sfdx-hardis 8.22.0 → 8.23.0

package/defaults/ci/.github/workflows/check-deploy.yml

@@ -1,4 +1,10 @@
 ---
+# Source of this file: the sfdx-hardis default template
+#   https://github.com/hardisgroupcom/sfdx-hardis/blob/main/defaults/ci/.github/workflows/check-deploy.yml
+#   raw: https://raw.githubusercontent.com/hardisgroupcom/sfdx-hardis/main/defaults/ci/.github/workflows/check-deploy.yml
+# To upgrade it, compare it with the latest version of that template and bring in its changes,
+# keeping what is specific to this project (branch names, secrets, runner tags, image, custom jobs).
+# What changed between versions: https://github.com/hardisgroupcom/sfdx-hardis/blob/main/CHANGELOG.md
 # Manual updates in in job step "Login & Process Deployment" below:
 # - variables for additional branches: add SFDX_CLIENT_ID / KEY variables
 # - To use slack notifications, you can also define SLACK_TOKEN and SLACK_CHANNEL_ID

package/defaults/ci/.github/workflows/check-major-branch-deploy.yml

@@ -0,0 +1,116 @@
+---
+# Source of this file: the sfdx-hardis default template
+#   https://github.com/hardisgroupcom/sfdx-hardis/blob/main/defaults/ci/.github/workflows/check-major-branch-deploy.yml
+#   raw: https://raw.githubusercontent.com/hardisgroupcom/sfdx-hardis/main/defaults/ci/.github/workflows/check-major-branch-deploy.yml
+# To upgrade it, compare it with the latest version of that template and bring in its changes,
+# keeping what is specific to this project (branch names, secrets, runner tags, image, custom jobs).
+# What changed between versions: https://github.com/hardisgroupcom/sfdx-hardis/blob/main/CHANGELOG.md
+# Major branch deployment check: every night, simulates the full deployment of each major branch to
+# its own org, to know whether an org drifted from its branch (manual changes, refresh, failed
+# deployment). Nothing is deployed, no Pull Request is commented, no deployment action runs.
+#
+# - The major branches are read from config/branches/.sfdx-hardis.*.yml of the default branch:
+#   no branch list to maintain here
+# - GitHub runs scheduled workflows from the default branch only: this file must be on it
+# - Manual updates in job step "Login & Check major branch deployment" below: add the
+#   SFDX_CLIENT_ID / KEY variables of your major branches, like in check-deploy.yml
+# - Define enableMajorBranchDeploymentCheck: true in config/.sfdx-hardis.yml to see the result of
+#   each branch in the VS Code DevOps Pipeline
+# More info at https://sfdx-hardis.cloudity.com/salesforce-devops-setup-major-branch-check/
+
+on:
+  schedule:
+    - cron: "0 1 * * *" # Every night at 1am UTC
+  workflow_dispatch:
+
+name: Check Major Branch Deployment (sfdx-hardis)
+permissions: read-all
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
+jobs:
+  list_major_branches:
+    runs-on: ubuntu-latest
+    name: List major branches
+    permissions:
+      contents: read
+    outputs:
+      branches: ${{ steps.list.outputs.branches }}
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+      # A branch config file is named after its branch, with / replaced by __ (release/uat -> release__uat)
+      - name: List major branches from config/branches
+        id: list
+        run: |
+          branches="[]"
+          for file in config/branches/.sfdx-hardis.*.yml; do
+            [ -f "$file" ] || continue
+            name="$(basename "$file")"
+            name="${name#.sfdx-hardis.}"
+            name="${name%.yml}"
+            branch="${name//__//}"
+            branches=$(echo "$branches" | jq -c --arg b "$branch" '. + [$b]')
+          done
+          echo "Major branches: $branches"
+          echo "branches=$branches" >> "$GITHUB_OUTPUT"
+
+  check_major_branch:
+    needs: list_major_branches
+    if: ${{ needs.list_major_branches.outputs.branches != '[]' }}
+    strategy:
+      fail-fast: false # One org that cannot be deployed must not hide the result of the others
+      matrix:
+        branch: ${{ fromJSON(needs.list_major_branches.outputs.branches) }}
+    runs-on: ubuntu-latest
+    # Job timeout, in minutes: define the repository variable CI_JOB_TIMEOUT_MINUTES to change it.
+    timeout-minutes: ${{ fromJSON(vars.CI_JOB_TIMEOUT_MINUTES || '150') }}
+    # Job runs in sfdx-hardis docker image, that includes Salesforce CLI and all required plugins & dependencies.
+    # Images are also mirrored on Docker Hub: hardisgroupcom/sfdx-hardis-ubuntu:latest
+    container: ghcr.io/hardisgroupcom/sfdx-hardis-ubuntu:latest
+    # The VS Code DevOps Pipeline finds the check of a branch by this name: keep "Major Branch" and the branch in it
+    name: Check Major Branch Deployment (${{ matrix.branch }})
+    permissions:
+      contents: read
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ matrix.branch }}
+          fetch-depth: 0
+      - name: Login & Check major branch deployment
+        env:
+          SFDX_CLIENT_ID_INTEGRATION: ${{ secrets.SFDX_CLIENT_ID_INTEGRATION}}
+          SFDX_CLIENT_KEY_INTEGRATION: ${{ secrets.SFDX_CLIENT_KEY_INTEGRATION}}
+          SFDX_CLIENT_ID_UAT: ${{ secrets.SFDX_CLIENT_ID_UAT}}
+          SFDX_CLIENT_KEY_UAT: ${{ secrets.SFDX_CLIENT_KEY_UAT}}
+          SFDX_CLIENT_ID_PREPROD: ${{ secrets.SFDX_CLIENT_ID_PREPROD}}
+          SFDX_CLIENT_KEY_PREPROD: ${{ secrets.SFDX_CLIENT_KEY_PREPROD}}
+          SFDX_CLIENT_ID_MAIN: ${{ secrets.SFDX_CLIENT_ID_MAIN}}
+          SFDX_CLIENT_KEY_MAIN: ${{ secrets.SFDX_CLIENT_KEY_MAIN}}
+          # Secrets read by replacementRules (secret: NAME): NAME_<BRANCH> is read first, then NAME
+          # PAYMENT_API_PASSWORD_UAT: ${{ secrets.PAYMENT_API_PASSWORD_UAT }}
+          SFDX_AUTH_URL_TECHNICAL_ORG: ${{ secrets.SFDX_AUTH_URL_TECHNICAL_ORG }}
+          SFDX_DEPLOY_WAIT_MINUTES: ${{ vars.SFDX_DEPLOY_WAIT_MINUTES || '120' }}
+          SFDX_TEST_WAIT_MINUTES: ${{ vars.SFDX_TEST_WAIT_MINUTES || '120' }}
+          CI_COMMIT_REF_NAME: ${{ matrix.branch }} # The checked major branch
+          ORG_ALIAS: ${{ matrix.branch }}
+          CONFIG_BRANCH: ${{ matrix.branch }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          FORCE_COLOR: "1"
+        run: |
+          echo "Check deployment of major branch \"$CI_COMMIT_REF_NAME\" to its org"
+          # The job runs in a container, where git runs as another user than the owner of the checkout
+          git config --global --add safe.directory "$GITHUB_WORKSPACE"
+          sf hardis:auth:login
+          sf hardis:project:deploy:smart --check --major-branch-check
+
+      # Upload sfdx-hardis reports, including the complete deployment result JSON
+      - name: Archive sfdx-hardis reports
+        if: always() # Also when the job was stopped by the timeout
+        uses: actions/upload-artifact@v4
+        with:
+          name: sfdx-hardis reports ${{ strategy.job-index }}
+          path: hardis-report

