Action Secrets & Variables Updates & Conversion to SF CLI

.github/workflows/issue-branch-creation-handler.yml

@@ -40,11 +40,11 @@ jobs:
         if: steps.branchFilter.outputs.matches == 'true'
         run: |
           echo "${{ secrets.SALESFORCE_JWT_KEY }}" > server.key
-          npx sfdx-cli force:auth:jwt:grant \
-            --clientid ${{ secrets.SALESFORCE_CLIENT_ID }} \
-            --jwtkeyfile server.key \
-            --username ${{ secrets.SALESFORCE_DEVHUB_USERNAME }} \
-            --setdefaultdevhubusername -a DevHub
+          npx sf org login jwt \
+            --client-id ${{ secrets.SALESFORCE_PROD_CLIENT_ID }} \
+            --jwt-key-file server.key \
+            --username ${{ secrets.SALESFORCE_PROD_USERNAME }} \
+            --set-default-dev-hub -a DevHub
           rm server.key
       - name: Extract Branch Name
         if: steps.branchFilter.outputs.matches == 'true'

.github/workflows/push-to-main-handler.yml

@@ -20,6 +20,20 @@ jobs:
         with:
           node-version-file: ".nvmrc"
 
+      - name: Cache Node Modules
+        uses: actions/cache@v3.0.11
+        id: npm_cache_id
+        with:
+          path: node_modules
+          key: ${{ runner.os }}-npm-cache-${{ hashFiles('**/package-lock.json') }}
+          restore-keys: |
+            ${{ runner.os }}-npm-cache-
+            ${{ runner.os }}-
+
+      - name: Install Dependencies
+        if: steps.npm_cache_id.outputs.cache-hit != 'true'
+        run: npm ci
+
       - name: Authorize external workspace
         run: |
           git config --global --add safe.directory /github/workspace
@@ -42,27 +56,32 @@ jobs:
 
       - name: Install profile decompose sfdx plugin
         if: steps.requires-deploy.outputs.changed == '1'
-        run: echo y | npx sfdx-cli plugins:install @rdietrick/sfdx-profile-decompose
+        run: echo y | npx sf plugins:install @rdietrick/sfdx-profile-decompose
 
       - name: Authenticate DevHub
         if: steps.requires-deploy.outputs.changed == '1'
         env:
           SALESFORCE_JWT_KEY: ${{ secrets.SALESFORCE_JWT_KEY }}
         run: |
           echo "${SALESFORCE_JWT_KEY}" > server.key
-          npx sfdx-cli force:auth:jwt:grant --clientid ${{ secrets.SALESFORCE_CLIENT_ID }} --jwtkeyfile server.key --username ${{ secrets.SALESFORCE_DEVHUB_USERNAME}} --setdefaultdevhubusername -a DevHub
-          npx sfdx-cli force:org:display --json -u DevHub > sfdx-auth.json
+          npx sf org login jwt \
+            --client-id ${{ secrets.SALESFORCE_PROD_CLIENT_ID }} \
+            --jwt-key-file server.key \
+            --username ${{ secrets.SALESFORCE_PROD_USERNAME }} \
+            --set-default-dev-hub -a DevHub
+          npx sf org display --json -o DevHub > sfdx-auth.json
 
       - name: Recompose profiles
         if: steps.requires-deploy.outputs.changed == '1' && vars.SALESFORCE_FORMATTED_PROFILES_AND_PERMS == 'false'
         run: |
-          npx sfdx-cli profiles:aggregate
+          npx sf profiles:aggregate
           rm -rf force-app/main/default/profiles/decomposed force-app/main/default/permissionsets/decomposed
 
