Governance-first Salesforce DevOps.
GlassOps is a CI-agnostic command line tool that acts as the CI/CD layer for Salesforce delivery, with other platforms possible later. It is written in Go and replaces the older GitHub Action runtime that this repository once held. It is early work, not a finished product.
v0.3.0 is released as a prerelease, with a container image at ghcr.io/glassops-platform/glassops:0.3.0. The next release adds the commands env, test, run, check and analyze, the reusable GitHub workflows, and a separate glassops-analyzer image (ghcr.io/glassops-platform/glassops-analyzer) that adds Java and the Code Analyzer for analyze. Until then, build from a checkout to use them.
The CLI lives at the repository root (cmd/, internal/, schemas/). Each step is its own command, and glassops run runs a whole pipeline of them.
| Command | What it does |
|---|---|
init |
Detects the provider and CI system, then writes glassops.yaml and a CI file |
doctor |
Checks the config, tools, git checkout and environment variables. With --auth it also logs in to targets |
describe |
Logs in to a target, runs the org Id guard and records what the target reports |
plan |
Works out the change set between two git refs |
validate |
Runs a check-only validate of the change set. On a scratch org it first seeds what a destructive change needs |
gate |
Evaluates the policy rules for a target into a signed PERMIT |
permit verify |
Checks that a PERMIT is signed, unexpired and bound to this target, commit, plan and config |
deploy |
Deploys the change set, only under a valid PERMIT, then moves the deployed tag |
report |
Summarises every result as markdown and SARIF |
env create, env delete, env sweep |
Create, delete and sweep ephemeral scratch orgs that later steps use |
test |
Runs Apex tests with coverage on a target and writes JUnit XML |
check |
Runs your own project scripts |
analyze |
Runs the Code Analyzer and records violation counts. Needs analyze.enabled: true and the glassops-analyzer image |
run |
Runs a named pipeline from glassops.yaml, such as the default pr and deploy |
Commands exit 0 on pass, 1 on a failed check and 2 on a tool error, and every command except report writes a result file to .glassops/results/. See the CLI reference, the configuration reference, PERMIT and rules, Run a pipeline and the GitHub deploy guide.
- Architecture overview:
overview.md - Vision:
vision.md - CLI reference:
cli.md - Configuration reference:
config.md - PERMIT and rules:
permit-and-rules.md - Run a pipeline:
run-a-pipeline.md - Deploy with GitHub:
deploy-with-github.md - White paper (describes direction, not current functionality):
whitepaper.md - ADRs: earlier design decisions, each with a status line
Teams that:
- Already use (or want to use) GitHub Actions
- Care about auditability and compliance
- Prefer transparent systems over black boxes
The released image is ghcr.io/glassops-platform/glassops:0.3.0. To use the newer commands, build the CLI from a checkout with go build -o glassops ./cmd/glassops, or build the container image with docker build -t glassops ..
On GitHub, examples/consumer/ is the smallest working layout. It holds a glassops.yaml and two short workflows that call the reusable workflows glassops-pr.yml and glassops-deploy.yml from this repository. The deploy caller passes GLASSOPS_PERMIT_KEY by name, and the value lives only as a secret of the protected glassops-deploy environment. See the GitHub deploy guide. Or run glassops init in a Salesforce DX project to generate a similar setup.
- Report bugs or suggest features
- Improve the Go CLI
- See
CONTRIBUTING.mdfor details.
- Code: Apache 2.0. See LICENSE
- Documentation: Creative Commons Attribution 4.0 International. See docs/LICENSE
- Issues: GitHub Issues
- Author: Ryan Bumstead (@rdbumstead)
- Maintainer: Ryan Bumstead (@rdbumstead)