package/defaults/ci/.github/workflows/megalinter.yml

@@ -1,4 +1,10 @@
 ---
+# Source of this file: the sfdx-hardis default template
+#   https://github.com/hardisgroupcom/sfdx-hardis/blob/main/defaults/ci/.github/workflows/megalinter.yml
+#   raw: https://raw.githubusercontent.com/hardisgroupcom/sfdx-hardis/main/defaults/ci/.github/workflows/megalinter.yml
+# To upgrade it, compare it with the latest version of that template and bring in its changes,
+# keeping what is specific to this project (branch names, secrets, runner tags, image, custom jobs).
+# What changed between versions: https://github.com/hardisgroupcom/sfdx-hardis/blob/main/CHANGELOG.md
 # Mega-Linter GitHub Action configuration file
 # More info at https://megalinter.io
 name: Mega-Linter

package/defaults/ci/.github/workflows/process-deploy.yml

@@ -1,4 +1,10 @@
 ---
+# Source of this file: the sfdx-hardis default template
+#   https://github.com/hardisgroupcom/sfdx-hardis/blob/main/defaults/ci/.github/workflows/process-deploy.yml
+#   raw: https://raw.githubusercontent.com/hardisgroupcom/sfdx-hardis/main/defaults/ci/.github/workflows/process-deploy.yml
+# To upgrade it, compare it with the latest version of that template and bring in its changes,
+# keeping what is specific to this project (branch names, secrets, runner tags, image, custom jobs).
+# What changed between versions: https://github.com/hardisgroupcom/sfdx-hardis/blob/main/CHANGELOG.md
 # Manual updates in in job step "Login & Process Deployment" below:
 # - variables for additional branches: add SFDX_CLIENT_ID / KEY variables
 # - To use slack notifications, you can also define SLACK_TOKEN and SLACK_CHANNEL_ID

