ruleset.xml

<?xml version="1.0"?>
<ruleset name="Opinionated PMD Ruleset" xmlns="http://pmd.sourceforge.net/ruleset/2.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://pmd.sourceforge.net/ruleset/2.0.0 https://pmd.sourceforge.io/ruleset_2_0_0.xsd">

    <description>Opinionated PMD Ruleset</description>

    <!-- STANDARD RULES -->  
    
    <rule ref="category/apex/security.xml">
        <priority>1</priority>
        <!-- All are good and not controversial -->
    </rule>  
    
    <rule ref="category/apex/bestpractices.xml">      
        <priority>2</priority>   
        
        <exclude name="ApexUnitTestClassShouldHaveRunAs" /> <!-- No smart person does that -->
        <exclude name="ApexAssertionsShouldIncludeMessage" /> <!-- Better have a focused well named method -->
        <exclude name="ApexUnitTestClassShouldHaveAsserts" /> <!-- Configured below -->
    </rule>

    <rule ref="category/apex/bestpractices.xml/ApexUnitTestClassShouldHaveAsserts" message="Apex unit test classes should have at least one System.assert() or assertEquals() or AssertNotEquals() call">
        <priority>3</priority>
        <properties>
            <property name="additionalAssertMethodPattern" value="((System\.Assert|Assert|Asserts)\.\w+|verify\w+)"/>
        </properties>
    </rule>
    
    <rule ref="category/apex/design.xml">      
        <priority>2</priority>  

        <!-- Note: Cognitive Complexity covers all of that better -->     
        <exclude name="AvoidDeeplyNestedIfStmts" />
        <exclude name="StdCyclomaticComplexity" />
        <exclude name="CyclomaticComplexity" />
        <exclude name="ExcessiveClassLength" />
        <exclude name="ExcessiveParameterList" />
        <exclude name="ExcessivePublicCount" />
        <exclude name="TooManyFields" />
        <exclude name="NcssConstructorCount" />
        <exclude name="NcssMethodCount" />
        <exclude name="NcssTypeCount" />
    </rule>

    <rule ref="category/apex/performance.xml">      
        <priority>2</priority>   

        <!-- Note: All below should be covered by OperationWithLimitsInLoop -->     
        <exclude name="AvoidDmlStatementsInLoops" />    
        <exclude name="AvoidSoqlInLoops" />    
        <exclude name="AvoidSoslInLoops" />    

        <!-- Improved by AvoidProductionDebugLogs below -->
        <exclude name="AvoidDebugStatements" />   
    </rule>

    <rule name="AvoidProductionDebugLogs" language="apex" message="Avoid leaving System.debug() statments in code as they negativly influence performance." class="net.sourceforge.pmd.lang.rule.XPathRule">
        <priority>2</priority>   
        <properties>
            <property name="version" value="2.0"/>
            <property name="xpath">
                <value><![CDATA[
                //MethodCallExpression[lower-case(@FullMethodName)='system.debug'][count(*)=2]
                ]]></value>
            </property>
        </properties>
    </rule>

    <rule ref="category/apex/codestyle.xml">      
        <priority>2</priority>  
        <!-- Note: All are super crucial for readable, maintainable code -->     
    </rule>

    <rule ref="category/apex/errorprone.xml">      
        <priority>2</priority>  
        <!-- Note: Stupid category but I think everything in there is valid and a 2 -->     
    </rule>

    <!-- CUSTOM RULES -->

    <!-- Apex Rules -->

    <rule name="NullValueCheckBeforeEmptyCheck" language="apex" message="Apex code must check != null before .isEmpty()" class="net.sourceforge.pmd.lang.rule.XPathRule">
        <priority>2</priority>
        <properties>
            <property name="version" value="2.0"/>
            <property name="xpath">
                <value><![CDATA[
                //BooleanExpression[@Op="&&"][
                    child::*[2][
                    self::BooleanExpression[@Op="!="][
                        child::*[1][self::VariableExpression] and
                        child::*[2][self::LiteralExpression[@LiteralType="NULL"]]
                    ]
                    ]
                ]
                ]]></value>
            </property>
        </properties>
    </rule>

    <!-- Metadata XML Rules -->

    <rule name="BumpApiVersion" language="xml" message="Metadata should use the latest API version." class="net.sourceforge.pmd.lang.rule.XPathRule">
        <priority>3</priority>
        <properties>
            <property name="version" value="2.0"/>
            <property name="xpath">
                <value><![CDATA[
                //apiVersion/text[number(@Image) < 50]
                ]]></value>
            </property>
        </properties>
    </rule>

