sf-plugin-permission-sets 0.0.0-dev.73 → 0.0.0-dev.74
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/README.md +22 -0
- package/package.json +1 -1
package/README.md
CHANGED
|
@@ -15,6 +15,7 @@ Stop clicking through Setup to grant access. Commit a YAML file, open a PR, let
|
|
|
15
15
|
|
|
16
16
|
- [Why](#why)
|
|
17
17
|
- [Install](#install)
|
|
18
|
+
- [Org permissions](#org-permissions)
|
|
18
19
|
- [Quick start](#quick-start)
|
|
19
20
|
- [Permission files](#permission-files)
|
|
20
21
|
- [Organizing files](#organizing-files)
|
|
@@ -57,6 +58,25 @@ sf plugins install sf-plugin-permission-sets@x.y.z
|
|
|
57
58
|
|
|
58
59
|
Requires Salesforce CLI (`sf`) and Node.js 22.13+.
|
|
59
60
|
|
|
61
|
+
## Org permissions
|
|
62
|
+
|
|
63
|
+
What the user behind `--target-org` needs:
|
|
64
|
+
|
|
65
|
+
| Command | API Enabled | View Setup and Configuration | View Roles and Role Hierarchy | Assign Permission Sets |
|
|
66
|
+
| --- | :---: | :---: | :---: | :---: |
|
|
67
|
+
| `sf ps check` | - | - | - | - |
|
|
68
|
+
| `sf ps validate` | ✓ | ✓ | ✓ | - |
|
|
69
|
+
| `sf ps plan` | ✓ | ✓ | ✓ | - |
|
|
70
|
+
| `sf ps export` | ✓ | ✓ | ✓ | - |
|
|
71
|
+
| `sf ps apply` | ✓ | ✓ | ✓ | ✓ |
|
|
72
|
+
|
|
73
|
+
✓ Required, - Not required.
|
|
74
|
+
|
|
75
|
+
Two permission sets, so a pull request job cannot change the org:
|
|
76
|
+
|
|
77
|
+
- [PS_Plugin_Read](setup/permissionsets/PS_Plugin_Read.permissionset-meta.xml): reads permission set assignments.
|
|
78
|
+
- [PS_Plugin_Write](setup/permissionsets/PS_Plugin_Write.permissionset-meta.xml): reads and modifies permission set assignments.
|
|
79
|
+
|
|
60
80
|
## Quick start
|
|
61
81
|
|
|
62
82
|
```bash
|
|
@@ -375,6 +395,8 @@ A requested `--user` that has no matching assignments (a typo, or a user who gen
|
|
|
375
395
|
|
|
376
396
|
Three small workflows that build on each other: check pull requests with no org at all, validate the same files against the real org, then apply on merge.
|
|
377
397
|
|
|
398
|
+
Point the pull request workflows at a `PS_Plugin_Read` user and only the merge workflow at `PS_Plugin_Write` (see [Org permissions](#org-permissions)).
|
|
399
|
+
|
|
378
400
|
**1. Check pull requests to main** (no org, no secrets):
|
|
379
401
|
|
|
380
402
|
```yaml
|
package/package.json
CHANGED