Skip to content

Commit 9b77d71

Browse files
RubenHalmanRubenHalman
committed
Import VSX repository with full history into packages/vsx
2 parents 2e70e63 + 650aa64 commit 9b77d71

34 files changed

+17529
-0
lines changed

‎packages/vsx/.github/workflows/deploy-RELEASE.yml‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
name: "Build & Release"
2+
3+
on:
4+
release:
5+
types: [created]
6+
7+
permissions:
8+
contents: read
9+
id-token: write # for future OpenID CI auth to avoid PATs
10+
11+
concurrency:
12+
group: ${{ github.ref_name }}-${{ github.workflow }}
13+
cancel-in-progress: true
14+
15+
jobs:
16+
release:
17+
runs-on: ubuntu-latest
18+
environment: release
19+
20+
steps:
21+
- name: Checkout Repository
22+
uses: actions/checkout@v4
23+
with:
24+
fetch-depth: 0
25+
26+
- name: Setup Node
27+
uses: actions/setup-node@v4
28+
with:
29+
node-version: 22.x
30+
31+
- name: Install Dependencies
32+
run: npm ci
33+
34+
# Snyk security scan (currently advisory)
35+
- name: Snyk Security Scan (Advisory Mode)
36+
if: env.SNYK_TOKEN != ''
37+
env:
38+
SNYK_TOKEN: ${{ secrets.SNYK_TOKEN }}
39+
run: |
40+
npm install -g snyk
41+
snyk test || echo "❗ SNYK findings detected (not failing pipeline yet)"
42+
43+
- name: Build Extension Artifacts
44+
run: npm run vscode:prepublish
45+
46+
- name: Run WDIO E2E Tests
47+
run: npm run test
48+
49+
- name: Package VSIX
50+
run: |
51+
npm install -g @vscode/vsce
52+
vsce package
53+
54+
- name: Publish to VS Code Marketplace
55+
run: |
56+
vsce publish --pat "${{ secrets.VSCE_PAT }}" --packagePath *.vsix
57+
shell: bash

‎packages/vsx/.gitignore‎

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
out
2+
dist
3+
node_modules
4+
.vscode-test/
5+
*.vsix
6+
.DS_Store
7+
yarn-error.logs
8+
.wdio-vscode-service
9+
10+
*.log
11+
*.vsix
12+
coverage
13+
14+
.config
15+
16+
src/vscode.d.ts

‎packages/vsx/.vscode/launch.json‎

Lines changed: 43 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,43 @@
1+
// A launch configuration that compiles the extension and then opens it inside a new window
2+
// Use IntelliSense to learn about possible attributes.
3+
// Hover to view descriptions of existing attributes.
4+
// For more information, visit: https://go.microsoft.com/fwlink/?linkid=830387
5+
{
6+
"version": "0.2.0",
7+
"configurations": [
8+
{
9+
"name": "Launch Extension",
10+
"type": "extensionHost",
11+
"request": "launch",
12+
"runtimeExecutable": "${execPath}",
13+
"args": ["--extensionDevelopmentPath=${workspaceRoot}" ],
14+
"stopOnEntry": false,
15+
"sourceMaps": true,
16+
"outFiles": ["${workspaceRoot}/out/src/**/*.js"],
17+
"preLaunchTask": "npm: watch"
18+
},
19+
{
20+
"args": [
21+
"--extensionDevelopmentPath=${workspaceFolder}"
22+
],
23+
"name": "Launch Extension xxxxx",
24+
"outFiles": [
25+
"${workspaceFolder}/dist/**/*.js"
26+
],
27+
"request": "launch",
28+
"runtimeExecutable": "${execPath}",
29+
"type": "pwa-extensionHost"
30+
},
31+
{
32+
"name": "Run Extension",
33+
"type": "extensionHost",
34+
"request": "launch",
35+
"args": [
36+
"--extensionDevelopmentPath=${workspaceFolder}"
37+
],
38+
"outFiles": [
39+
"${workspaceFolder}/dist/**/*.js"
40+
]
41+
}
42+
]
43+
}

