PR Validation

Reusable workflow that validates a pull request without changing the target org: it runs static code analysis and a check-only (dry-run) delta deployment including Apex tests. Call it from your own repository via uses:.

Reusable workflow - call it from your own repository with uses:. View source

Inputs

Input	Description	Type	Required	Default
source-dir	Source directory to analyze and validate.	string	no	force-app
target-org-alias	Alias used for the authenticated validation org.	string	no	ci
test-level	Apex test level for the validation deployment.	string	no	RunLocalTests
delta	Validate only the components changed in the pull request.	boolean	no	true
run-code-review	Run the code review (Salesforce Code Analyzer).	boolean	no	true
severity-threshold	Fail if a code analyzer violation with this severity or higher is found.	string	no	3

Secrets

Secret	Description	Required
SFDX_CONSUMER_KEY	Consumer key (client ID) of the connected app used for the JWT flow.	yes
SFDX_JWT_SECRET_KEY	Contents of the private server key (server.key) used for the JWT flow.	yes
SFDX_USERNAME	Username of the integration user to authenticate as.	yes

Example usage

Copy this caller into your project's .github/workflows/ directory (source):

# Example: call the reusable PR validation workflow.
# Copy this file into your project's .github/workflows/ directory.

name: PR Validation

# Keep this on `pull_request`. Never switch it to `pull_request_target`: that
# event runs with the base repository's secrets, so a pull request from a fork
# could execute its own code against your Salesforce org.
on:
  pull_request:
    branches: [main]

# Least-privilege token: read the repository, plus write the code analysis
# results back as a SARIF report. A reusable workflow can never get more
# permissions than the caller grants here, so security-events: write has to be
# granted in this file as well.
permissions:
  contents: read
  security-events: write

jobs:
  validate:
    uses: svierk/salesforce-devops-starter-kit/.github/workflows/pr-validation.yml@v1.0.0
    with:
      source-dir: force-app
      test-level: RunLocalTests
      delta: true
      run-code-review: true
      severity-threshold: '3'
    secrets:
      SFDX_CONSUMER_KEY: ${{ secrets.SFDX_CONSUMER_KEY }}
      SFDX_JWT_SECRET_KEY: ${{ secrets.SFDX_JWT_SECRET_KEY }}
      SFDX_USERNAME: ${{ secrets.SFDX_USERNAME }}