From db1dc8fae3ab69d220d0a44ee3bf1ec6f5f31e27 Mon Sep 17 00:00:00 2001 From: Willie Ruemmele Date: Tue, 8 Sep 2026 12:04:09 -0600 Subject: [PATCH 1/3] chore: disable JWT auth in just-nuts to test JWTBAT Temporarily disables TESTKIT_JWT_CLIENT_ID, TESTKIT_JWT_KEY, and TESTKIT_HUB_INSTANCE env vars so the testkit falls through to AUTH_URL strategy. This forces NUTs to authenticate through the connected app with JWT-based access tokens enabled, surfacing endpoints that reject JWT tokens (e.g., Streaming/CometD 403). W-24095410 --- .github/workflows/just-nut.yml | 9 ++++++--- 1 file changed, 6 insertions(+), 3 deletions(-) diff --git a/.github/workflows/just-nut.yml b/.github/workflows/just-nut.yml index 2d2e4a07b..7fbd3ff57 100644 --- a/.github/workflows/just-nut.yml +++ b/.github/workflows/just-nut.yml @@ -60,9 +60,12 @@ jobs: TESTKIT_EXECUTABLE_PATH: sf TESTKIT_AUTH_URL: ${{ secrets.TESTKIT_AUTH_URL}} TESTKIT_HUB_USERNAME: ${{ secrets.TESTKIT_HUB_USERNAME}} - TESTKIT_JWT_CLIENT_ID: ${{ secrets.TESTKIT_JWT_CLIENT_ID}} - TESTKIT_JWT_KEY: ${{ secrets.TESTKIT_JWT_KEY}} - TESTKIT_HUB_INSTANCE: ${{ secrets.TESTKIT_HUB_INSTANCE}} + # JWTBAT: disabled JWT env vars to force AUTH_URL strategy so NUTs + # authenticate through the JWT-based-access-token-enabled connected app. + # Revert by uncommenting these three lines. + # TESTKIT_JWT_CLIENT_ID: ${{ secrets.TESTKIT_JWT_CLIENT_ID}} + # TESTKIT_JWT_KEY: ${{ secrets.TESTKIT_JWT_KEY}} + # TESTKIT_HUB_INSTANCE: ${{ secrets.TESTKIT_HUB_INSTANCE}} ONEGP_TESTKIT_AUTH_URL: ${{ secrets.ONEGP_TESTKIT_AUTH_URL }} TESTKIT_SETUP_RETRIES: 2 SF_DISABLE_TELEMETRY: true From e302780e41bf57aae4ddf22c740b3679197e2fb7 Mon Sep 17 00:00:00 2001 From: Willie Ruemmele Date: Tue, 8 Sep 2026 13:28:13 -0600 Subject: [PATCH 2/3] chore: add devhub-environment input to just-nuts workflows Adds an optional `devhub-environment` input to just-nut.yml and just-nuts.yml that selects a GitHub Environment whose secrets override the default TESTKIT_* credentials. When unspecified, behavior is identical to today (org-level secrets). This enables testing NUTs against different devhub configurations (e.g., JWT-based access tokens) without swapping org-level secrets. W-24095410 --- .github/workflows/just-nut.yml | 20 ++++++++++++++------ .github/workflows/just-nuts.yml | 15 +++++++++++++++ 2 files changed, 29 insertions(+), 6 deletions(-) diff --git a/.github/workflows/just-nut.yml b/.github/workflows/just-nut.yml index 7fbd3ff57..ab6f703c8 100644 --- a/.github/workflows/just-nut.yml +++ b/.github/workflows/just-nut.yml @@ -25,6 +25,11 @@ on: description: 'install JIT plugin before running tests' type: boolean default: false + devhub-environment: + required: false + description: 'GitHub Environment whose secrets override the default TESTKIT_* credentials. Leave empty to use org-level secrets.' + type: string + default: '' workflow_call: inputs: channel-or-version: @@ -50,22 +55,25 @@ on: description: 'install JIT plugin before running tests' type: boolean default: false + devhub-environment: + required: false + description: 'GitHub Environment whose secrets override the default TESTKIT_* credentials. Leave empty to use org-level secrets.' + type: string + default: '' jobs: just-nut: name: ${{inputs.repository}} runs-on: ${{inputs.os}} + environment: ${{ inputs.devhub-environment || '' }} env: GITHUB_TOKEN: ${{ secrets.SVC_CLI_BOT_GITHUB_TOKEN }} TESTKIT_EXECUTABLE_PATH: sf TESTKIT_AUTH_URL: ${{ secrets.TESTKIT_AUTH_URL}} TESTKIT_HUB_USERNAME: ${{ secrets.TESTKIT_HUB_USERNAME}} - # JWTBAT: disabled JWT env vars to force AUTH_URL strategy so NUTs - # authenticate through the JWT-based-access-token-enabled connected app. - # Revert by uncommenting these three lines. - # TESTKIT_JWT_CLIENT_ID: ${{ secrets.TESTKIT_JWT_CLIENT_ID}} - # TESTKIT_JWT_KEY: ${{ secrets.TESTKIT_JWT_KEY}} - # TESTKIT_HUB_INSTANCE: ${{ secrets.TESTKIT_HUB_INSTANCE}} + TESTKIT_JWT_CLIENT_ID: ${{ secrets.TESTKIT_JWT_CLIENT_ID}} + TESTKIT_JWT_KEY: ${{ secrets.TESTKIT_JWT_KEY}} + TESTKIT_HUB_INSTANCE: ${{ secrets.TESTKIT_HUB_INSTANCE}} ONEGP_TESTKIT_AUTH_URL: ${{ secrets.ONEGP_TESTKIT_AUTH_URL }} TESTKIT_SETUP_RETRIES: 2 SF_DISABLE_TELEMETRY: true diff --git a/.github/workflows/just-nuts.yml b/.github/workflows/just-nuts.yml index d983dbf40..626e871f0 100644 --- a/.github/workflows/just-nuts.yml +++ b/.github/workflows/just-nuts.yml @@ -7,12 +7,22 @@ on: required: true description: Version or channel of the CLI to test against (nightly, latest-rc, 2.1.1) type: string + devhub-environment: + required: false + description: 'GitHub Environment whose secrets override the default TESTKIT_* credentials. Leave empty to use org-level secrets.' + type: string + default: '' workflow_call: inputs: channel-or-version: required: true description: Version or channel of the CLI to test against (nightly, latest-rc, 2.1.1) type: string + devhub-environment: + required: false + description: 'GitHub Environment whose secrets override the default TESTKIT_* credentials. Leave empty to use org-level secrets.' + type: string + default: '' jobs: # plugins that use yarn:test:nuts @@ -40,6 +50,7 @@ jobs: repository: ${{ matrix.repository }} channel-or-version: ${{ inputs.channel-or-version }} os: ${{ matrix.os }} + devhub-environment: ${{ inputs.devhub-environment }} secrets: inherit jit: @@ -66,6 +77,7 @@ jobs: channel-or-version: ${{ inputs.channel-or-version }} os: ${{ matrix.os }} jit: true + devhub-environment: ${{ inputs.devhub-environment }} secrets: inherit packaging: @@ -83,6 +95,7 @@ jobs: channel-or-version: ${{ inputs.channel-or-version }} os: ${{ matrix.os }} command: ${{ matrix.command }} + devhub-environment: ${{ inputs.devhub-environment }} secrets: inherit deploy-retrieve: @@ -111,6 +124,7 @@ jobs: channel-or-version: ${{ inputs.channel-or-version }} os: ${{ matrix.os }} command: ${{ matrix.command }} + devhub-environment: ${{ inputs.devhub-environment }} secrets: inherit data: @@ -134,4 +148,5 @@ jobs: channel-or-version: ${{ inputs.channel-or-version }} os: ${{ matrix.os }} command: ${{ matrix.command }} + devhub-environment: ${{ inputs.devhub-environment }} secrets: inherit From 0fc95262b5b56cc3a52da5ff7879c4fdc7b268a8 Mon Sep 17 00:00:00 2001 From: Willie Ruemmele Date: Tue, 8 Sep 2026 15:51:04 -0600 Subject: [PATCH 3/3] chore: add max-retries input to just-nut workflow --- .github/workflows/just-nut.yml | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/.github/workflows/just-nut.yml b/.github/workflows/just-nut.yml index ab6f703c8..cb0ea5a14 100644 --- a/.github/workflows/just-nut.yml +++ b/.github/workflows/just-nut.yml @@ -30,6 +30,11 @@ on: description: 'GitHub Environment whose secrets override the default TESTKIT_* credentials. Leave empty to use org-level secrets.' type: string default: '' + max-retries: + required: false + description: 'Maximum number of retry attempts for the NUT command (default: 3)' + type: number + default: 3 workflow_call: inputs: channel-or-version: @@ -60,6 +65,11 @@ on: description: 'GitHub Environment whose secrets override the default TESTKIT_* credentials. Leave empty to use org-level secrets.' type: string default: '' + max-retries: + required: false + description: 'Maximum number of retry attempts for the NUT command (default: 3)' + type: number + default: 3 jobs: just-nut: @@ -110,5 +120,6 @@ jobs: - name: Run NUT (with retries) uses: salesforcecli/github-workflows/.github/actions/retry@main with: + max_attempts: ${{ inputs.max-retries }} retry_wait_seconds: 1800 command: ${{ inputs.command }}