‎packages/vsx/.vscode/settings.json‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
// Place your settings in this file to overwrite default and user settings.
2+
{
3+
"files.exclude": {
4+
"out": false, // set this to true to hide the "out" folder with the compiled JS files
5+
"dist": false // set this to true to hide the "dist" folder with the compiled JS files
6+
},
7+
"search.exclude": {
8+
"out": true, // set this to false to include "out" folder in search results
9+
"dist": true // set this to false to include "dist" folder in search results
10+
},
11+
// Turn off tsc task auto detection since we have the necessary tasks as npm scripts
12+
"typescript.tsc.autoDetect": "off",
13+
"typescript.tsdk": "node_modules/typescript/lib",
14+
}

‎packages/vsx/.vscode/tasks.json‎

Lines changed: 29 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
// See https://go.microsoft.com/fwlink/?LinkId=733558
2+
// for the documentation about the tasks.json format
3+
{
4+
"version": "2.0.0",
5+
"tasks": [
6+
{
7+
"type": "npm",
8+
"script": "watch",
9+
"problemMatcher": "$ts-webpack-watch",
10+
"isBackground": true,
11+
"presentation": {
12+
"reveal": "never",
13+
"group": "watchers"
14+
},
15+
"group": {
16+
"kind": "build",
17+
"isDefault": true
18+
}
19+
},
20+
{
21+
"type": "npm",
22+
"script": "compile",
23+
"group": "build",
24+
"problemMatcher": [],
25+
"label": "npm: compile",
26+
"detail": "npm run build"
27+
}
28+
]
29+
}

‎packages/vsx/CNAME‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
vsx.lightningflowscanner.org

‎packages/vsx/Contributing.md‎

Lines changed: 9 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,9 @@
1+
Since 2021, the _Lightning Flow Scanner_ has grown from its roots as VS Code tool to empower Salesforce Developers across six free and open-source platforms—from developer tools to native Salesforce App—delivering a unified experience for robust static analysis of Flows. Our dedicated community has shared their expertise to deepen understanding of Flow optimization. Your support can amplify our impact. Here’s how you can contribute:
2+
3+
- ⭐ Star your favorite platforms
4+
- 📢 Share our work with your network
5+
- 💬 Provide feedback to help us improve
6+
- 💻 Contribute code to drive innovation
7+
- 🤝 [Become a member](https://register.lightningflowscanner.org/) and stay involved.
8+
9+
Want to help improve Lightning Flow Scanner? See our [Contributing Guidelines](https://github.com/Flow-Scanner/lightning-flow-scanner-core/blob/main/CONTRIBUTING.md).

‎packages/vsx/LICENSE.md‎

Lines changed: 21 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,21 @@
1+
MIT License
2+
3+
Copyright (c) 2020
4+
5+
Permission is hereby granted, free of charge, to any person obtaining a copy
6+
of this software and associated documentation files (the "Software"), to deal
7+
in the Software without restriction, including without limitation the rights
8+
to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
9+
copies of the Software, and to permit persons to whom the Software is
10+
furnished to do so, subject to the following conditions:
11+
12+
The above copyright notice and this permission notice shall be included in all
13+
copies or substantial portions of the Software.
14+
15+
THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
16+
IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
17+
FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
18+
AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
19+
LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
20+
OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
21+
SOFTWARE.