       - name: Generate Destructive Changes Param
-        if: steps.branchFilter.outputs.matches == 'true' && steps.requires-deploy.outputs.changed == '1' && steps.check_first_deploy.outputs.FIRST_DEPLOY == 'true'
+        if: steps.requires-deploy.outputs.changed == '1'
         id: check_for_destructive_changes
         run: |
+          DESTRUCTIVE_FILES_EXIST=true
           if [ -f destructive-changes/destructiveChangesPre.xml ] && [ -f destructive-changes/destructiveChangesPost.xml ]
           then 
             echo "DESTRUCTIVE_FILES=--predestructivechanges destructive-changes/destructiveChangesPre.xml --postdestructivechanges destructive-changes/destructiveChangesPost.xml" >> $GITHUB_OUTPUT;
@@ -72,13 +91,20 @@ jobs:
           elif [ -f destructive-changes/destructiveChangesPost.xml ]
           then 
             echo "DESTRUCTIVE_FILES=--postdestructivechanges destructive-changes/destructiveChangesPost.xml" >> $GITHUB_OUTPUT;
+          else
+            DESTRUCTIVE_FILES_EXIST=false
+          fi
+          if [ "$DESTRUCTIVE_FILES_EXIST" == "true" ]
+          then
+            RELEASE_DATE=$(TZ=America/Los_Angeles date +'%Y-%m-%d')
+            echo "DESTRUCTIVE_CHANGES_CLEANUP_BRANCH=clean-up-destructive-changes-$RELEASE_DATE" >> $GITHUB_OUTPUT;
           fi
 
       - name: Deploy to Production
         if: steps.requires-deploy.outputs.changed == '1'
         run: |
-          npx sfdx-cli force:source:manifest:create --sourcepath force-app --manifestname temp-deploy-manifest
-          npx sfdx-cli force:source:deploy -u DevHub -x temp-deploy-manifest.xml ${{ steps.check_for_destructive_changes.outputs.DESTRUCTIVE_FILES }} -w 200 -l RunLocalTests
+          npx sf force source manifest create -p force-app -n temp-deploy-manifest
+          npx sf project deploy start -o DevHub -x temp-deploy-manifest.xml ${{ steps.check_for_destructive_changes.outputs.DESTRUCTIVE_FILES }} -w ${{ vars.DEPLOYMENT_TIMEOUT }} -l RunLocalTests --ignore-conflicts
 
       - name: Get Previous Tag
         if: steps.check_release.outputs.IS_RELEASE == 'true' && steps.requires-deploy.outputs.changed == '1'
@@ -121,36 +147,41 @@ jobs:
         if: steps.requires-deploy.outputs.changed == '1'
         run: |
           echo "${SALESFORCE_TEMPLATE_JWT_SECRET_KEY}" > template-server.key
-          npx sfdx-cli force:auth:jwt:grant --clientid ${{ secrets.SALESFORCE_TEMPLATE_CONSUMER_KEY }} --jwtkeyfile template-server.key --username ${{ secrets.SALESFORCE_TEMPLATE_USERNAME}} -a Template --instanceurl https://test.salesforce.com
-          npx sfdx-cli force:org:display --json -u Template > sfdx-auth.json
+          npx sf org login jwt \
+            --client-id ${{ secrets.SALESFORCE_TEMPLATE_CLIENT_ID }} \
+            --jwt-key-file server.key \
+            --username ${{ secrets.SALESFORCE_TEMPLATE_USERNAME }} \
+            --set-default-dev-hub -a DevHub
+          npx sf org display --json -o Template > sfdx-auth.json
         env:
           SALESFORCE_TEMPLATE_JWT_SECRET_KEY: ${{ secrets.SALESFORCE_TEMPLATE_JWT_SECRET_KEY }}
 
