ruleset.xml

<?xml version="1.0"?>
<ruleset name="Oppinionated PMD Ruleset" xmlns="http://pmd.sourceforge.net/ruleset/2.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://pmd.sourceforge.net/ruleset/2.0.0 https://pmd.sourceforge.io/ruleset_2_0_0.xsd">

    <description>Oppinionated PMD Ruleset</description>

    <!-- IGNORE EXTERNAL LIBS -->
    <include-pattern>.*/force-app/main/default/.*</include-pattern>


    <!-- STANDARD RULES -->  
    
    <rule ref="category/apex/security.xml">
        <priority>1</priority>
    </rule>  

    <rule ref="category/apex/bestpractices.xml">      
        <priority>2</priority>   
        
        <exclude name="ApexUnitTestClassShouldHaveRunAs" /> <!-- No smart person does that -->
        <exclude name="ApexAssertionsShouldIncludeMessage" /> <!-- Better have a focused well named method -->
        <exclude name="ApexUnitTestClassShouldHaveAsserts" /> <!-- Configured below -->
    </rule>

    <rule ref="category/apex/bestpractices.xml/ApexUnitTestClassShouldHaveAsserts" message="Apex unit test classes should have at least one System.assert() or assertEquals() or AssertNotEquals() call">
        <priority>3</priority>
        <properties>
            <property name="additionalAssertMethodPattern" value="((System\.Assert|Assert|Asserts)\.\w+|verify\w+)"/>
        </properties>
    </rule>
    
    <rule ref="category/apex/design.xml">      
        <priority>2</priority>  

        <!-- Note: Cognitive Complexity covers all of that better -->     
        <exclude name="AvoidDeeplyNestedIfStmts" />
        <exclude name="StdCyclomaticComplexity" />
        <exclude name="CyclomaticComplexity" />
        <exclude name="ExcessiveClassLength" />
        <exclude name="ExcessiveParameterList" />
        <exclude name="ExcessivePublicCount" />
        <exclude name="TooManyFields" />
        <exclude name="NcssConstructorCount" />
        <exclude name="NcssMethodCount" />
        <exclude name="NcssTypeCount" />
    </rule>

    <rule ref="category/apex/performance.xml">      
        <priority>2</priority>   

        <!-- Note: All below should be covered by OperationWithLimitsInLoop -->     
        <exclude name="AvoidDmlStatementsInLoops" />    
        <exclude name="AvoidSoqlInLoops" />    
        <exclude name="AvoidSoslInLoops" />    

        <!-- Improved by AvoidProductionDebugLogs below -->
        <exclude name="AvoidDebugStatements" />   
    </rule>

    <rule name="AvoidDebugStatements" language="apex" message="Avoid leaving System.debug() statments in code as they negativly influence performance." class="net.sourceforge.pmd.lang.rule.xpath.XPathRule">
        <priority>2</priority>   
        <properties>
            <property name="xpath"><value><![CDATA[
                //MethodCallExpression[lower-case(@FullMethodName)='system.debug'][count(*)=2]
            ]]></value></property>
        </properties>
    </rule>

    <rule ref="category/apex/codestyle.xml">      
        <priority>2</priority>  
    </rule>

    <rule ref="category/apex/codestyle.xml/ClassNamingConventions">
        <priority>2</priority> 
        <properties>
            <property name="testClassPattern" value="[A-Z][a-zA-Z0-9_]*" />
            <property name="abstractClassPattern" value="[A-Z][a-zA-Z0-9]*" />
            <property name="classPattern" value="[A-Z][a-zA-Z0-9]*" />
            <property name="interfacePattern" value="[A-Z][a-zA-Z0-9]*" />
            <property name="enumPattern" value="[A-Z][a-zA-Z0-9]*" />
        </properties>
    </rule>  

    <rule ref="category/apex/errorprone.xml">      
        <priority>2</priority>  
    </rule>


    <!-- CUSTOM RULES -->

    <!-- Apex Rules -->

    <rule name="CommentsAreAnExcuseForBadCodeAndTests" language="apex" message="Comments are often an excuse for bad code and tests" class="net.sourceforge.pmd.lang.rule.xpath.XPathRule">
        <priority>3</priority>
        <properties>
            <property name="xpath"><value><![CDATA[
                //FormalComment
            ]]></value></property>
        </properties>
    </rule>

    <rule name="UnneedUseIfThisReducesReadability" language="apex" message="Unneeded use of this reduces readability" class="net.sourceforge.pmd.lang.rule.xpath.XPathRule">
        <priority>3</priority>
        <properties>
            <property name="xpath"><value><![CDATA[
                //ThisVariableExpression[
                    ancestor::ReferenceExpression[ancestor::MethodCallExpression] or
                    ancestor::AssignmentExpression/VariableExpression[1][
                        @Image != following-sibling::VariableExpression[1]/@Image
                    ]
                ]
            ]]></value></property>
        </properties>
    </rule>