package/defaults/ci/.github/workflows/scratch-pool-refresh.yml

@@ -1,4 +1,10 @@
 ---
+# Source of this file: the sfdx-hardis default template
+#   https://github.com/hardisgroupcom/sfdx-hardis/blob/main/defaults/ci/.github/workflows/scratch-pool-refresh.yml
+#   raw: https://raw.githubusercontent.com/hardisgroupcom/sfdx-hardis/main/defaults/ci/.github/workflows/scratch-pool-refresh.yml
+# To upgrade it, compare it with the latest version of that template and bring in its changes,
+# keeping what is specific to this project (branch names, secrets, runner tags, image, custom jobs).
+# What changed between versions: https://github.com/hardisgroupcom/sfdx-hardis/blob/main/CHANGELOG.md
 # Scratch org pool refresh: deletes the scratch orgs about to expire and creates new ones, so jobs
 # and developers get a scratch org in seconds.
 #

package/defaults/ci/.gitlab-ci-config.yml

@@ -1,3 +1,10 @@
+# Source of this file: the sfdx-hardis default template
+#   https://github.com/hardisgroupcom/sfdx-hardis/blob/main/defaults/ci/.gitlab-ci-config.yml
+#   raw: https://raw.githubusercontent.com/hardisgroupcom/sfdx-hardis/main/defaults/ci/.gitlab-ci-config.yml
+# To upgrade it, compare it with the latest version of that template and bring in its changes,
+# keeping what is specific to this project (branch names, secrets, runner tags, image, custom jobs).
+# This file holds the values of this project: bring in new keys only, never replace existing values.
+# What changed between versions: https://github.com/hardisgroupcom/sfdx-hardis/blob/main/CHANGELOG.md
 # You can customize your pipeline process here
 variables:
   DEPLOY_BRANCHES: /^(development|integration|recette|preprod|main|master)$/ # Regex contenant la liste des branches où un push va déclencher un déploiement

package/defaults/ci/.gitlab-ci.yml

@@ -1,4 +1,10 @@
 ---
+# Source of this file: the sfdx-hardis default template
+#   https://github.com/hardisgroupcom/sfdx-hardis/blob/main/defaults/ci/.gitlab-ci.yml
+#   raw: https://raw.githubusercontent.com/hardisgroupcom/sfdx-hardis/main/defaults/ci/.gitlab-ci.yml
+# To upgrade it, compare it with the latest version of that template and bring in its changes,
+# keeping what is specific to this project (branch names, secrets, runner tags, image, custom jobs).
+# What changed between versions: https://github.com/hardisgroupcom/sfdx-hardis/blob/main/CHANGELOG.md
 ##################################################################
 # Test and deployment pipeline for a Salesforce CI/CD Project    #
 #         Update it only if you know what you are doing :)       #
@@ -252,8 +258,12 @@ clean:
     - sf hardis:auth:login --scratchorg || true
     - sf org delete scratch --no-prompt || true
 
-# Simulate deployment to related org
-# Is triggered only when scheduled, or via manual launch
+# Major branch deployment check: simulates the full deployment of a major branch to its own org,
+# to know whether the org drifted from its branch. Nothing is deployed, no Merge Request is commented.
+# Is triggered only when scheduled, or via manual launch:
+# create one schedule per major branch in CI/CD > Schedules (ex: every night at 1am)
+# Define enableMajorBranchDeploymentCheck: true in config/.sfdx-hardis.yml to see the result in VS Code DevOps Pipeline
+# More info at https://sfdx-hardis.cloudity.com/salesforce-devops-setup-major-branch-check/
 check_deploy_to_current_branch_org:
   stage: check_deploy
   timeout: 150 minutes # Raise it if the job is killed before the deployment ends
@@ -285,7 +295,7 @@ check_deploy_to_current_branch_org:
     #     echo "[sfdx-hardis] GitLab push/MR auth enabled for coding agents"
     #   fi
     - sf hardis:auth:login
-    - sf hardis:project:deploy:smart --check
+    - sf hardis:project:deploy:smart --check --major-branch-check
   artifacts:
     when: always
     paths:

package/defaults/ci/Jenkinsfile

@@ -1,3 +1,9 @@
+// Source of this file: the sfdx-hardis default template
+//   https://github.com/hardisgroupcom/sfdx-hardis/blob/main/defaults/ci/Jenkinsfile
+//   raw: https://raw.githubusercontent.com/hardisgroupcom/sfdx-hardis/main/defaults/ci/Jenkinsfile
+// To upgrade it, compare it with the latest version of that template and bring in its changes,
+// keeping what is specific to this project (branch names, secrets, runner tags, image, custom jobs).
+// What changed between versions: https://github.com/hardisgroupcom/sfdx-hardis/blob/main/CHANGELOG.md
 // Pipeline for Salesforce CI/CD using sfdx-hardis
 //
 // SETUP (do a CTRL+F on "MANUAL"):
@@ -269,6 +275,51 @@ pipeline {
             }
         }
 
+        ///////////////////////////////////////////////////////////////////////////////////
+        // Major branch deployment check: simulates the full deployment of a major      //
+        // branch to its own org, to know whether the org drifted from its branch.      //
+        // Nothing is deployed, no Pull Request is commented. Runs only when            //
+        // MAJOR_BRANCH_DEPLOYMENT_CHECK is "true": create a dedicated Jenkins job on    //
+        // this Jenkinsfile, scheduled every night on each major branch, that sets this //
+        // environment variable. The VS Code DevOps Pipeline finds the check by the     //
+        // name of the commit status it posts, which must contain "major branch check"  //
+        // (ex: major-branch-check). A multibranch job posts a generic status name      //
+        // (continuous-integration/jenkins/branch) whatever the job is called: set a    //
+        // custom status name in the job (ex: GitHub Branch Source, trait "Custom       //
+        // GitHub Notification Context"), or the check result replaces the deployment   //
+        // status of the commit. More info at                                           //
+        // https://sfdx-hardis.cloudity.com/salesforce-devops-setup-major-branch-check/  //
+        ///////////////////////////////////////////////////////////////////////////////////
+        stage('Check Major Branch Deployment') {
+            when {
+                allOf {
+                    environment name: 'MAJOR_BRANCH_DEPLOYMENT_CHECK', value: 'true'
+                    expression { DEPLOYMENT_BRANCHES.contains(env.BRANCH_NAME_CLEAN) }
+                    not { changeRequest() }
+                }
+            }
+            steps {
+                withCredentials([
+                    // ----------------------------------------------------------------
+                    // MANUAL: Add one pair of credentials per deployment org.
+                    // Same credential pairs as in the Deployment stage below.
+                    //
+                    // string(credentialsId: 'SFDX_CLIENT_ID_INTEGRATION',  variable: 'SFDX_CLIENT_ID_INTEGRATION'),
+                    // string(credentialsId: 'SFDX_CLIENT_KEY_INTEGRATION', variable: 'SFDX_CLIENT_KEY_INTEGRATION'),
+                    // ----------------------------------------------------------------
+                    string(credentialsId: 'SFDX_AUTH_URL_TECHNICAL_ORG',    variable: 'SFDX_AUTH_URL_TECHNICAL_ORG',    optional: true),
+                ]) {
+                    sh 'sf hardis:auth:login'
+                    sh 'sf hardis:project:deploy:smart --check --major-branch-check'
+                }
+            }
+            post {
+                always {
+                    archiveArtifacts allowEmptyArchive: true, artifacts: 'hardis-report/**', defaultExcludes: false, followSymlinks: false
+                }
+            }
+        }
+
         /////////////////////////////////////////////////////////////////////////////////
         // Deploy to the target org when a commit lands on a deployment branch        //
         /////////////////////////////////////////////////////////////////////////////////
@@ -279,6 +330,8 @@ pipeline {
                     not { changeRequest() }
                     // The job that refreshes the scratch org pool does not deploy
                     not { environment name: 'SCRATCH_ORG_POOL', value: 'true' }
+                    // The job that checks a major branch against its org does not deploy
+                    not { environment name: 'MAJOR_BRANCH_DEPLOYMENT_CHECK', value: 'true' }
                 }
             }
             steps {

package/defaults/ci/azure-pipelines-checks.yml

@@ -1,3 +1,9 @@
+# Source of this file: the sfdx-hardis default template
+#   https://github.com/hardisgroupcom/sfdx-hardis/blob/main/defaults/ci/azure-pipelines-checks.yml
+#   raw: https://raw.githubusercontent.com/hardisgroupcom/sfdx-hardis/main/defaults/ci/azure-pipelines-checks.yml
+# To upgrade it, compare it with the latest version of that template and bring in its changes,
+# keeping what is specific to this project (branch names, secrets, runner tags, image, custom jobs).
+# What changed between versions: https://github.com/hardisgroupcom/sfdx-hardis/blob/main/CHANGELOG.md
 # Pipeline for Salesforce deployment check & MegaLinter check
 #
 # This pipeline is triggered when a commit is added to a Pull Request

package/defaults/ci/azure-pipelines-deployment.yml

@@ -1,3 +1,9 @@
+# Source of this file: the sfdx-hardis default template
+#   https://github.com/hardisgroupcom/sfdx-hardis/blob/main/defaults/ci/azure-pipelines-deployment.yml
+#   raw: https://raw.githubusercontent.com/hardisgroupcom/sfdx-hardis/main/defaults/ci/azure-pipelines-deployment.yml
+# To upgrade it, compare it with the latest version of that template and bring in its changes,
+# keeping what is specific to this project (branch names, secrets, runner tags, image, custom jobs).
+# What changed between versions: https://github.com/hardisgroupcom/sfdx-hardis/blob/main/CHANGELOG.md
 # Pipeline for Salesforce deployment check & MegaLinter check
 #
 # This pipeline is triggered when a commit is added to a Pull Request

