forcedotcom / forcedotcom/code-analyzer

[BUG] Bundled PMD 7.25.0 cannot load custom rulesets referencing PMD 7.26.0 rules — one unresolvable ref disables the whole ruleset

オープン
#2,065 コメント 1 件 リアクション 0 件 担当者 0 名 GitHub で見る
主要言語
TypeScript
スター
240
フォーク
52
平均マージ
1日 23時間
マージ済み PR(30日)
5

説明

## Description

A custom PMD ruleset that references a standard rule added in PMD 7.26.0 (for example `category/apex/errorprone.xml/InvocableClassNoArgConstructor`, added 2026-06-29) cannot be loaded by Code Analyzer, because the plugin's bundled PMD engine is still 7.25.0 — and one unresolvable rule reference fails the load of the **entire** ruleset, so every other rule in the file silently stops running too.

There is currently no way for a user to fix this on their side: the PMD jars ship inside `@salesforce/code-analyzer-pmd-engine` (`dist/java-lib/pmd-apex-7.25.0.jar` in engine 0.43.0, the latest) and there is no supported way to point the pmd engine at newer jars.

## Steps To Reproduce

(Prerequisites: Salesforce CLI and Java, the standard Code Analyzer requirements. Steps verified end-to-end in an empty directory.)

1. `sf plugins install code-analyzer` (installs `code-analyzer 5.14.0`, the current latest, which resolves `@salesforce/code-analyzer-pmd-engine@0.43.0`).
2. In an empty directory, create `src/Sample.cls`:

```java
public class Sample {
public static void log() {
System.debug('hello');
}
}
```

3. Create `my-rules.xml`:

```xml

One rule from PMD 7.26.0 plus one custom XPath rule.


demo
3

//MethodCallExpression[lower-case(@FullMethodName) = 'system.debug']

```

4. Create `code-analyzer.yml`:

```yaml
engines:
pmd:
custom_rulesets:
- my-rules.xml
```

5. `sf code-analyzer run --workspace src --rule-selector pmd --config-file code-analyzer.yml`

## Expected Behavior

Either the reference resolves (bundled PMD current with the PMD release line), or at minimum the loadable rules still run and the failure clearly names the unresolvable rule and the bundled PMD version.

## Actual Behavior

The pmd engine fails entirely; zero rules from the ruleset execute:

```
Error: Code Analyzer:
Failed to get rules from engine with name 'pmd' due to the following error:
PMD errored when attempting to load a custom ruleset "my-rules.xml".
Make sure the resource is a valid ruleset file on disk or on the Java classpath.

PMD Exception:
| Cannot load ruleset my-rules.xml: PMD threw an unexpected exception:
| Error at my-rules.xml:7:4
|
| ^^^^^ Unable to find referenced rule InvocableClassNoArgConstructor;
| perhaps the rule name is misspelled?
```

The run then reports `1 Critical severity violation(s) found` across 0 files, which downstream tooling can misread as a code finding.

**Control (shows the rest of the ruleset is valid):** delete the single `` line from `my-rules.xml` and re-run step 5 — the scan now succeeds and `pmd:MyOtherRule` correctly flags `Sample.cls:3`. One unresolvable reference is the only difference between "everything runs" and "nothing runs".

## Requests

1. **Bump the bundled PMD** in `@salesforce/code-analyzer-pmd-engine` to the current PMD release line (7.26.0 shipped 2026-06-29; the all-or-nothing ruleset load is PMD's own semantics, so currency of the bundle is what decides whether a ruleset referencing new standard rules is usable at all).
2. **Improve the diagnostic**: when a custom ruleset fails to load over an unresolvable rule reference, state the bundled PMD version in the message (for example "bundled PMD is 7.25.0; `InvocableClassNoArgConstructor` requires 7.26.0+") so users don't debug a "misspelled rule name" that is actually a version gap. (Companion request for the underlying message on the PMD side: pmd/pmd#6865.)
3. (Nice to have) A documented way to supply or override the PMD version the engine uses.

## Workaround

Remove standard-category rule references from custom rulesets (inline the XPath equivalents or run the standalone PMD CLI >= 7.26.0 separately).

## Environment

- `code-analyzer` plugin 5.14.0 (latest), `@salesforce/code-analyzer-pmd-engine` 0.43.0 (latest)
- Bundled jars: `pmd-apex-7.25.0.jar`, `pmd-core-7.25.0.jar` (in `dist/java-lib/`)
- Standalone PMD for comparison: 7.26.0 (2026-06-29)
- macOS 15 / Node 22

コントリビューションガイド

コントリビューションガイドを開く

調査の方向性

@salesforce/code-analyzer-pmd-engine 0.43.0 とその dist/java-lib/ 内の PMD jar から始め、バンドルされた依存関係とカスタムルールセットの読み込み経路を追跡します。提供されている my-rules.xml、code-analyzer.yml、および sf code-analyzer コマンドを使って再現します。完了の条件は、サポート対象の PMD リリースが最新であり、解決できないルールがバンドルされたバージョンを報告し、要求されたもう一方の動作を暗黙に隠さないことです。

索引モデルが issue の本文から書いたものです。

評価

技術スタック
java, typescript
領域
devtools, testing-qa
issue の種類
バグ
難易度
4/5
見積もり時間
3〜5日
活発さ
静か
明瞭さ
おおむね明確
初心者へのやさしさ
45/100

新しい issue をメールで受け取る

初心者向けの GitHub issue を短くまとめたダイジェスト。