Disabling rules in code-analyzer.yml and suppressing PMD Apex via // NOPMD comments

[SCWells72]

I'm seeing some unexpected (to me, at least) behavior and wanted to see if it was correct or not.

First, if I comment out a rule in the code-analyzer.yml file that is specified via the -c <config-file> flag, I still see violations reported against that rule. This is true for all engines that I've tested. Is that expected? If so, have I perhaps overlooked the correct way to disable a specific rule for an engine?

Second, if I suppress a reported PMD violation using a // NOPMD comment, I still see that violation reported on the next run. Again, is that expected? Does Code Analyzer's execution of PMD perhaps use some other suppression mechanism than the standard ones described in that linked documentation?

Thanks in advance for any insights.

[stephen-carter-at-sf]

The code-analyzer.yml file is just an overrides file. If something is not present in that file then the defaults are used.

Use the sf code-analyzer rules --rule-selector <YOUR_RULE_SELECTOR> command to see the rules that you have selected. Once you are happy then use the same --rule-selector for your run command.

Note that the default value for --rule-selector on the run and rules command is Recomended. So if you don't want a rule to run with this default selector, then in your overrides file - just remove the Recommended tag for that rule.

What are you using for --rule-selector?

The // NOPMD comment works only for PMD engine and should work as documented at https://pmd.github.io/pmd/pmd_userdocs_suppressing_warnings.html

Are you seeing otherwise? I can't reproduce.

[stephen-carter-at-sf]

A common problem is - folks forget to save the file after adding in the // NOPMD before scanning again. Try saving the file before re-scanning.

[SCWells72]

The code-analyzer.yml file is just an overrides file. If something is not present in that file then the defaults are used.

Got it. I thought that was the authoritative config file, but I can see where certain engines, e.g., PMD, have a way to configure the actual ruleset file paths. Makes sense.

And regarding NOPMD, you were correct. My direct PMD integration doesn't require changes to be committed to disk because it operates on the in-memory document, so my mind was working in that mode. As a result, when I added the comment programmatically via a quick fix, that change wasn't picked up. Now I'm flushing that change to disk before Code Analyzer runs again.

Thanks for the quick response!