Salesforce DX, Deployment & Packaging

sfdx-project.json defines package directories, versions, and dependencies.

39.1 Development models

Source of truth Org development The org (sandbox) Change sets, VS Code with manifest (package.xml) Source-driven (Salesforce DX) Version control (Git) sf CLI, scratch orgs/sandboxes, CI/CD Package development Git + versioned packages

Unlocked or managed 2GP packages, Dev Hub

39.2 Deployment options

Change sets Point-and-click between connected orgs (sandbox → production); no deletions, no version control — legacy

Metadata API (sf project deploy start) Deploy source format or package.xml manifests; supports destructive changes and quick deploy DevOps Center

Salesforce's free UI for Git-based pipelines and work items Unlocked packages

Versioned, upgradeable bundles for internal apps; metadata remains editable in the org Managed packages (2GP)

For ISVs/AppExchange; namespace, IP protection, global API contracts, push upgrades

Gearset, Copado, Flosum, AutoRABIT, Blue Canvas, Salto

# validate (check-only) with tests, then quick deploy the validated job
sf project deploy validate --source-dir force-app --test-level RunLocalTests --target-org prod
sf project deploy quick --job-id 0Afxx0000000001 --target-org prod

# manifest-based and destructive deployments
sf project generate manifest --source-dir force-app --name package.xml
sf project deploy start --manifest package.xml --post-destructive-changes destructiveChanges.xml

# test levels: NoTestRun (non-prod only), RunSpecifiedTests, RunLocalTests (prod default if Apex present), RunAllTestsInOrg
sf project deploy start --source-dir force-app --test-level RunSpecifiedTests --tests AccountServiceTest

39.3 Packaging (2GP)

sfdx-project.json defines package directories, versions, and dependencies. Promoted (released) package versions require 75% coverage. First-generation managed packages (1GP, packaging orgs) are legacy; new ISV work uses 2GP.

sf package create --name "Acme Core" --package-type Unlocked --path force-app --no-namespace
sf package version create --package "Acme Core" --installation-key-bypass --code-coverage --wait 20
sf package version promote --package "Acme Core@1.0.0-1"
sf package install --package "Acme Core@1.0.0-1" --target-org uat --wait 10

39.4 A minimal CI/CD pipeline (GitHub Actions)

Typical flow: feature branch → scratch org or dev sandbox → pull request (static analysis + validation deploy + tests) → merge → deploy to QA/UAT → release to production (quick deploy) → tag the release.

name: validate
on: [pull_request]
jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - run: npm install --global @salesforce/cli
      - run: echo "${{ secrets.SFDX_AUTH_URL }}" > auth.txt
      - run: sf org login sfdx-url --sfdx-url-file auth.txt --alias ci --set-default
      - run: sf plugins install code-analyzer
      - run: sf code-analyzer run --target force-app --severity-threshold 2
      - run: sf project deploy validate --source-dir force-app --test-level RunLocalTests --wait 60