package/defaults/ci/azure-pipelines-major-branch-check.yml

@@ -0,0 +1,80 @@
+# Source of this file: the sfdx-hardis default template
+#   https://github.com/hardisgroupcom/sfdx-hardis/blob/main/defaults/ci/azure-pipelines-major-branch-check.yml
+#   raw: https://raw.githubusercontent.com/hardisgroupcom/sfdx-hardis/main/defaults/ci/azure-pipelines-major-branch-check.yml
+# To upgrade it, compare it with the latest version of that template and bring in its changes,
+# keeping what is specific to this project (branch names, secrets, runner tags, image, custom jobs).
+# What changed between versions: https://github.com/hardisgroupcom/sfdx-hardis/blob/main/CHANGELOG.md
+# Pipeline for Salesforce major branch deployment check
+#
+# Simulates the full deployment of a major branch to its own org, to know whether the org drifted from
+# its branch (manual changes, refresh, failed deployment). Nothing is deployed, no Pull Request is
+# commented, no deployment action runs.
+#
+# Setup:
+#   - Go to Pipelines
+#   - Create a new pipeline from this file (Create new -> Existing Azure Pipelines YAML file)
+#   - Rename it "Check Major Branch Deployment": the VS Code DevOps Pipeline finds the check by this name
+#   - Add the variables of your major branches (SFDX_CLIENT_ID_<BRANCH>, SFDX_CLIENT_KEY_<BRANCH>), like in the deployment pipeline
+#   - Edit the pipeline, open the menu ⋮ and select Triggers
+#   - In "Scheduled", add a schedule (ex: every night at 1am) and "Include" all your major branches,
+#     as in the branch filter of the deployment pipeline
+#   - Define enableMajorBranchDeploymentCheck: true in config/.sfdx-hardis.yml to see the result of each
+#     branch in the VS Code DevOps Pipeline
+#
+# More info at https://sfdx-hardis.cloudity.com/salesforce-devops-setup-major-branch-check/
+
+name: Check Major Branch Deployment
+
+# Only started by its schedule (defined in the pipeline Triggers) or by hand
+trigger: none
+pr: none
+
+# Mandatory variables, used by jobs
+variables:
+  - name: FORCE_COLOR
+    value: "1"
+  - name: BRANCH_NAME
+    value: $[replace(variables['Build.SourceBranch'], 'refs/heads/', '')]
+
+jobs:
+  - job: MajorBranchDeploymentCheck
+    displayName: Check Major Branch Deployment
+    timeoutInMinutes: 150
+    pool:
+      vmImage: ubuntu-latest
+    # Job runs in sfdx-hardis docker image, that includes Salesforce CLI and all required plugins & dependencies.
+    # Images are also mirrored on Docker Hub: hardisgroupcom/sfdx-hardis-ubuntu:latest
+    container: ghcr.io/hardisgroupcom/sfdx-hardis-ubuntu:latest
+    steps:
+      - checkout: self
+        fetchDepth: 0
+        displayName: Git Checkout
+
+      - script: |
+          echo "Check deployment of major branch \"${BRANCH_NAME}\" to its org"
+          sf hardis:auth:login
+          sf hardis:project:deploy:smart --check --major-branch-check
+        env:
+          SFDX_CLIENT_ID_INTEGRATION: $(SFDX_CLIENT_ID_INTEGRATION)
+          SFDX_CLIENT_KEY_INTEGRATION: $(SFDX_CLIENT_KEY_INTEGRATION)
+          CI_COMMIT_REF_NAME: $(BRANCH_NAME)
+          CONFIG_BRANCH: $(BRANCH_NAME)
+          ORG_ALIAS: $(BRANCH_NAME)
+          SFDX_DEPLOY_WAIT_MINUTES: $(SFDX_DEPLOY_WAIT_MINUTES)
+          SFDX_AUTH_URL_TECHNICAL_ORG: $(SFDX_AUTH_URL_TECHNICAL_ORG)
+          CI: "true"
+          SYSTEM_ACCESSTOKEN: $(System.AccessToken)
+          CI_SFDX_HARDIS_AZURE_TOKEN: $(System.AccessToken)
+          SYSTEM_COLLECTIONURI: $(System.CollectionUri)
+          SYSTEM_TEAMPROJECT: $(System.TeamProject)
+          BUILD_REPOSITORY_ID: $(Build.Repository.ID)
+          BUILD_REPOSITORYNAME: $(Build.Repository.Name)
+          BUILD_SOURCEBRANCHNAME: $(Build.SourceBranchName)
+          BUILD_BUILD_ID: $(Build.BuildId)
+        displayName: "Check major branch deployment to its SF Org"
+      # Publish sfdx-hardis reports, including the complete deployment result JSON
+      - publish: $(System.DefaultWorkingDirectory)/hardis-report/
+        condition: succeededOrFailed()
+        continueOnError: true
+        artifact: hardis-report
+        displayName: Publish sfdx-hardis reports

