Metadata governance and package dependencies

These checks compare your metadata with a governance policy you write, and check how installed managed packages are used.

vulkro-sf scan ./force-app

Policy file

The governance checks read .vulkro-sf/metadata-governance.yaml at the project root. Set VULKRO_SF_GOVERNANCE_FILE to use another path (for example a shared policy in CI). Components not listed are not governed, and with no file the SF-META-GOV checks do not run.

components:
  - name: Legacy_Account_Sync   # API name (case-insensitive)
    owner: platform-team
    review_by: 2026-03-01
    deprecated: true
  - name: Invoice__c
    owner: billing-team

# Optional: every component of these kinds must have an owner.
require_owner_for:
  - apex-class
  - flow

Checks

Rule ID	What it finds	Fix
SF-META-GOV-001	A listed component with an empty `owner`, or a component of a `require_owner_for` kind with no entry.	Name an owner (person, team or list) in the policy.
SF-META-GOV-002	A component past its `review_by` date.	Review it and move the date, or retire it.
SF-META-GOV-003	A component marked `deprecated: true` that is still referenced. Lists the callers.	Migrate each caller, then remove it.
SF-PKG-DEP-001	An installed managed package with no detected use from your metadata.	Rule out dynamic use (dynamic invocation, namespace in a SOQL string, external calls), then uninstall in a sandbox first.
SF-PKG-DEP-002	A namespaced managed-package component carried in the project that nothing in your own metadata uses.	Confirm there is no dynamic or live-org-only use before removing it.

Governance findings carry the component type, API name, owner and review date. Package findings carry the namespace, publisher and the affected components.

Policy file​

Checks​

Policy file

Checks