       - name: Update Template sandbox
         if: steps.requires-deploy.outputs.changed == '1'
         run: |
-          npx sfdx-cli force:source:manifest:create --sourcepath force-app --manifestname temp-deploy-manifest
-          npx sfdx-cli force:source:deploy -u Template -x temp-deploy-manifest.xml ${{ steps.check_for_destructive_changes.outputs.DESTRUCTIVE_FILES }} -w 200 -l RunLocalTests
+          npx sf force source manifest create -p force-app -n temp-deploy-manifest
+          npx sf project deploy start -o Template -x temp-deploy-manifest.xml ${{ steps.check_for_destructive_changes.outputs.DESTRUCTIVE_FILES }} -w ${{ vars.DEPLOYMENT_TIMEOUT }} -l RunLocalTests --ignore-conflicts
 
-      - name: Create PR with cleaned up destructive changes
-        if: steps.check_release.outputs.IS_RELEASE == 'true' && steps.requires-deploy.outputs.changed == '1'
+      - name: Remove Destructive Change Files
+        if: steps.check_for_destructive_changes.outputs.DESTRUCTIVE_CHANGES_CLEANUP_BRANCH != ''
+        run: |
+          git checkout -b ${{ steps.check_for_destructive_changes.outputs.DESTRUCTIVE_CHANGES_CLEANUP_BRANCH }}
+          git clean -fd
+          rm -rf destructive-changes
+
+      - name: Commit Destructive Change Cleanup
+        if: steps.check_for_destructive_changes.outputs.DESTRUCTIVE_CHANGES_CLEANUP_BRANCH != ''
+        uses: stefanzweifel/git-auto-commit-action@75802d269e7721b5146d08f6063ba3097c55ad2b
+        with:
+          branch: ${{ steps.check_for_destructive_changes.outputs.DESTRUCTIVE_CHANGES_CLEANUP_BRANCH }}
+          commit_message: Clean up destructive changes from release
+
+      - name: Create Destructive Change Cleanup Pull Request
+        if: steps.check_for_destructive_changes.outputs.DESTRUCTIVE_CHANGES_CLEANUP_BRANCH != ''
         env:
-          PAT: ${{ secrets.SCOPED_PAT }}
-          USER_EMAIL: ${{ secrets.BOT_USER_EMAIL }}
-          USER_NAME: ${{ secrets.BOT_USER_NAME }}
+          DESTRUCTIVE_CHANGE_CLEANUP_BRANCH: ${{ steps.check_for_destructive_changes.outputs.DESTRUCTIVE_CHANGES_CLEANUP_BRANCH }}
+          GH_TOKEN: ${{ secrets.SCOPED_PAT }}
         run: |
-          if [ -f destructive-changes/destructiveChanges.xml ] || [ -f destructive-changes/destructiveChangesPre.xml ] || [ -f destructive-changes/destructiveChangesPost.xml ]
-          then 
-            RELEASE_DATE=$(date +'%Y-%m-%d')
-            echo $PAT | gh auth login --with-token
-            git config --global user.email "$USER_EMAIL"
-            git config --global user.name "$USER_NAME"
-
-            git checkout -b clean-up-destructive-changes-"$RELEASE_DATE" && git push --set-upstream origin clean-up-destructive-changes-"$RELEASE_DATE"
-            git rm -r destructive-changes
-            git commit -m "Clean up destructive changes from release" && git push
-
-            gh pr create --title "Clean up destructive changes" \
-            --body "Please merge \`clean-up-destructive-changes-$RELEASE_DATE\` into \`main\` and delete \`clean-up-destructive-changes-$RELEASE_DATE\`." \
-            -H clean-up-destructive-changes-"$RELEASE_DATE" -B main
-          fi
+          gh pr create --title "Clean up destructive changes" \
+            --body "Please merge \`$DESTRUCTIVE_CHANGE_CLEANUP_BRANCH\` into \`main\` and delete \`$DESTRUCTIVE_CHANGE_CLEANUP_BRANCH\`." \
+            -H "$DESTRUCTIVE_CHANGE_CLEANUP_BRANCH" -B main

