Fork-Safe Salesforce Continuous Integration

Overview

Separate deterministic untrusted-code checks from credentialed org validation so pull requests cannot access Salesforce secrets or mutate a customer org.

Prerequisites

• Repository, Salesforce DX project, package layout, branch policy, and immutable dependency lock
• Synthetic metadata and API fixtures plus an authorized validation org
• CI, Salesforce admin, security, release, and code owners with environment protection rules

Tool Discipline

Use Read, Glob, and Grep to inspect approved repository and evidence files, WebFetch to re-check current first-party Salesforce documentation, and Write or Edit only for secretless plans, fixtures, configuration, and redacted receipts.

Current Contract

Salesforce CLI can validate and deploy source against authorized orgs, but exact commands, test levels, authentication, and metadata behavior vary with the pinned CLI and project. Fork pull requests must be treated as untrusted.