package/defaults/ci/azure-pipelines-scratch-pool.yml

@@ -1,3 +1,9 @@
+# Source of this file: the sfdx-hardis default template
+#   https://github.com/hardisgroupcom/sfdx-hardis/blob/main/defaults/ci/azure-pipelines-scratch-pool.yml
+#   raw: https://raw.githubusercontent.com/hardisgroupcom/sfdx-hardis/main/defaults/ci/azure-pipelines-scratch-pool.yml
+# To upgrade it, compare it with the latest version of that template and bring in its changes,
+# keeping what is specific to this project (branch names, secrets, runner tags, image, custom jobs).
+# What changed between versions: https://github.com/hardisgroupcom/sfdx-hardis/blob/main/CHANGELOG.md
 # Pipeline for the scratch org pool refresh
 #
 # Deletes the scratch orgs about to expire and creates new ones, so jobs and developers get a

package/defaults/ci/bitbucket-pipelines.yml

@@ -1,3 +1,9 @@
+# Source of this file: the sfdx-hardis default template
+#   https://github.com/hardisgroupcom/sfdx-hardis/blob/main/defaults/ci/bitbucket-pipelines.yml
+#   raw: https://raw.githubusercontent.com/hardisgroupcom/sfdx-hardis/main/defaults/ci/bitbucket-pipelines.yml
+# To upgrade it, compare it with the latest version of that template and bring in its changes,
+# keeping what is specific to this project (branch names, secrets, runner tags, image, custom jobs).
+# What changed between versions: https://github.com/hardisgroupcom/sfdx-hardis/blob/main/CHANGELOG.md
 # You might add new branch names in pipeline "branches"
 
 # Steps run in sfdx-hardis docker image, that includes Salesforce CLI and all required plugins & dependencies.
@@ -132,6 +138,31 @@ pipelines:
           artifacts:
             - hardis-report/**
 
+    # Major branch deployment check: simulates the full deployment of a major branch to its own org,
+    # to know whether the org drifted from its branch. Nothing is deployed, no Pull Request is commented.
+    # Schedule it every night on each major branch (Pipelines -> Schedules -> New schedule ->
+    # check-major-branch-deployment), and define enableMajorBranchDeploymentCheck: true in
+    # config/.sfdx-hardis.yml to see the result in the VS Code DevOps Pipeline.
+    # The DevOps Pipeline finds the check by the name of this custom pipeline: keep it.
+    # More info at https://sfdx-hardis.cloudity.com/salesforce-devops-setup-major-branch-check/
+    check-major-branch-deployment:
+      - step:
+          name: Check Major Branch Deployment
+          max-time: 120
+          clone:
+            depth: full
+          script:
+            - export BRANCH_NAME=$(echo "$BITBUCKET_BRANCH" | sed
+              's/refs\/heads\///')
+            - export CI_COMMIT_REF_NAME=$BRANCH_NAME
+            - export CONFIG_BRANCH=$BRANCH_NAME
+            - export ORG_ALIAS=$BRANCH_NAME
+            - export FORCE_COLOR=1
+            - sf hardis:auth:login
+            - sf hardis:project:deploy:smart --check --major-branch-check
+          artifacts:
+            - hardis-report/**
+
   branches:
     # Add all your major branches here
     "{integration,uat,preprod,production,main}":

package/defaults/lintonly/.gitlab-ci.yml

@@ -1,4 +1,10 @@
 ---
+# Source of this file: the sfdx-hardis default template
+#   https://github.com/hardisgroupcom/sfdx-hardis/blob/main/defaults/lintonly/.gitlab-ci.yml
+#   raw: https://raw.githubusercontent.com/hardisgroupcom/sfdx-hardis/main/defaults/lintonly/.gitlab-ci.yml
+# To upgrade it, compare it with the latest version of that template and bring in its changes,
+# keeping what is specific to this project (branch names, secrets, runner tags, image, custom jobs).
+# What changed between versions: https://github.com/hardisgroupcom/sfdx-hardis/blob/main/CHANGELOG.md
 # Pipeline pour tester la qualité du code Apex / Aura / LWC d'un repository
 
