why next to the comment. In CI, --no-suppress (or VULKRO_NO_SUPPRESS=1) shows what the comments hide.

Typical flows​

  • First pipeline on a mature codebase: gate pull requests with --gate-vs origin/main and fix the backlog over time with full scans.
  • AgentExchange resubmission: fix the reviewer's findings, then gate every later change against the fixed commit so nothing regresses.
  • An engagement on a customer's code: tag the starting commit, gate changes against it, and run a full scan at the end to compare with the first one.

Exit codes​

0 no new findings; 1 new findings (or no licence); 2 error (for example, a ref that does not resolve).

See also: CI/CD integration, CLI reference: scan

Last updated on