Salesforce package version creation after resolving the errors

Question

1. We are planning to publish the package to the appexchange security review process before which we have run through a security scan. The package version is 0.1.0-1. After resolving the errors from the checkmarx scan can I build the package with the same version number ie. 0.1.0-1?

2. Also, if we are not able to build a version after resolving errors, why does documentation state that You’re provisioned three Source Code Scanner (Checkmarx) runs per solution version with the security review fee. Because no one is going to run the same version again and again in the checkmarx without resolving the errors. If my understanding is wrong, can you please explain me to correct that?

Answer 1

We are planning to publish the package to the appexchange security review process before which we have run through a security scan. The package version is 0.1.0-1. After resolving the errors from the checkmarx scan can I build the package with the same version number ie. 0.1.0-1?

You'd have to delete the original version, assuming even that is allowed, and the team would know it's not the same 0.1.0-1, because they have package version ID values, not just the version number.

Also, if we are not able to build a version after resolving errors, why does documentation state that You’re provisioned three Source Code Scanner (Checkmarx) runs per solution version with the security review fee. Because no one is going to run the same version again and again in the checkmarx without resolving the errors. If my understanding is wrong, can you please explain me to correct that?

They're not talking about literally 0.1.0-1 being reviewed three times, but rather three distinct chances to fix/scan your code per review before you have to start paying for more scans.