 # Liste ordonnée des étapes du pipeline

package/defaults/mkdocs/.github/workflows/build-deploy-docs.yml

@@ -1,3 +1,9 @@
+# Source of this file: the sfdx-hardis default template
+#   https://github.com/hardisgroupcom/sfdx-hardis/blob/main/defaults/mkdocs/.github/workflows/build-deploy-docs.yml
+#   raw: https://raw.githubusercontent.com/hardisgroupcom/sfdx-hardis/main/defaults/mkdocs/.github/workflows/build-deploy-docs.yml
+# To upgrade it, compare it with the latest version of that template and bring in its changes,
+# keeping what is specific to this project (branch names, secrets, runner tags, image, custom jobs).
+# What changed between versions: https://github.com/hardisgroupcom/sfdx-hardis/blob/main/CHANGELOG.md
 name: "DOC - Build and deploy with sfdx-hardis"
 on:
   push:

package/defaults/monitoring/.github/workflows/org-monitoring.yml

@@ -1,3 +1,9 @@
+# Source of this file: the sfdx-hardis default template
+#   https://github.com/hardisgroupcom/sfdx-hardis/blob/main/defaults/monitoring/.github/workflows/org-monitoring.yml
+#   raw: https://raw.githubusercontent.com/hardisgroupcom/sfdx-hardis/main/defaults/monitoring/.github/workflows/org-monitoring.yml
+# To upgrade it, compare it with the latest version of that template and bring in its changes,
+# keeping what is specific to this project (branch names, secrets, runner tags, image, custom jobs).
+# What changed between versions: https://github.com/hardisgroupcom/sfdx-hardis/blob/main/CHANGELOG.md
 # Pipeline for Salesforce monitoring using sfdx-hardis
 #
 # WARNING: Scheduling can be run only on main branch on GitHub Actions, so there is a specific config.

package/defaults/monitoring/.gitlab-ci.yml

@@ -1,3 +1,9 @@
+# Source of this file: the sfdx-hardis default template
+#   https://github.com/hardisgroupcom/sfdx-hardis/blob/main/defaults/monitoring/.gitlab-ci.yml
+#   raw: https://raw.githubusercontent.com/hardisgroupcom/sfdx-hardis/main/defaults/monitoring/.gitlab-ci.yml
+# To upgrade it, compare it with the latest version of that template and bring in its changes,
+# keeping what is specific to this project (branch names, secrets, runner tags, image, custom jobs).
+# What changed between versions: https://github.com/hardisgroupcom/sfdx-hardis/blob/main/CHANGELOG.md
 #######################################
 ### sfdx-hardis monitoring pipeline ###
 #######################################

package/defaults/monitoring/Jenkinsfile

@@ -1,3 +1,9 @@
+// Source of this file: the sfdx-hardis default template
+//   https://github.com/hardisgroupcom/sfdx-hardis/blob/main/defaults/monitoring/Jenkinsfile
+//   raw: https://raw.githubusercontent.com/hardisgroupcom/sfdx-hardis/main/defaults/monitoring/Jenkinsfile
+// To upgrade it, compare it with the latest version of that template and bring in its changes,
+// keeping what is specific to this project (branch names, secrets, runner tags, image, custom jobs).
+// What changed between versions: https://github.com/hardisgroupcom/sfdx-hardis/blob/main/CHANGELOG.md
 // Pipeline for Salesforce monitoring using sfdx-hardis
 //
 // SETUP (do a CTRL+F on "MANUAL"):

package/defaults/monitoring/azure-pipelines.yml

@@ -1,3 +1,9 @@
+# Source of this file: the sfdx-hardis default template
+#   https://github.com/hardisgroupcom/sfdx-hardis/blob/main/defaults/monitoring/azure-pipelines.yml
+#   raw: https://raw.githubusercontent.com/hardisgroupcom/sfdx-hardis/main/defaults/monitoring/azure-pipelines.yml
+# To upgrade it, compare it with the latest version of that template and bring in its changes,
+# keeping what is specific to this project (branch names, secrets, runner tags, image, custom jobs).
+# What changed between versions: https://github.com/hardisgroupcom/sfdx-hardis/blob/main/CHANGELOG.md
 # Pipeline for Salesforce monitoring using sfdx-hardis
 #
 # You need to (do a CTRL+F on "MANUAL")

package/defaults/monitoring/bitbucket-pipelines.yml

@@ -1,3 +1,9 @@
+# Source of this file: the sfdx-hardis default template
+#   https://github.com/hardisgroupcom/sfdx-hardis/blob/main/defaults/monitoring/bitbucket-pipelines.yml
+#   raw: https://raw.githubusercontent.com/hardisgroupcom/sfdx-hardis/main/defaults/monitoring/bitbucket-pipelines.yml
+# To upgrade it, compare it with the latest version of that template and bring in its changes,
+# keeping what is specific to this project (branch names, secrets, runner tags, image, custom jobs).
+# What changed between versions: https://github.com/hardisgroupcom/sfdx-hardis/blob/main/CHANGELOG.md
 # You may:
 # - Update manifest/package-skip-items.xml to filter elements to retrieve
 

