busbar-actions/Busbar — sf-cli
Run a declarative Salesforce CLI action inside a managed nono capability sandbox with a version-pinned sf install and a full audit trail.
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Stale
- License
- None
Inputs
| name | description | required | default |
|---|---|---|---|
| action | The declarative action as an SfAction JSON document (e.g. {"action":"data_query","target_org":"my-org","soql":"SELECT Id FROM Account"}). | yes | — |
| target-instance | Instance URL of the Busbar-equipped Salesforce org to mint a session against via GitHub OIDC (no trailing slash). REQUIRED for the default OIDC auth path; the job must grant `permissions: id-token: write`. | no | "" |
| eca-client-id | Consumer key of the External Client App in the Busbar-equipped org (non-secret). Defaults to the baked public key when empty. | no | "" |
| token-handler | Apex token-exchange handler dev name. Defaults to `GitHubTokenExchangeHandler` when empty. | no | "" |
| oidc-audience | OIDC token audience. Defaults to `target-instance` when empty. | no | "" |
| sf-cli-version | npm version spec for `@salesforce/cli` to install (e.g. `2.69.6`, or `latest`). Pin an exact version for reproducibility. | no | latest |
| working-dir | Working directory for the `sf` invocation. | no | "" |
| output | Path to write the structured `sf` result JSON (in addition to stdout). | no | "" |
| audit-out | Path to write the JSON audit log for this run. | no | .busbar/logs/sandbox-audit.json |
| artifact-name | Name for the uploaded sandbox audit + generalized-fingerprint artifact. Must be UNIQUE within a workflow run (set a distinct value per sf-cli step). | no | busbar-sandbox-sf |
| version | Release tag of the sf-cli binary. Falls back to env.BUSBAR_ACTION_VERSION, then "latest". | no | "" |
| binary-repo | GitHub repo hosting prebuilt binary releases. Falls back to env.BUSBAR_ACTION_REPO, then busbar-actions/actions-dist. | no | "" |
Outputs
| name | description |
|---|---|
| success | "true" when the action executed successfully. |
| duration-ms | Wall-clock duration of the sf invocation in milliseconds. |
| risk-level | Inherent risk level of the action (low | medium | high | critical). |
| sandbox-enforced | "true" when kernel-enforced confinement was applied. |
| audit-path | Path to the JSON audit log written for this run. |
| result-path | Path to the structured sf result JSON (only when `output` was set). |
| sf-cli-path | Path to the managed sf binary installed for this run. |
| sf-cli-prefix | Prefix directory containing the managed sf install. |
| sf-cli-version | Version of @salesforce/cli that was installed. |