    <rule name="WhatYouReturnCallItResultAndInitItFirst" language="apex" message="What you return call it result and declare it in the first line" class="net.sourceforge.pmd.lang.rule.xpath.XPathRule">
        <priority>3</priority>
        <properties>
            <property name="xpath"><value><![CDATA[
                //ReturnStatement[
                    lower-case(@Image) != 'result' 
                    and
                    ancestor::Method[
                        @Synthetic = false() 
                        and 
                        lower-case(@ReturnType)!='void'
                    ] 
                    and
                    preceding-sibling::VariableDeclarationStatements/VariableDeclaration[1][@Image != 'result'
                ]]
            ]]></value></property>
        </properties>
    </rule>

    <rule name="NullValueCheckBeforeEmptyCheck" language="apex" message="Apex code must check != null before .isEmpty()" class="net.sourceforge.pmd.lang.rule.xpath.XPathRule">
        <priority>2</priority>
        <properties>
            <property name="xpath"><value><![CDATA[
                //BooleanExpression[@Op="&&"][
                    child::*[2][
                    self::BooleanExpression[@Op="!="][
                        child::*[1][self::VariableExpression] and
                        child::*[2][self::LiteralExpression[@LiteralType="NULL"]]
                    ]
                    ]
                ]
            ]]></value></property>
        </properties>
    </rule>

    <!-- Metadata XML Rules -->

    <rule name="BumpApiVersion" language="xml" message="Metadata should use the latest API version." class="net.sourceforge.pmd.lang.rule.xpath.XPathRule">
        <priority>3</priority>
        <properties>
            <property name="xpath"><value><![CDATA[
                //apiVersion/text[number(@Image) < 50]
            ]]></value></property>
        </properties>
    </rule>

    <!-- Flow Rules -->

    <rule name="DMLStatementInFlowLoop" language="xml" message="DML Operations shouldn't be done inside of Flow loops" class="net.sourceforge.pmd.lang.rule.xpath.XPathRule">
        <priority>2</priority>
        <properties>
            <property name="xpath"><value><![CDATA[
                    //Flow/loops//targetReference/text[@Image=//Flow/(recordCreates|recordDeletes|recordUpdates)/name/text/@Image]
            ]]></value></property>
        </properties>
    </rule>

    <!-- Custom Objects / Fields Rules -->

    <rule name="MetadataRequiresDescription" language="xml" message="Add a description to explain custom metadata" class="net.sourceforge.pmd.lang.rule.xpath.XPathRule">
        <priority>2</priority>
        <properties>
            <property name="xpath"><value><![CDATA[
                    //(CustomObject | CustomField)[not(description)]
            ]]></value></property>
        </properties>
    </rule>

    <!-- Profile and Permission Set Rules -->

    <rule name="ModifyOrViewAllOnPermSet" language="xml" message="Allowing this user permission can give access and ability to modify sensitive data." class="net.sourceforge.pmd.lang.rule.xpath.XPathRule">
        <priority>1</priority>
        <properties>
            <property name="xpath"><value><![CDATA[
                //PermissionSet/userPermissions[ name/text[@Image='ModifyAllData' or @Image='ViewAllData'] and enabled/text[@Image='true'] ]
                ]]> </value>
            </property>
        </properties>
    </rule>

    <rule name="ModifyOrViewAllOnSysAdminProfile" language="xml" message="Only Admins can view and modify all data, if any other profile get these permissions, they could manipulate records that shouldn't" class="net.sourceforge.pmd.lang.rule.xpath.XPathRule">
        <priority>1</priority>
        <properties>
            <property name="xpath"><value><![CDATA[
                //Profile/userPermissions[ name/text[@Image='ModifyAllData' or @Image='ViewAllData'] and enabled/text[@Image='true'] and pmd:fileName() != 'System Administrator' ]
                ]]> </value>
            </property>
        </properties>
    </rule>

    <rule name="ManageUsersByNonSysAdmins" language="xml" message="Managing users need to be limited to System Administrator Profile only." class="net.sourceforge.pmd.lang.rule.xpath.XPathRule">
        <priority>1</priority>
        <properties>
            <property name="xpath"><value><![CDATA[
                //Profile/userPermissions[ pmd:fileName() != 'System Administrator' and name/text[@Image='ManageUsers'] ]
                ]]> </value>
            </property>
        </properties>
    </rule>

    <rule name="ViewSetupByNonSysAdmins" language="xml" message="Exposing the setup menu to non-authorized users." class="net.sourceforge.pmd.lang.rule.xpath.XPathRule">
        <priority>1</priority>
        <properties>
            <property name="xpath"><value><![CDATA[
                //Profile/userPermissions[ pmd:fileName() != 'System Administrator' and enabled/text[@Image='true'] and name/text[@Image='ViewSetup'] ]
                ]]> </value>
            </property>
        </properties>
    </rule>
</ruleset>