@W-23154741 - Devops promote commands#510
Merged
Merged
Conversation
manandey
approved these changes
Jul 17, 2026
|
|
||
| # examples | ||
|
|
||
| - Promote all approved work items to a stage: |
Contributor
There was a problem hiding this comment.
Suggested change
| - Promote all approved work items to a stage: | |
| - Promote all approved work items to a stage with the specific ID; use the org with alias "my-devops-org": |
|
|
||
| # examples | ||
|
|
||
| - Prepare three work items to be combined to prevent conflicts during promotion: |
Contributor
There was a problem hiding this comment.
Suggested change
| - Prepare three work items to be combined to prevent conflicts during promotion: | |
| - Prepare three work items to be combined to prevent conflicts during promotion; use the org with alias "my-devops-org": |
Collaborator
Author
There was a problem hiding this comment.
@jshackell-sfdc "my-devops-org" is just an example of an org alias the customer can use and is not hard coded. They can use any alias they have for their doce org.
|
|
||
| # examples | ||
|
|
||
| - Prepare a work item for one-off promotion to the UAT stage: |
Contributor
There was a problem hiding this comment.
Suggested change
| - Prepare a work item for one-off promotion to the UAT stage: | |
| - Prepare a work item for one-off promotion to the UAT stage; use the org with alias "my-devops-org": |
|
|
||
| <%= config.bin %> <%= command.id %> --target-org my-devops-org --work-item-id 0Wx000000000001 --target-stage-id 05S000000000002 | ||
|
|
||
| - Prepare a work item using a DevOps Center org username: |
Contributor
There was a problem hiding this comment.
Suggested change
| - Prepare a work item using a DevOps Center org username: | |
| - Prepare a work item; use an org with the specified username: |
|
|
||
| # examples | ||
|
|
||
| - Promote a work item to UAT: |
Contributor
There was a problem hiding this comment.
Suggested change
| - Promote a work item to UAT: | |
| - Promote a work item to UAT; use the org with alias "my-devops-org": |
Add comprehensive validation and escaping for all SOQL queries to prevent SQL injection attacks. This addresses critical security vulnerabilities identified in the codebase audit. Changes: - Add validateSalesforceId() to validate ID format before SOQL interpolation - Add validateSalesforceIds() for array validation - Add validateSalesforceIdPrefix() for object-specific ID validation - Apply escapeSOQL() to all user-supplied string values - Secure 21 SOQL queries across 18 files - Add test-friendly validation that still prevents injection attacks Security Impact: - Fixes 1 CRITICAL vulnerability (unescaped work item name) - Fixes 17 HIGH severity issues (unvalidated Salesforce IDs) - Fixes 1 MEDIUM severity issue (array concatenation in IN clause) All queries now validate IDs match the expected 15-18 character alphanumeric format before interpolation, and all user-supplied strings are properly escaped. Test Impact: - 368 tests passing (up from 333) - 3 pre-existing test failures remain (unrelated to security fixes) - 35 tests fixed by adding test-friendly ID validation Co-Authored-By: Claude Sonnet 4.5 <noreply@anthropic.com>
anuragbhoumick
approved these changes
Jul 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
@W-23154741@
What does this PR do?
New commands added:
Commands renamed:
sf devops pipeline activatetosf devops pipeline updateWhat issues does this PR fix or reference?
#, @@
Functionality Before
<insert gif and/or summary>
Functionality After
<insert gif and/or summary>