.github/workflows/release-branch-pull-request-handler.yml

@@ -45,8 +45,8 @@ jobs:
       - name: Recompose Profiles
         if: steps.branchFilter.outputs.matches == 'true' && steps.requires-deploy.outputs.changed == '1' && vars.SALESFORCE_FORMATTED_PROFILES_AND_PERMS == 'false'
         run: |
-          echo y | npx sfdx-cli plugins:install @rdietrick/sfdx-profile-decompose
-          npx sfdx-cli profiles:aggregate
+          echo y | npx sf plugins:install @rdietrick/sfdx-profile-decompose
+          npx sf profiles:aggregate
           rm -rf force-app/main/default/profiles/decomposed force-app/main/default/permissionsets/decomposed
       - name: Check First Deploy
         if: vars.GENERATE_RELEASE == 'true' && steps.branchFilter.outputs.matches == 'true'
@@ -80,14 +80,14 @@ jobs:
           echo "$SFDX_AUTH_SECRET_KEY" >> key.txt
           age --decrypt -i key.txt ${LOGIN_ENC_FILE}.age > ${LOGIN_ENC_FILE}
           rm key.txt
-          npx sfdx-cli force:auth:sfdxurl:store -f ${LOGIN_ENC_FILE} -a is${{ steps.branchFilter.outputs.issueNumber }}uat
+          npx sf force auth sfdxurl store -f ${LOGIN_ENC_FILE} -a is${{ steps.branchFilter.outputs.issueNumber }}uat
       - name: Deploy Source to Sandbox
         if: steps.branchFilter.outputs.matches == 'true' && steps.requires-deploy.outputs.changed == '1'
         env:
           LOGIN_ENC_FILE: auth/sandbox-login-url-${{ steps.branchFilter.outputs.branchName }}-uat.txt
         run: |
-          npx sfdx-cli force:source:manifest:create --sourcepath force-app --manifestname temp-deploy-manifest
-          npx sfdx-cli force:source:deploy -u is${{ steps.branchFilter.outputs.issueNumber }}uat -x temp-deploy-manifest.xml ${{ steps.check_for_destructive_changes.outputs.DESTRUCTIVE_FILES }} -w ${{ vars.DEPLOYMENT_TIMEOUT }} -l RunLocalTests
+          npx sf force source manifest create -p force-app -n temp-deploy-manifest
+          npx sf project deploy start -o is${{ steps.branchFilter.outputs.issueNumber }}uat -x temp-deploy-manifest.xml ${{ steps.check_for_destructive_changes.outputs.DESTRUCTIVE_FILES }} -w ${{ vars.DEPLOYMENT_TIMEOUT }} -l RunLocalTests --ignore-conflicts
       - name: Init Release Notes
         id: init-release-notes
         if: vars.GENERATE_RELEASE == 'true' && steps.check_first_deploy.outputs.FIRST_DEPLOY == 'true' && steps.branchFilter.outputs.matches == 'true'

.nvmrc

@@ -1 +1 @@
-v14.20.0
+v20.7.0

docs/Getting Started.md

@@ -22,7 +22,7 @@ These step-by-step instructions will walk you through your initial project setup
 
