Here is the scenario: We are trying to "automate" our Salesforce development with Azure Pipelines. Since Salesforce is very unique when it comes to deploying changes, I have tried to create a Pipeline that would be manually run to save any change made into a Salesforce Sandbox back to a Branch. The goal is to eventually merge these changes into other branches and deploy them into other Salesforce environments.

We are using the the SFDX cli for such tasks within the image. Below is a copy of my yml file:

- developer

  vmImage: 'ubuntu-latest'

- group: DeveloperVariables

- checkout: self
  persistCredentials: true

- task: DownloadSecureFile@1
    secureFile: server.key
- task: Bash@3
    workingDirectory: ''
    targetType: inline
    script: |
      wget https://developer.salesforce.com/media/salesforce-cli/sfdx-linux-amd64.tar.xz;
      mkdir sfdx;
      tar xJf sfdx-linux-amd64.tar.xz -C sfdx --strip-components 1;
      sudo ./sfdx/install;
      sfdx force:auth:jwt:grant --clientid $CONSUMER_KEY --jwtkeyfile $DOWNLOADSECUREFILE_SECUREFILEPATH --username $USERNAME --setalias developer;
      sfdx force:mdapi:retrieve -u $USERNAME -k src/package.xml -r .;
      unzip unpackaged.zip;
      cd unpackaged;
      git config --global user.email "[email protected]"
      git config --global user.name "Test User"
      git checkout -t origin/developer;
      git add .;
      git status;
      echo "This is me: ";
      git commit -m "Retrieved latest Developer SB changes!"
      echo "Pushing now!!!";
      git push --set-upstream origin HEAD:developer;

As per Microsoft's documentation found here, we need to make sure we grant permissions to the build service. All the permissions have been granted as requested but we still can't get it to work.

Below is the copy of the logs generated when we run the Pipeline:

enter image description here

##[section]Starting: Bash
Task         : Bash
Description  : Run a Bash script on macOS, Linux, or Windows
Version      : 3.151.3
Author       : Microsoft Corporation
Help         : https://docs.microsoft.com/azure/devops/pipelines/tasks/utility/bash
Generating script.
========================== Starting Command Output ===========================
[command]/bin/bash --noprofile --norc /home/vsts/work/_temp/9d534f54-57b8-44a0-8d10-2e3d8c334bbf.sh
--2019-08-13 13:27:00--  https://developer.salesforce.com/media/salesforce-cli/sfdx-linux-amd64.tar.xz
Resolving developer.salesforce.com (developer.salesforce.com)...
Connecting to developer.salesforce.com (developer.salesforce.com)||:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 19686680 (19M) [application/x-tar]
Saving to: ‘sfdx-linux-amd64.tar.xz’

     0K .......... .......... .......... .......... ..........  0% 25.6M 1s
    50K .......... .......... .......... .......... ..........  0% 27.2M 1s
 19150K .......... .......... .......... .......... .......... 99%  171M 0s
 19200K .......... .......... .....                           100%  247M=0.1s

2019-08-13 13:27:00 (133 MB/s) - ‘sfdx-linux-amd64.tar.xz’ saved [19686680/19686680]

sfdx installed to ‌4m/usr/local/bin/sfdx‌
sfdx-cli/7.8.1-8f830784cc linux-x64 node-v10.15.3
(node:3433) [EACCES] Error Plugin: sfdx-cli: EACCES: permission denied, open '/home/vsts/.cache/sfdx/lastrun'
module: @oclif/[email protected]
task: runHook init
plugin: sfdx-cli
root: /usr/local/lib/sfdx
See more details with DEBUG=*
Successfully authorized [email protected] with org ID 00D560340009rbvEAA
(node:3469) [EACCES] Error Plugin: sfdx-cli: EACCES: permission denied, open '/home/vsts/.cache/sfdx/lastrun'
module: @oclif/[email protected]
task: runHook init
plugin: sfdx-cli
root: /usr/local/lib/sfdx
See more details with DEBUG=*
this.retrieveTargetPath: /home/vsts/work/1/s
Retrieving source...

=== Status
Status:  InProgress
jobid:  09S56000001G6fmEAC
=== Result
Status:  Succeeded
jobid:  09S56000001G6fmEAC

Wrote retrieve zip to /home/vsts/work/1/s/unpackaged.zip.
Archive:  unpackaged.zip
  inflating: unpackaged/settings/Account.settings  
  inflating: unpackaged/pathAssistants/TMG_CBE_Path.pathAssistant  
  inflating: unpackaged/package.xml  
Switched to a new branch 'developer'
Branch 'developer' set up to track remote branch 'developer' from 'origin'.
On branch developer
Your branch is up to date with 'origin/developer'.

Changes to be committed:
  (use "git reset HEAD <file>..." to unstage)

    new file:   approvalProcesses/Billing_Item__c.Billable_Item_Less_than_0.approvalProcess
    new file:   workflows/Touchpoint__c.workflow
    new file:   workflows/User.workflow

Untracked files:
  (use "git add <file>..." to include in what will be committed)


This is me: 

[developer f8ea8ed] Retrieved latest Developer SB changes!
 1332 files changed, 452246 insertions(+)
 create mode 100644 unpackaged/approvalProcesses/Billing_Item__c.Billable_Item_Less_than_0.approvalProcess
 create mode 100644 unpackaged/workflows/Touchpoint__c.workflow
 create mode 100644 unpackaged/workflows/User.workflow
Pushing now!!!
remote: 001f# service=git-receive-pack
remote: 0000000000aaTF401027: You need the Git 'GenericContribute' permission to perform this action. Details: identity 'Build\49a2cab3-a4ad-46c4-994c-35f429c806d2', scope 'repository'.
remote: TF401027: You need the Git 'GenericContribute' permission to perform this action. Details: identity 'Build\49a2cab3-a4ad-46c4-994c-35f429c806d2', scope 'repository'.
fatal: unable to access 'https://dev.azure.com/cooporg/test/_git/test/': The requested URL returned error: 403
##[error]Bash exited with code '128'.
##[section]Finishing: Bash

I added the "whoami" command to confirm the running user and to our surprise it's running as "vsts". We tried searching for this user to grant it the permissions needed, but we can't find it.

Has anybody implemented something similar? How do we execute Git commands as a specific user within a Pipeline, so we can push the changes back to our branch? The ideal scenario would be committing these changes based on the user that manually ran the Pipeline.


  • (node:3433) [EACCES] Error Plugin: sfdx-cli: EACCES: permission denied, open '/home/vsts/.cache/sfdx/lastrun' It looks like this is your first error, not executing the git commands.
    – Preston Martin
    Aug 13, 2019 at 14:31
  • Hi @PrestonM, I'm not sure this is actually the issue, as all the SFDX cli commands run even with the error showing. My issue is mainly when I try to push back to the branch, saying that "I" don't have the correct permissions. Even though the user is "vsts" and not my user.
    – Rodrigo
    Aug 13, 2019 at 14:43

1 Answer 1


Found the issue...

The documentation states that the "contribute" permission needs to be added to "Project Collection Build Service Accounts". There is also an USER called ""Project Collection Build Service". After explicitly adding the "Project Collection Build Service" user to be able to contribute it worked as expected!

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.