Skip to content

Fix: migrate off sf-jwt-login, which no longer exists upstream - #7

Open
gambe94 wants to merge 1 commit into
mainfrom
fix/sf-org-login-migration
Open

Fix: migrate off sf-jwt-login, which no longer exists upstream#7
gambe94 wants to merge 1 commit into
mainfrom
fix/sf-org-login-migration

Conversation

@gambe94

@gambe94 gambe94 commented Aug 6, 2026

Copy link
Copy Markdown
Collaborator

This workflow is broken on main right now.

shared-github-actions merged sf-jwt-login into sf-org-login behind an auth-method input and released it as v2. This workflow called sf-jwt-login@main, so it broke the moment that merge landed — the action directory no longer exists. Nothing has failed visibly yet only because this is a workflow_dispatch workflow, so it does not run until someone triggers it.

The change

-  uses: …/.github/actions/sf-jwt-login@main
+  uses: …/.github/actions/sf-org-login@v2
   with:
+    auth-method: jwt
     aws-region: …
     secret-name: …
     aws-role-arn: ${{ vars.AWS_ROLE_ARN }}
     org-alias: gabor-devhub
     set-default-dev-hub: "true"

Verification

  • All six inputs passed are declared on sf-org-login@v2
  • The job already grants id-token: write + contents: read, which is what the JWT path requires
  • actionlint 1.7.12 clean

Why @v2 and not @main

Tracking a moving default branch is precisely what turned an upstream refactor into a broken workflow here. Upstream documents @main as development-only.

Behaviour note

The merged action has different defaults from the old one — org-alias is target rather than devhub, and set-default-dev-hub is false rather than true. Both were already set explicitly here, so behaviour is unchanged.

shared-github-actions merged sf-jwt-login into sf-org-login behind an
`auth-method` input and released the result as v2. This workflow called
sf-jwt-login@main, so it broke the moment that merge landed on main — the action
directory is simply gone.

Switched to sf-org-login with `auth-method: jwt`. The other inputs are unchanged
and all six are declared on sf-org-login@v2; the job already grants the
`id-token: write` + `contents: read` the JWT path needs.

Pinned @v2 rather than @main. Tracking a moving default branch is what turned an
upstream refactor into a broken workflow here, and the upstream README calls out
@main as development-only.

Note the merged action defaults differ from the old one — org-alias `target` not
`devhub`, set-default-dev-hub false not true. Both were already explicit here, so
behaviour is unchanged.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant