
Security News
vlt Launches "reproduce": A New Tool Challenging the Limits of Package Provenance
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
sfdx-git-delta
Advanced tools
Generate the sfdx content in source format and destructive change from two git commits
Generate the sfdx content in source format and destructive change from two git commits
SFDX-Git-Delta (*a.k.a. sgd*) helps Technical Architects accomplish 2 things with their CI deployments:
If you are not a Salesforce Architect or Developer, probably not, sorry.
If you are a Technical Architect or Developer, then it’s a very useful tool for you, when the 3 conditions below are met:
Your Salesforce project uses a git repo as the source of truth.
➕
You use the Source (DX) format in the repo.
➕
You have a CI/CD pipeline (Jenkins, Bitbucket Pipelines, GitLab CI, GitHub Actions, Azure DevOps...) that handles the deployment of the sources to the Salesforce org(s).
DISCLAIMER:
⚠️ SFDX-Git-Delta is not an officially supported tool ⚠️
👷 Use it at your own risk, wear a helmet, and test it first before adding it to your pipeline 🔥
npm install sfdx-git-delta@latest -g
If you run your CI jobs inside a Docker image (which is very common), you can add sgd to your image, such as in this example: https://hub.docker.com/r/mehdisfdc/sfdx-cli-gitlab/dockerfile
To see the full list and description of the sgd options, run sgd --help
-V, --version output the version number
-t, --to [sha] commit sha to where the diff is done [HEAD] (default: "HEAD")
-f, --from [sha] commit sha from where the diff is done [git rev-list —max-parents=0 HEAD]
-o, --output [dir] source package specific output [./output] (default: "./output")
-a, --api-version [version] salesforce API version [48] (default: "48")
-i, --ignore specify the ignore file (default: ".forceignore")
-r, --repo [dir] git repository location [./repo] (default: "./repo")
-d, --generate-delta generate delta files in [./output] folder
-h, --help output usage information
Works in Unix like system. Windows is not tested.
Git command line is required on the system where the command line is running.
sgd --to HEAD --from HEAD^ --repo . --output .
echo "--- package.xml generated with added and modified metadata ---"
cat package/package.xml
echo
echo "---- Deploying added and modified metadata ----"
sfdx force:source:deploy -x package/package.xml
echo "--- destructiveChanges.xml generated with deleted metadata ---"
cat destructiveChanges/destructiveChanges.xml
echo
echo "--- Deleting removed metadata ---"
sfdx force:mdapi:deploy -d destructiveChanges --ignorewarnings
Let’s take a look at the following scenario:
The CI pipelines deploys the sources to Production anytime there is a new commit in the master branch.
In our example, the latest commit to master is composed of:
In this situation, we would expect the CI pipeline to:
So let’s do it!
From the project repo folder, the CI pipeline will run the following command
sgd --to HEAD --from HEAD^ --repo . --output .
which means:
Analyse the difference between HEAD (latest commit) and HEAD^ (previous commit), from the current folder, and output the result in the same folder.
The sgd
command produces 2 usefull artefacts:
1) A package.xml
file, inside a package
folder. This package.xml file contains only the metadata that has been added and changed, and that needs to be deployed in the target org.
Content of the package.xml
file in our scenario:
2) A destructivePackage.xml
file, inside a destructivePackage
folder. This destructivePackage.xml file contains only the metadata that has been removed or renamed, and that needs to be deleted from the target org. Note: the destructivePackage
folder also contains a minimal package.xml file because deploying destructive changes requires a package.xml (even an empty one) in the payload.
Content of the destructivePackage.xml
file in our scenario:
In addition, we could also have generated a copy of the force-app folder with only the added and changed metadata, by using the --generate-delta (-d)
option (more on that later).
The CI pipeline can use the package/package.xml
file to deploy only this subset of metadata:
echo "--- package.xml generated with added and modified metadata ---"
cat package/package.xml
echo
echo "---- Deploying added and modified metadata ----"
sfdx force:source:deploy -x package/package.xml
The CI pipeline can use the destructiveChanges
folder to deploy the corresponding destructive change:
echo "--- destructiveChanges.xml generated with deleted metadata ---"
cat destructiveChanges/destructiveChanges.xml
echo
echo "--- Deleting removed metadata ---"
sfdx force:mdapi:deploy -d destructiveChanges --ignorewarnings
And voilà! 🥳
Using a package.xml file to deploy a subset of the metadata is propably the simpliest approach to delta deployments. But there are some situations where you may want to have the actual source files related to all the components that have been changed recently.
One example is to speed up object deployments: the package.xml approach will result on the entire sub-folder for a given object to be deployed. On the opposite, having a copy of the actual sources added/modified allows you to chirchugically deploy only the modified components.
This is where the --generate-delta (-d)
option comes handy!
Let's use this option with our previous example:
mkdir changed-sources
sgd --to HEAD --from HEAD^ --repo . --output changed-sources/ --generate-delta
In addition to the package
and destructiveChanges
folders, the sgd
command will also produce a copy of the added/changed files in the ouput folder.
Content of the output folder when using the --generate-delta option, with the same scenario as above:
var sgd = require('sfdx-git-delta');
const work = sgd({
'to':'', // commit sha to where the diff is done. Default : HEAD
'from':'', // commit sha from where the diff is done. Default : git rev-list --max-parents=0 HEAD
'output':'', // source package specific output. Default : ./output
'apiVersion':'', // salesforce API version. Default : 46
'repo':'' // git repository location. Default : ./repo
});
console.log(JSON.stringify(work));
/* {
* config: config,
* diffs: { package: {...}, destructiveChanges: {...} },
* warnings: []
* }
*/
SemVer is used for versioning.
Contributions are what make the trailblazer community such an amazing place. I regard this component as a way to inspire and learn from others. Any contributions you make are greatly appreciated.
See contributing.md for lwcc principles.
This project is licensed under the MIT License - see the LICENSE.md file for details
FAQs
Generate the sfdx content in source format and destructive change from two git commits
The npm package sfdx-git-delta receives a total of 73,005 weekly downloads. As such, sfdx-git-delta popularity was classified as popular.
We found that sfdx-git-delta demonstrated a healthy version release cadence and project activity because the last version was released less than a year ago. It has 0 open source maintainers collaborating on the project.
Did you know?
Socket for GitHub automatically highlights issues in each pull request and monitors the health of all your open source dependencies. Discover the contents of your packages and block harmful activity before you install or update your dependencies.
Security News
vlt's new "reproduce" tool verifies npm packages against their source code, outperforming traditional provenance adoption in the JavaScript ecosystem.
Research
Security News
Socket researchers uncovered a malicious PyPI package exploiting Deezer’s API to enable coordinated music piracy through API abuse and C2 server control.
Research
The Socket Research Team discovered a malicious npm package, '@ton-wallet/create', stealing cryptocurrency wallet keys from developers and users in the TON ecosystem.