How to baseline the code analyzer

Turning on static analysis in a project that already has years of code lights up hundreds of existing violations at once. You do not have to fix them all before the check can pass — you baseline them: record the current counts so npm run lint fails only on new violations, then ratchet the counts down as you clean up. This is mostly a brownfield concern; a greenfield project starts with an empty baseline and never needs it.

Create the baseline

From the project root:

npm run lint:createbaseline

This scans the whole workspace with suppressions turned off (so every violation is counted), tallies them per folder, per rule, and writes the result into the managed block of code-analyzer/code-analyzer.yml:

suppressions:
    disable_suppressions: false
    # >>> GENERATED BASELINE - managed by `npm run lint:createbaseline`; do not edit by hand >>>
    "force-app/main/default/classes/":
        - rule_selector: "pmd:ApexDoc"
          max_suppressed_violations: 42
    # <<< END GENERATED BASELINE <<<

Each entry is a cap: that folder may carry up to that many violations of that rule. Review the diff and commit code-analyzer/code-analyzer.yml.

Ratchet the caps down

After fixing real violations, re-run npm run lint:createbaseline and commit the smaller caps. The Update Code Analyzer Baseline custom pipeline does the same on a schedule against the default branch. Why the caps only ever tighten: lint failures are measured against a baseline.

Verify

npm run lint

Right after baselining this passes (every existing violation is within its cap). Introduce a new violation and it fails, naming the folder and rule that went over.

The violation table can name the wrong file

Caps count violations without identity, so the table may show a pre-existing violation in a file you never touched. Read the Likely cause block at the end of the run, not the table — see how to read a rejected commit.

Do not re-baseline to hide new violations

Regenerating the baseline raises the caps to whatever is currently there — including anything you just introduced. Baseline on adoption and after genuine fixes, never to make a red run go green. And never hand-edit the managed block; it is regenerated wholesale.