What you see
After upgrading to @salesforce/plugin-code-analyzer 5.16.0, a scan that used to run our custom PMD rules stops running them, and nothing fails. The exit code is still 0. The only sign is one Critical violation attached to no file, with a summary like Found 1 violation(s) across 0 file(s). A CI gate that does not use --severity-threshold reads green while zero Apex rules ran.
sf code-analyzer config and sf code-analyzer rules show the cause: Cannot resolve rule/ruleset reference 'scanner/<full-ruleset>.xml/<RuleName>'.
Why it happens
Our repo has two custom rulesets: a full one that defines the rules, and a smaller one that reuses some of them with <rule ref="scanner/full-ruleset.xml/RuleName"/>, a path relative to the repo root. Up to 5.15.x, PMD resolved that path against the repo being scanned, because the PMD process was started from there.
Core PR #503 (the CWE-427 hardening) now starts the PMD process from the engine's own install folder (cwd: __dirname). The PR calls this behaviour-preserving because every argument handed to java is an absolute path. That is true for the paths the engine passes, but not for paths written inside a custom ruleset: PMD still resolves those from the process's working directory, which is now the wrong folder. The whole ruleset then fails to load, and the PMD engine drops out of the run.
The 5.16.0 release notes do not mention it.
How to reproduce
scanner/full.xml defines MyRule. scanner/subset.xml contains <rule ref="scanner/full.xml/MyRule"/>.code-analyzer.yml in the repo root lists both files under engines.pmd.custom_rulesets.- Run
sf code-analyzer rules --rule-selector pmd:MyRule. On 5.15.x the rule is listed. On 5.16.0 the ruleset fails to load with the error above.
Seen with plugin 5.16.0 (code-analyzer-core 0.53.0, pmd-engine 0.46.0, PMD 7.26.0) on macOS. The same configuration loaded cleanly on 5.14.0 and on the release before 5.16.0.
What would fix it
Any one of these:
- Resolve paths inside custom rulesets against the config file's folder or the workspace root. One way: keep the working directory pinned, but add the workspace root to PMD's classpath, so
scanner/... resolves as a classpath resource.
- Or state in the
custom_rulesets docs and the 5.16.0 release notes that a custom ruleset must be self-contained (no relative <rule ref> to another file).
Workaround
Generate the smaller ruleset as a self-contained copy of the rules it needs, instead of pointing at the full one. That is what we now do.
What you see
After upgrading to
@salesforce/plugin-code-analyzer5.16.0, a scan that used to run our custom PMD rules stops running them, and nothing fails. The exit code is still 0. The only sign is one Critical violation attached to no file, with a summary likeFound 1 violation(s) across 0 file(s). A CI gate that does not use--severity-thresholdreads green while zero Apex rules ran.sf code-analyzer configandsf code-analyzer rulesshow the cause:Cannot resolve rule/ruleset reference 'scanner/<full-ruleset>.xml/<RuleName>'.Why it happens
Our repo has two custom rulesets: a full one that defines the rules, and a smaller one that reuses some of them with
<rule ref="scanner/full-ruleset.xml/RuleName"/>, a path relative to the repo root. Up to 5.15.x, PMD resolved that path against the repo being scanned, because the PMD process was started from there.Core PR #503 (the CWE-427 hardening) now starts the PMD process from the engine's own install folder (
cwd: __dirname). The PR calls this behaviour-preserving because every argument handed tojavais an absolute path. That is true for the paths the engine passes, but not for paths written inside a custom ruleset: PMD still resolves those from the process's working directory, which is now the wrong folder. The whole ruleset then fails to load, and the PMD engine drops out of the run.The 5.16.0 release notes do not mention it.
How to reproduce
scanner/full.xmldefinesMyRule.scanner/subset.xmlcontains<rule ref="scanner/full.xml/MyRule"/>.code-analyzer.ymlin the repo root lists both files underengines.pmd.custom_rulesets.sf code-analyzer rules --rule-selector pmd:MyRule. On 5.15.x the rule is listed. On 5.16.0 the ruleset fails to load with the error above.Seen with plugin 5.16.0 (code-analyzer-core 0.53.0, pmd-engine 0.46.0, PMD 7.26.0) on macOS. The same configuration loaded cleanly on 5.14.0 and on the release before 5.16.0.
What would fix it
Any one of these:
scanner/...resolves as a classpath resource.custom_rulesetsdocs and the 5.16.0 release notes that a custom ruleset must be self-contained (no relative<rule ref>to another file).Workaround
Generate the smaller ruleset as a self-contained copy of the rules it needs, instead of pointing at the full one. That is what we now do.