‎packages/vsx/README.md‎

Lines changed: 160 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,160 @@
1+
<p align="center">
2+
<a href="https://github.com/Flow-Scanner">
3+
<img src="media/bannerslim.png" style="width: 41%;" />
4+
</a>
5+
</p>
6+
<p align="center"><i>Detect unsafe contexts, queries in loops, hardcoded IDs, and more to optimize Salesforce Flows</i></p>
7+
8+
<p align="center">
9+
<img src="media/demo.gif" alt="Flow Overview"/>
10+
</p>
11+
12+
---
13+
14+
## Table of contents
15+
16+
- **[Usage](#usage)**
17+
- **[Configuration](#configuration)**
18+
- [Scanner Options](#scanner-options)
19+
- [Extension Settings](#extension-settings)
20+
- **[Installation](#installation)**
21+
- **[Development](#development)**
22+
23+
---
24+
25+
## Usage
26+
27+
28+
Lightning Flow Scanner VSX is plug-and-play. Open any project with flows and use our side bar or the **Command Palette** and type `flowscanner` to see the list of all available commands.
29+
30+
* `Configure Flow Scanner` - Set up rules in `.flow-scanner.yml`
31+
* `Scan Flows` - Analyze a directory or selected flow files
32+
* `Fix Flows` - Automatically apply available fixes
33+
* `Flow Scanner Documentation` - Open the rules reference guide
34+
35+
**Privacy:** Zero user data collected. All processing is client-side. → See our [Security Policy](https://github.com/Flow-Scanner/lightning-flow-scanner-vsx?tab=security-ov-file).
36+
37+
---
38+
39+
## Configuration
40+
41+
It is recommended to set up a `.flow-scanner.yml` and define:
42+
43+
- The rules to be executed.
44+
- The severity of violating any specific rule.
45+
- Rule properties such as REGEX expressions.
46+
- Any known exceptions that should be ignored during scanning.
47+
48+
### Scanner Options
49+
50+
```json
51+
{
52+
"rules": {
53+
// Your rules here
54+
},
55+
"exceptions": {
56+
// Your exceptions here
57+
},
58+
"betamode": false // Enable beta rules
59+
}
60+
```
61+
62+
Using the rules section of your configurations, you can specify the list of rules to be run. Furthermore, you can define the severity and configure expressions of rules. Below is a breakdown of the available attributes of rule configuration:
63+
64+
```json
65+
{
66+
"rules": {
67+
"<RuleName>": {
68+
"severity": "<Severity>",
69+
"expression": "<Expression>"
70+
}
71+
}
72+
}
73+
```
74+
75+
Note: if you prefer JSON format, you can create a `.flow-scanner.json` file using the same format. For a more on configurations, review the [scanner documentation](https://flow-scanner.github.io/lightning-flow-scanner-core/#configuration).
76+
77+
### Extension Settings
78+
79+
| Extension Settings | Description | Default Value |
80+
| ---------------------------- | ------------------------------------------------------------------- | ------------- |
81+
| `flowscanner.SpecifyFiles` | Set to true to select .Flow file paths instead of a root directory. | `true` |
82+
83+
---
84+
85+
## Installation
86+
87+
`lightning-flow-scanner-vsx` is available on:
88+
89+
| Visual Studio Marketplace | Open VSX Registry |
90+
| -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
91+
| [![VS Marketplace Version](https://img.shields.io/visual-studio-marketplace/v/ForceConfigControl.lightning-flow-scanner-vsx?label=VS%20Marketplace)](https://marketplace.visualstudio.com/items?itemName=ForceConfigControl.lightning-flow-scanner-vsx) | [![Open VSX Version](https://img.shields.io/open-vsx/v/ForceConfigControl/lightning-flow-scanner-vsx?label=Open%20VSX)](https://open-vsx.org/extension/ForceConfigControl/lightning-flow-scanner-vsx) |
92+
93+
To install via CLI (VS Code)
94+
95+
```bash
96+
code --install-extension ForceConfigControl.lightning-flow-scanner-vsx
97+
```
98+
99+
---
100+
101+
## Development
102+
103+
> This project optionally uses [Volta](https://volta.sh) to manage Node.js versions. Install Volta with:
104+
>
105+
> ```sh
106+
> curl https://get.volta.sh | bash
107+
> ```
108+
>
109+
> Volta will automatically use the Node.js version defined in `package.json`.
110+
111+
1. **Clone the repository**
112+
113+
```bash
114+
git clone https://github.com/Flow-Scanner/lightning-flow-scanner-vsx.git
115+
```
116+
117+
2. **Install dependencies**
118+
119+
```bash
120+
npm install
121+
```
122+
123+
3. **Compile a new version**
124+
125+
```bash
126+
npm run build
127+
```
128+
129+
4. **Auto-compile new changes**
130+
131+
```bash
132+
npm run watch
133+
```
134+
135+
5. **Run end-to-end tests**
136+
137+
```bash
138+
npm run test
139+
```
140+
141+
6. **Linking** **Core Module (Optional)**
142+
143+
If you’re developing or testing updates to the core module, you can link it locally:
144+
145+
- In the core module directory, run:
146+
```bash
147+
npm run link
148+
```
149+
- In this CLI project directory, run:
150+
```bash
151+
npm link @flow-scanner/lightning-flow-scanner-core
152+
```
153+
154+
---
155+
156+
## VSCE to VSX
157+
158+
`lightning-flow-scanner-vsce` was unpublished from the Visual Studio and Open VSX Marketplaces due to a vulnerability stemming from unsafe rule loading. The issue was addressed in [core v5](https://github.com/Flow-Scanner/lightning-flow-scanner-core/releases/tag/v5.1.0). This fork, created on 22/09/2025, emphasizes security and maintainability.
159+
160+
<p><strong>Want to help improve Lightning Flow Scanner? See our <a href="https://github.com/Flow-Scanner/lightning-flow-scanner-core?tab=contributing-ov-file">Contributing Guidelines</a></strong></p>