package/defaults/templates/monitoring/AGENTS.md

@@ -148,6 +148,7 @@ Read the configuration from the deployment branch itself (`git -C ../<name> show
 - While it is open, the pipeline runs `sf hardis:project:deploy:smart --check`: a validation (check-only deployment with the Apex tests) against the org of the target branch. On GitHub it is the `check-deploy.yml` workflow, on GitLab the check job of `.gitlab-ci.yml`, on Azure DevOps `azure-pipelines-checks.yml`.
 - Once merged, the pipeline runs `sf hardis:project:deploy:smart` on the target branch and deploys to its org (`process-deploy.yml` on GitHub, `azure-pipelines-deployment.yml` on Azure DevOps). It uses a Quick Deploy of the validation when it can.
 - sfdx-hardis comments the Pull Request with the result of the check, the deployment errors and their fix tips, the Flow visual differences and the deployment actions. Read those comments first: they explain a failure better than the raw logs.
+- A project can also schedule a nightly major branch deployment check (`sf hardis:project:deploy:smart --check --major-branch-check`): a full check-only deployment of each major branch to its own org, with no Pull Request comment and no deployment action. A red check means the org drifted from its branch (a change made by hand, a refresh, a failed deployment). It is not a deployment: never count it as one. Its job is `check_deploy_to_current_branch_org` on GitLab, the `check-major-branch-deploy.yml` workflow on GitHub, `azure-pipelines-major-branch-check.yml` on Azure DevOps.
 
 #### What gets deployed
 
@@ -372,7 +373,7 @@ Any other command against an org counts as a write: do not run it, even when the
 | `mkdocs.yml` | Menu and settings of the documentation site built from `docs/`. |
 | `.sfdx-hardis.yml` | sfdx-hardis configuration of the branch: monitored org, notification settings, custom `monitoringCommands` and `monitoringDisable`, the `deploymentRepository` (and optional `deploymentBranch`) that deploys to the org, and the `grafanaUrl` (and optional datasource uids) that receives the monitoring results. Never a secret. |
 | `sfdx-project.json` | Salesforce DX project definition, including the API version used for the retrieve. |
-| `.gitlab-ci.yml`, `.github/workflows/`, `azure-pipelines.yml`, `bitbucket-pipelines.yml`, `Jenkinsfile` | The monitoring pipeline for each CI/CD platform. Only one of them is used. On GitHub, the workflow lives on the default branch and runs all monitoring branches. |
+| `.gitlab-ci.yml`, `.github/workflows/`, `azure-pipelines.yml`, `bitbucket-pipelines.yml`, `Jenkinsfile` | The monitoring pipeline for each CI/CD platform. Only one of them is used. On GitHub, the workflow lives on the default branch and runs all monitoring branches. Each one starts with the URL of the sfdx-hardis template it comes from: to upgrade it, compare it with that template. |
 | `.mega-linter.yml`, `.jscpd.json` | MegaLinter and copy-paste detection settings. The backup adds `DISABLE_ERRORS: true` to `.mega-linter.yml` when the key is missing, so that MegaLinter findings do not fail its job, and creates the file when the repository has none. |
 | `THIS_IS_MONITORING`, `DO_NOT_DEPLOY_FROM_THIS_REPO` | Empty marker files: this repository is for monitoring only. |
 

package/lib/commands/hardis/doc/project2markdown.js

@@ -49,6 +49,7 @@ import { UtilsAi } from '../../../common/aiProvider/utils/utils.js';
 import ExcelJS from 'exceljs';
 import { t } from '../../../common/utils/i18n.js';
 import { writeReportFile } from '../../../common/utils/reportFileWriteUtils.js';
+import { getMonitoringFetchDepthLinksMarkdown } from '../../../common/monitoring/monitoringTemplateLinks.js';
 Messages.importMessagesDirectoryFromMetaUrl(import.meta.url);
 const messages = Messages.loadMessages('sfdx-hardis', 'org');
 // Assets owned by sfdx-hardis, rewritten on every run so styling and behavior fixes reach a
@@ -128,10 +129,7 @@ _The alpine-based sfdx-hardis docker image does not succeed to run mermaid/puppe
 
 If Flow history doc always display a single state, you probably need to update your workflow configuration:
 
-- on Gitlab: Env variable [\`GIT_FETCH_EXTRA_FLAGS: --depth 10000\`](https://github.com/hardisgroupcom/sfdx-hardis/blob/main/defaults/monitoring/.gitlab-ci.yml#L11)
-- on GitHub: [\`fetch-depth: 0\`](https://github.com/hardisgroupcom/sfdx-hardis/blob/main/defaults/monitoring/.github/workflows/org-monitoring.yml#L62)
-- on Azure: [\`fetchDepth: "0"\`](https://github.com/hardisgroupcom/sfdx-hardis/blob/main/defaults/monitoring/azure-pipelines.yml#L46)
-- on Bitbucket: [\`step: clone: depth: full\`](https://github.com/hardisgroupcom/sfdx-hardis/blob/main/defaults/monitoring/bitbucket-pipelines.yml#L23)
+${getMonitoringFetchDepthLinksMarkdown()}
 
 ![Screenshot flow doc](https://github.com/hardisgroupcom/sfdx-hardis/raw/main/docs/assets/images/screenshot-flow-doc.jpg)