busbar-actions/Busbar Anonymize & Extract

Extract data from a source Salesforce org, anonymize it, and load it into a target sandbox

Trust Signals

Scorecard Score: not yet scored
Maintenance Recency: Activelast commit Jun 7, 2026
License: None

Pinned Snippet

workflow.ymlSHA-pinned

uses: busbar-actions/sf-anonymize-extract@d2e57baee5b581eaddc21f0c0756bde0cefcdcd8 # no releases — HEAD as of 2026-07-11

tags can be moved; commit SHAs can't. why a SHA?

Inputs

name	description	required	default
source-instance	Instance URL of the SOURCE org (a Salesforce org with Busbar installed and trust established), e.g. https://yourdomain.my.salesforce.com. Mapped to SF_SOURCE_INSTANCE_URL; the source session self-mints its own short-lived token via GitHub OIDC, bound to this org. Requires the caller job to grant `permissions: id-token: write`.	no	""
target-instance	Instance URL of the TARGET org (a Salesforce org with Busbar installed and trust established). Mapped to SF_TARGET_INSTANCE_URL; the target session self-mints in-process via GitHub OIDC, bound to this org. Required unless dry-run=true.	no	""
config-file	Pipeline config (YAML): extraction mapping, anonymization rules, load settings.	yes	—
dry-run	Extract and anonymize but do NOT load into the target org.	no	false
snapshot	Snapshot the target objects before load so the run can be rolled back.	no	true
rollback-on-failure	If the load partially fails, surface the backup-id for MANUAL rollback (v1: no automated in-place restore).	no	true
validate-residual-pii	Run the PII validator on the anonymized data BEFORE loading. Aborts the load if the threshold is breached.	no	true
residual-pii-fail-on	Abort load if anonymized data still contains PII at or above this severity. Same scale as pii-scan.	no	high
output-dir	Where extracted data, anonymized data, and the run report are written.	no	.busbar/pipeline-runs
upload-artifact	Upload the run report (NOT the data) as a workflow artifact.	no	true
artifact-name	Artifact name when upload-artifact=true.	no	pipeline-run
upload-data	Also upload the extracted+anonymized data as an artifact. Off by default — anonymized data can still be sensitive.	no	false
version	Release tag of the sf-anonymize-extract binary. Falls back to env.BUSBAR_ACTION_VERSION, then "latest".	no	""
binary-repo	GitHub repo hosting prebuilt binary releases. Falls back to env.BUSBAR_ACTION_REPO, then busbar-actions/actions-dist.	no	""

Outputs

name	description
status	One of: success, dry-run, residual-pii-blocked, failed.
operation-id	Pipeline operation ID.
backup-id	Snapshot/backup ID for MANUAL rollback (empty if no snapshot taken).
records-extracted	Records extracted from the source org.
records-loaded	Records successfully loaded into the target org.
records-failed	Records that failed to load.
residual-pii-count	PII findings remaining in the anonymized data at or above residual-pii-fail-on.
report-path	Path to the run report JSON.