The Quality Clouds GitHub Action enables automated code quality analysis directly within your GitHub workflow. Once configured, every push or Pull Request can trigger a Quality Clouds scan, allowing your team to identify quality issues early and enforce Quality Gates before code is merged.

This article explains how to configure the GitHub Action for Salesforce and ServiceNow repositories.

 

Prerequisites #

Before configuring the GitHub Action, ensure you have:

• A Quality Clouds account.
• A valid Quality Clouds API Key.
• A GitHub repository.
• Permission to create or modify GitHub Actions workflows.
• A repository connected to your Quality Clouds organization.

 

If you need an API key, contact your Quality Clouds administrator or refer to the Administering API Keys documentation.

 

Create the GitHub Workflow #

The GitHub integration is configured using a standard GitHub Actions workflow file.

Create the following file in your repository: .github/workflows/qualityclouds.yml

Add the following workflow:

name: QualityClouds

on:
  push:
  pull_request:
  workflow_dispatch:

jobs:
  build:
    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v2

      - name: Quality Clouds Scan
        uses: qualityclouds/action-full-scan@2.0.0
        with:
          mode: cloud
          token: ${{ secrets.QC_API_KEY }}
          review: true
          allIssues: true
          gitHubToken: ${{ secrets.GITHUB_TOKEN }}
          pr_fails_on_blockers: true

 

This workflow automatically launches a Quality Clouds Feature Branch scan whenever:

• Code is pushed to the repository.
• A Pull Request is opened or updated.
• The workflow is manually triggered.

 

How the GitHub Action Works #

Once the workflow has been configured:

1. A developer pushes code or creates a Pull Request.
2. GitHub executes the Quality Clouds Action.
3. Quality Clouds analyzes the proposed changes.
4. The scan results are returned to GitHub.
5. If review mode is enabled, findings are displayed directly in the Pull Request.
6. If Quality Gates are configured, the Pull Request status reflects whether the configured quality requirements have been met.

 

No additional manual steps are required during normal development.

 

Configuration Parameters #

Input	Required	Description
token	Yes	Quality Clouds API key used to connect to the ruleset against which the code will be checked.
mode	Optional	Use cloud to scan the branch where the action is performed. Use local to scan a provided ZIP file. Default is local.
zip_path	Optional	Path to the ZIP file containing the files to scan. Only used in local mode.
codequality	Optional	Generates a code quality JSON with issues. Only used in local mode.
review	Optional	Adds inline pull request comments. Only used in cloud mode.
allIssues	Optional	Shows blockers and non-blockers. Only used in cloud mode.
cloud	Optional	Defines the target platform. Use servicenow for ServiceNow repositories. If not specified, Salesforce is used by default.
gitHubToken	Optional	GitHub token used when review is enabled.
pr_fails_on_blockers	Optional	Determines whether the pull request should be marked as failed when the Quality Gate does not pass.

 

Salesforce configuration #

For Salesforce repositories, the default configuration can be used. If the cloud input is not provided, the scan is treated as a Salesforce scan.

- name: Quality Clouds Salesforce Scan
  uses: qualityclouds/action-full-scan@2.0.0
  with:
    mode: cloud
    token: 'MyGitQCToken'
    review: true
    allIssues: true
    gitHubToken: 'MyGitHubToken'
    pr_fails_on_blockers: true

 

Pull Request Feedback #

When review is enabled, Quality Clouds publishes scan results directly inside the Pull Request.

Depending on the configuration, developers can review:

• Detected issues
• Severity
• File and line number
• Violated best practices
• Documentation links
• Blocker and non-blocker findings

This allows developers to resolve issues without leaving GitHub.

 

Quality Gate Status #

If your organization uses Quality Gates, the GitHub Action validates every scan against the configured quality requirements.

Possible outcomes include:

Passed

The scan completed successfully and all configured Quality Gate conditions were satisfied.

If no Quality Gates have been configured, the workflow also completes successfully.

Failed

The scan completed successfully, but one or more blocking Quality Gate conditions were not met.

If pr_fails_on_blockers is enabled, the Pull Request is marked as failed until the blocking issues have been resolved.

 

Best Practices #

To get the most value from the GitHub integration, we recommend:

• Store the Quality Clouds API Key as a GitHub Secret.
• Enable inline Pull Request reviews (review: true).
• Display all findings during development (allIssues: true).
• Enable Quality Gates to prevent critical issues from being merged.
• Run scans on every Pull Request to provide continuous feedback.

 

Related Integrations #

Quality Clouds can also be integrated into other CI/CD platforms.

Supported options include:

• Copado Integration
• Flosum Integration
• Visual Studio Code Integration
• DevOps Center Integration
• Code Builder Extension

Refer to the corresponding integration guides for platform-specific configuration instructions.

 

Next Steps #

After configuring the GitHub Action:

• Create a Pull Request to verify that the workflow executes successfully.
• Review the scan results directly within GitHub.
• Configure Quality Gates to enforce your organization’s quality standards.
• Learn more about the GitHub development workflow in GitHub Integration Overview.