‎packages/vsx/SECURITY.md‎

Lines changed: 27 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,27 @@
1+
# Security Policy for Lightning Flow Scanner
2+
3+
## Security Practices
4+
5+
- Code is open-source and peer-reviewed by the community.
6+
- Vulnerabilities can be reported privately via [GitHub vulnerability reporting](https://github.com/Flow-Scanner/lightning-flow-scanner-vsx/security).
7+
- Changes to the repository are scanned and reviewed before merging.
8+
9+
## Data Handling
10+
11+
This tool collects zero user data. No credentials, PII, payment info, health data, or user content is ever stored, transmitted, or shared. All analysis runs 100% client-side with no network calls to external services.
12+
13+
We temporarily use metadata (e.g., Flow metadata, timestamps) in-memory only for real-time functionality during your session. This data is never stored, logged, or transmitted and is discarded immediately when the session ends.
14+
15+
**Note:** You may manually save scan results (e.g., reports, CSV, JSON) to your local filesystem. These files are created at your request and remain under your full control. This tool does not access, upload, or retain them.
16+
17+
## Dependencies
18+
19+
We actively track and maintain an up-to-date inventory of all third-party dependencies to ensure security and compatibility. Our dependencies include:
20+
21+
| Package | License | Purpose` |
22+
| ------------------------------- | ------------------------------------------------------------------------------------ | ---------------------------------------------- |
23+
| `convert-array-to-csv` | [MIT](https://github.com/zemirco/convert-array-to-csv/blob/master/LICENSE) | Converts JavaScript arrays into CSV format |
24+
| `lightning-flow-scanner-core` | [MIT](https://github.com/Flow-Scanner/lightning-flow-scanner-core/blob/main/LICENSE.md) | Salesforce Flow scanning utilities |
25+
| `tabulator-tables` | [MIT](https://github.com/olifolkerd/tabulator/blob/master/LICENSE) | Interactive tables and data grids for web apps |
26+
| `uuid` | [MIT](https://github.com/uuidjs/uuid/blob/main/LICENSE.md) | Generates RFC-compliant UUIDs |
27+
| `cosmiconfig` | [MIT](https://github.com/davidtheclark/cosmiconfig/blob/main/LICENSE) | Config file loader for JavaScript/Node |

0 commit comments

Comments
 (0)