PR Validation

Reusable workflow that validates a pull request without changing the target org: it runs static code analysis and a check-only (dry-run) delta deployment including Apex tests. Call it from your own repository via uses:.

Reusable workflow - call it from your own repository with uses:. View source

Inputs

Input	Description	Type	Required	Default
source-dir	Source directory to analyze and validate.	string	no	force-app
target-org-alias	Alias used for the authenticated validation org.	string	no	ci
test-level	Apex test level for the validation deployment. Ignored when apex-tests is set.	string	no	RunLocalTests
apex-tests	Comma-separated or multi-line list of Apex test classes to run during the validation deployment. A selection always runs with RunSpecifiedTests. Leave empty to run the test-level.	string	no	-
delta	Validate only the components changed in the pull request.	boolean	no	true
run-code-review	Run the code review (Salesforce Code Analyzer).	boolean	no	true
severity-threshold	Fail if a code analyzer violation with this severity or higher is found.	string	no	3
environment	Optional GitHub Environment to validate in - its environment-scoped secrets select the org to validate against, e.g. one environment per target branch. Use an environment without required reviewers or branch restrictions, or every pull request waits for an approval or is rejected. Leave empty to use the repository secrets.	string	no	-

Secrets

Secret	Description	Required
SFDX_CONSUMER_KEY	Consumer key (client ID) of the connected app used for the JWT flow.	yes
SFDX_JWT_SECRET_KEY	Contents of the private server key (server.key) used for the JWT flow.	yes
SFDX_USERNAME	Username of the integration user to authenticate as.	yes

Example usage

Copy this caller into your project's .github/workflows/ directory (source):

# Example: call the reusable PR validation workflow.
# Copy this file into your project's .github/workflows/ directory.

name: PR Validation

# Keep this on `pull_request`. Never switch it to `pull_request_target`: that
# event runs with the base repository's secrets, so a pull request from a fork
# could execute its own code against your Salesforce org.
on:
  pull_request:
    branches: [main]

# Least-privilege token: read the repository, plus write the code analysis
# results back as a SARIF report. A reusable workflow can never get more
# permissions than the caller grants here, so security-events: write has to be
# granted in this file as well.
permissions:
  contents: read
  security-events: write

jobs:
  validate:
    uses: svierk/salesforce-devops-starter-kit/.github/workflows/pr-validation.yml@v1.5.0
    with:
      source-dir: force-app
      test-level: RunLocalTests
      # Run only a selection of Apex test classes instead (implies RunSpecifiedTests):
      # apex-tests: AccountServiceTest,LeadServiceTest
      delta: true
      run-code-review: true
      severity-threshold: '3'
    secrets:
      SFDX_CONSUMER_KEY: ${{ secrets.SFDX_CONSUMER_KEY }}
      SFDX_JWT_SECRET_KEY: ${{ secrets.SFDX_JWT_SECRET_KEY }}
      SFDX_USERNAME: ${{ secrets.SFDX_USERNAME }}