 1. [Create a new repository](https://github.com/new?owner=&template_name=octoforce-actions&template_owner=github) from this repo. Check out your new repo locally.
 2. If you haven't already, [enable DevHub](https://help.salesforce.com/s/articleView?id=sf.sfdx_setup_enable_devhub.htm&type=5) in your production Salesforce org. Workflows in this repo will use your org's DevHub to provision development and test sandboxes for your project.
-3. Create (or repurpose an existing) an admin user in your production org that will be used for deployments and sandbox provisioning. Store the username of this user in a repo secret named `SALESFORCE_DEVHUB_USERNAME`.
+3. Create (or repurpose an existing) an admin user in your production org that will be used for deployments and sandbox provisioning. Store the username of this user in a repo secret named `SALESFORCE_PROD_USERNAME`.
 4. Create a [private key and certificate for use in the app you'll create in the next step](https://developer.salesforce.com/docs/atlas.en-us.sfdx_dev.meta/sfdx_dev/sfdx_dev_auth_key_and_cert.htm)
 5. Create a connected app in your production Salesforce org for the octoforce CI/CD application that will be provisioning sandboxes and deploying to production.
     - Name your app 'octoforce' or something similar.
@@ -35,10 +35,10 @@ These step-by-step instructions will walk you through your initial project setup
     - Grant the "system administrator" profile (or whichever profile the user designated in step 3 is assigned) access to the new connected app
     - Store the following secrets in your repo:
       - `SALESFORCE_JWT_KEY` - use the contents of the server.key file generated in step 4 above
-      - `SALESFORCE_CLIENT_ID` - use the Consumer Key of the connected app you just created
+      - `SALESFORCE_PROD_CLIENT_ID` - use the Consumer Key of the connected app you just created
 6. Clone your production org to create a sandbox named "template". This is the org that will be cloned to create your dev and uat sandboxes.
 7. When your newly created template sandbox is provisioned, configure it identically to how you did in step 5 above. You can use the same certificate and key pair or generate new ones. Create two repo secrets with the following values from your template sandbox:
-    - `SALESFORCE_TEMPLATE_CONSUMER_KEY` - use the consumer key of the octoforce connected app replicated from production to your template sandbox
+    - `SALESFORCE_TEMPLATE_CLIENT_ID` - use the consumer key of the octoforce connected app replicated from production to your template sandbox
     - `SALESFORCE_TEMPLATE_JWT_SECRET_KEY` - use the value of the server.key file related to your template certificate
     - `SALESFORCE_TEMPLATE_USERNAME` - use the username of the salesforce admin user replicated in your template sandbox
 9. [Follow these directions](https://github.com/github/octoforce-actions/blob/add-setup-docs/docs/SFDX%20Auth%20URLs%20%26%20Encryption.md) to generate and store your age encryption keys. Be sure to store the generated private key in the `SFDX_AUTH_SECRET_KEY` repo secret and to replace the contents of `auth/public-key.txt`.
@@ -78,20 +78,16 @@ The following secrets are required to be set in the repository settings:
   - This is a personal access token with the `repo` scope. This is used to checkout the repository and push any changes.
 - `SALESFORCE_JWT_KEY`
   - This is the private key used to generate the JWT token. This is used to authenticate with Salesforce production.
-- `SALESFORCE_CLIENT_ID`
+- `SALESFORCE_PROD_CLIENT_ID`
   - This is the client ID used to generate the JWT token. This is used to authenticate with Salesforce production.
-- `SALESFORCE_DEVHUB_USERNAME`
+- `SALESFORCE_PROD_USERNAME`
   - This is the username of the admin user of your DevHub/production org. This is used to authenticate with Salesforce production.
-- `SALESFORCE_TEMPLATE_CONSUMER_KEY`
+- `SALESFORCE_TEMPLATE_CLIENT_ID`
   - This is the consumer key of the template org. This is used to authenticate with the template sandbox.
 - `SALESFORCE_TEMPLATE_USERNAME`
   - This is the username of the template org. This is used to authenticate with the template sandbox.
 - `SALESFORCE_TEMPLATE_JWT_SECRET_KEY`
   - This is the private key used to generate the JWT token. This is used to authenticate with the template sandbox.
-- `BOT_USER_EMAIL`
-  - This is the email of the GitHub bot user. This is used to create pull requests against the main branch.
-- `BOT_USER_NAME`
-  - This is the GitHub username of the bot user. This is used to create pull requests against the main branch.
 - `SFDX_AUTH_SECRET_KEY`
   - This is the age private key used to encrypt sfdx auth URLs. The encrypted sfdx auth URLs are required to deploy pull requests to UAT sandboxes and are generated by running `scripts/sandbox_auth`. Please see [SFDX Auth URLs & Encryption.md](SFDX%20Auth%20URLs%20%26%20Encryption.md) for more information.