Here is the scenario: We are trying to "automate" our Salesforce development with Azure Pipelines. Since Salesforce is very unique when it comes to deploying changes, I have tried to create a Pipeline that would be manually run to save any change made into a Salesforce Sandbox back to a Branch. The goal is to eventually merge these changes into other branches and deploy them into other Salesforce environments.
We are using the the SFDX cli for such tasks within the image. Below is a copy of my yml file:
trigger:
- developer
pool:
vmImage: 'ubuntu-latest'
variables:
- group: DeveloperVariables
steps:
- checkout: self
persistCredentials: true
- task: DownloadSecureFile@1
inputs:
secureFile: server.key
- task: Bash@3
inputs:
workingDirectory: ''
targetType: inline
script: |
wget https://developer.salesforce.com/media/salesforce-cli/sfdx-linux-amd64.tar.xz;
mkdir sfdx;
tar xJf sfdx-linux-amd64.tar.xz -C sfdx --strip-components 1;
sudo ./sfdx/install;
sfdx force:auth:jwt:grant --clientid $CONSUMER_KEY --jwtkeyfile $DOWNLOADSECUREFILE_SECUREFILEPATH --username $USERNAME --setalias developer;
sfdx force:mdapi:retrieve -u $USERNAME -k src/package.xml -r .;
unzip unpackaged.zip;
cd unpackaged;
git config --global user.email "[email protected]"
git config --global user.name "Test User"
git checkout -t origin/developer;
git add .;
git status;
echo "This is me: ";
whoami;
git commit -m "Retrieved latest Developer SB changes!"
echo "Pushing now!!!";
git push --set-upstream origin HEAD:developer;
As per Microsoft's documentation found here, we need to make sure we grant permissions to the build service. All the permissions have been granted as requested but we still can't get it to work.
Below is the copy of the logs generated when we run the Pipeline:
##[section]Starting: Bash
==============================================================================
Task : Bash
Description : Run a Bash script on macOS, Linux, or Windows
Version : 3.151.3
Author : Microsoft Corporation
Help : https://docs.microsoft.com/azure/devops/pipelines/tasks/utility/bash
==============================================================================
Generating script.
========================== Starting Command Output ===========================
[command]/bin/bash --noprofile --norc /home/vsts/work/_temp/9d534f54-57b8-44a0-8d10-2e3d8c334bbf.sh
--2019-08-13 13:27:00-- https://developer.salesforce.com/media/salesforce-cli/sfdx-linux-amd64.tar.xz
Resolving developer.salesforce.com (developer.salesforce.com)... 151.101.249.145
Connecting to developer.salesforce.com (developer.salesforce.com)|151.101.249.145|:443... connected.
HTTP request sent, awaiting response... 200 OK
Length: 19686680 (19M) [application/x-tar]
Saving to: ‘sfdx-linux-amd64.tar.xz’
0K .......... .......... .......... .......... .......... 0% 25.6M 1s
50K .......... .......... .......... .......... .......... 0% 27.2M 1s
...
19150K .......... .......... .......... .......... .......... 99% 171M 0s
19200K .......... .......... ..... 100% 247M=0.1s
2019-08-13 13:27:00 (133 MB/s) - ‘sfdx-linux-amd64.tar.xz’ saved [19686680/19686680]
sfdx installed to 4m/usr/local/bin/sfdx
sfdx-cli/7.8.1-8f830784cc linux-x64 node-v10.15.3
(node:3433) [EACCES] Error Plugin: sfdx-cli: EACCES: permission denied, open '/home/vsts/.cache/sfdx/lastrun'
module: @oclif/[email protected]
task: runHook init
plugin: sfdx-cli
root: /usr/local/lib/sfdx
See more details with DEBUG=*
Successfully authorized [email protected] with org ID 00D560340009rbvEAA
(node:3469) [EACCES] Error Plugin: sfdx-cli: EACCES: permission denied, open '/home/vsts/.cache/sfdx/lastrun'
module: @oclif/[email protected]
task: runHook init
plugin: sfdx-cli
root: /usr/local/lib/sfdx
See more details with DEBUG=*
this.retrieveTargetPath: /home/vsts/work/1/s
Retrieving source...
=== Status
Status: InProgress
jobid: 09S56000001G6fmEAC
...
=== Result
Status: Succeeded
jobid: 09S56000001G6fmEAC
Wrote retrieve zip to /home/vsts/work/1/s/unpackaged.zip.
Archive: unpackaged.zip
inflating: unpackaged/settings/Account.settings
...
inflating: unpackaged/pathAssistants/TMG_CBE_Path.pathAssistant
inflating: unpackaged/package.xml
Switched to a new branch 'developer'
Branch 'developer' set up to track remote branch 'developer' from 'origin'.
On branch developer
Your branch is up to date with 'origin/developer'.
Changes to be committed:
(use "git reset HEAD <file>..." to unstage)
new file: approvalProcesses/Billing_Item__c.Billable_Item_Less_than_0.approvalProcess
...
new file: workflows/Touchpoint__c.workflow
new file: workflows/User.workflow
Untracked files:
(use "git add <file>..." to include in what will be committed)
../sfdx-linux-amd64.tar.xz
../sfdx/
../unpackaged.zip
This is me:
vsts
[developer f8ea8ed] Retrieved latest Developer SB changes!
1332 files changed, 452246 insertions(+)
create mode 100644 unpackaged/approvalProcesses/Billing_Item__c.Billable_Item_Less_than_0.approvalProcess
...
create mode 100644 unpackaged/workflows/Touchpoint__c.workflow
create mode 100644 unpackaged/workflows/User.workflow
Pushing now!!!
remote: 001f# service=git-receive-pack
remote: 0000000000aaTF401027: You need the Git 'GenericContribute' permission to perform this action. Details: identity 'Build\49a2cab3-a4ad-46c4-994c-35f429c806d2', scope 'repository'.
remote: TF401027: You need the Git 'GenericContribute' permission to perform this action. Details: identity 'Build\49a2cab3-a4ad-46c4-994c-35f429c806d2', scope 'repository'.
fatal: unable to access 'https://dev.azure.com/cooporg/test/_git/test/': The requested URL returned error: 403
##[error]Bash exited with code '128'.
##[section]Finishing: Bash
I added the "whoami" command to confirm the running user and to our surprise it's running as "vsts". We tried searching for this user to grant it the permissions needed, but we can't find it.
Has anybody implemented something similar? How do we execute Git commands as a specific user within a Pipeline, so we can push the changes back to our branch? The ideal scenario would be committing these changes based on the user that manually ran the Pipeline.
Thanks.
