Salesforce code review

Manual code reviews for Salesforce projects often miss critical metadata documentation or skip over hidden PMD suppressions. This skill automates the inspection of Apex and Salesforce metadata within your GitLab MRs or GitHub PRs, ensuring every change meets strict organizational standards before it reaches production.

What it does

• Enforce Apex Standards flags bulkification issues, SOQL in loops, hardcoded IDs, and incorrect sharing keywords.
• Strict PMD Governance identifies and blocks any @SuppressWarnings annotations to prevent bypassing quality gates.
• Metadata Documentation Audit checks for missing or placeholder Description fields in Flows, Custom Fields, and Validation Rules.
• REST API Validation ensures HTTP status codes in @RestResource classes match the response body logic.
• Deployment Safety verifies that changed test classes are correctly registered in app.yaml for specified test runs.

How it works

1. Context Discovery detects whether the project uses GitLab or GitHub by inspecting git remotes and CLI auth status.
2. Metadata Retrieval fetches the MR/PR title, description, and the full diff against the master or main branch.
3. Automated Analysis runs a multi-pass check across Apex classes, triggers, and XML metadata files.
4. Interactive Reporting generates an inline-style review showing file names, line numbers, and severity levels.
5. Human-in-the-Loop Posting asks for permission before using the glab or gh CLI to post the final verdict to the remote platform.

Frameworks & tools

Built for Salesforce development environments using Apex and Salesforce Metadata API. It requires git and either the GitLab CLI (glab) or GitHub CLI (gh) to be installed and authenticated.

Why this beats prompting it yourself

Generic prompts often fail to parse complex XML metadata or miss subtle Apex-specific anti-patterns like inherited sharing nuances. This skill implements a specific, multi-step workflow that cross-references app.yaml and reference rule files for consistent enforcement that a basic chat prompt cannot maintain.

Use cases

• Pre-deployment Audits to catch missing Flow documentation that breaks maintenance cycles.
• Security Reviews to identify dynamic SOQL injection risks or improper sharing declarations.
• Standardization to block developers from silencing PMD alerts without team consensus.

Known limitations

Requires local CLI authentication and repository access; cannot review private PRs without active glab or gh sessions. Inline comments are posted as a summary note rather than line-anchored threads.