    <!-- Flow Rules -->

    <rule name="DMLStatementInFlowLoop" language="xml" message="DML Operations shouldn't be done inside of Flow loops" class="net.sourceforge.pmd.lang.rule.XPathRule">
        <priority>2</priority>
        <properties>
            <property name="version" value="2.0"/>
            <property name="xpath">
                <value><![CDATA[
                    //Flow/loops//targetReference/text[@Image=//Flow/(recordCreates|recordDeletes|recordUpdates)/name/text/@Image]
                ]]></value>
            </property>
        </properties>
    </rule>

    <!-- Custom Objects / Fields Rules -->

    <rule name="MetadataRequiresDescription" language="xml" message="Add a description to explain custom metadata" class="net.sourceforge.pmd.lang.rule.XPathRule">
        <priority>2</priority>
        <properties>
            <property name="version" value="2.0"/>
            <property name="xpath">
                <value><![CDATA[
                    //*[self::CustomObject or self::CustomField][not(description)]
                ]]></value>
            </property>
        </properties>
    </rule>


    <!-- Profile and Permission Set Rules -->

    <rule name="ModifyOrViewAllOnSysAdminProfile" language="xml" message="Only Admins can view and modify all data, if any other profile get these permissions, they could manipulate records that shouldn't" class="net.sourceforge.pmd.lang.rule.XPathRule">
        <priority>1</priority>
        <properties>
            <property name="version" value="2.0"/>
            <property name="xpath">
                <value><![CDATA[
                //Profile/userPermissions[ name/text[@Image='ModifyAllData' or @Image='ViewAllData'] and enabled/text[@Image='true'] and pmd:fileName() != 'System Administrator' ]
                ]]> </value>
            </property>
        </properties>
    </rule>

    <rule name="ModifyOrViewAllOnPermSet" language="xml" message="Allowing this user permission can give access and ability to modify sensitive data." class="net.sourceforge.pmd.lang.rule.XPathRule">
        <priority>1</priority>
        <properties>
            <property name="version" value="2.0"/>
            <property name="xpath">
                <value><![CDATA[
                //PermissionSet/userPermissions[ name/text[@Image='ModifyAllData' or @Image='ViewAllData'] and enabled/text[@Image='true'] ]
                ]]> </value>
            </property>
        </properties>
    </rule>

    <rule name="ManageUsersByNonSysAdmins" language="xml" message="Managing users need to be limited to System Administrator Profile only." class="net.sourceforge.pmd.lang.rule.XPathRule">
        <priority>1</priority>
        <properties>
            <property name="version" value="2.0"/>
            <property name="xpath">
                <value><![CDATA[
                //Profile/userPermissions[ pmd:fileName() != 'System Administrator' and name/text[@Image='ManageUsers'] ]
                ]]> </value>
            </property>
        </properties>
    </rule>

    <rule name="ViewSetupByNonSysAdmins" language="xml" message="Exposing the setup menu to non-authorized users." class="net.sourceforge.pmd.lang.rule.XPathRule">
        <priority>1</priority>
        <properties>
            <property name="version" value="2.0"/>
            <property name="xpath">
                <value><![CDATA[
                //Profile/userPermissions[ pmd:fileName() != 'System Administrator' and enabled/text[@Image='true'] and name/text[@Image='ViewSetup'] ]
                ]]> </value>
            </property>
        </properties>
    </rule>

    <!-- Org Setting Rules -->

    <rule name="TooLongSessionTimeout" language="xml" message="Allowing access to an inactive session for more than 12 hours is a security risk." class="net.sourceforge.pmd.lang.rule.XPathRule">
        <properties>
            <property name="version" value="2.0"/>
            <property name="xpath">
                <value><![CDATA[
                //SecuritySettings/sessionTimeout[ text[@Image='24 hours of inactivity'] or text[@Image='12 hours of inactivity'] ]
                ]]> </value>
            </property>
        </properties>
    </rule>

    <rule name="PasswordsNeverExpire" language="xml" message="Passwords need to expire every 90 days for security." class="net.sourceforge.pmd.lang.rule.XPathRule">
        <properties>
            <property name="version" value="2.0"/>
            <property name="xpath">
                <value><![CDATA[
                //SecuritySettings/passwordPolicies/expiration[ text[@Image=('Never', 'SixMonths', 'OneYear')] ]
                ]]> </value>
            </property>
        </properties>
    </rule>
</ruleset>