Salesforce: fix the cross-org Lead lookup, and drop the no-op sfdx logout - #8743
Merged
vdesabou merged 2 commits intoAug 6, 2026
Merged
Conversation
…e match
The three sink tests that verify their record landed in the second org ended with:
sfdx data:record:get --target-org "$SALESFORCE_USERNAME_ACCOUNT2" -s Lead \
-w "FirstName='$LEAD_FIRSTNAME' LastName='$LEAD_LASTNAME' Company=Confluent"
data:record:get requires the where-clause to identify exactly one record. The sink
connectors insert (they never upsert), so a shared org accumulates Leads, and a run
that dies before its cleanup trap leaves one behind. Any later run that redraws the
same John_$RANDOM / Doe_$RANDOM pair then fails permanently:
Error (1): FirstName='...' LastName='...' Company=Confluent is not a unique
qualifier for Lead; 2 records were retrieved.
The record the test just wrote is present and correct - the lookup simply refuses to
return it. Because the command runs under set -e, the script aborted on that line and
the following `cat /tmp/result.log` never executed, so the reason was invisible in CI
artifacts and the run only showed a bare RESULT: FAILURE.
data:query returns every match and exits 0, and the existing grep still fails when the
record is genuinely absent, so the assertion keeps its meaning. Verified against the
shared test org:
- 2 matching Leads: data:record:get exits 1, data:query exits 0 and grep passes
- 0 matching Leads: data:query returns "retrieved: 0" and grep fails, so a real
regression is still caught
- full salesforce-sobject-sink.sh run with a duplicate pre-seeded in the second org:
FAILURE before this change, SUCCESS after
`|| true` is added so cat always runs; without it set -e hides whatever went wrong.
Applied to all six affected tests, including the proxy variants.
The cleanup traps ended with:
sfdx force:auth:logout --all --no-prompt
justified by a comment claiming that "a run accumulates sessions against the same
user and later logins evict earlier ones". Both halves of that are wrong.
Salesforce enforces no per-user session cap. The Developer Edition limit of 5 is
Concurrent API Request Limits - inbound requests running 20 seconds or longer -
and it returns REQUEST_LIMIT_EXCEEDED rather than evicting anything.
force:auth:logout also makes no network call. In the sfdx-cli image these tests
use (sfdx-cli 7.209.6, plugin-auth 2.8.4, @salesforce/core 4.3.10) it resolves to
deleting ~/.sfdx/<user>.json; there is no reference to services/oauth2/revoke
anywhere in either package. It never released a server-side session, so the
sessions it claimed to release lapsed on their idle timeout either way.
It is also redundant: the sfdx-cli container is recreated per test, which is why
every login logs "Config folder does not exists, Creating Folder". The auth store
already starts empty.
What it did do is delete credentials that later steps still need. Querying the
second org after a test consistently failed with
Error (1): Parsing --target-org
No authorization information found for <user>.
until the account was re-authenticated. That breaks any step added after cleanup
and makes post-run debugging against the container needlessly awkward.
Verified: salesforce-sobject-sink.sh passes with the call removed, and a query
against the second org afterwards now succeeds with no re-login.
vdesabou
approved these changes
Aug 6, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Two independent fixes to the Salesforce tests. Both verified against the shared test org.
1. The cross-org Lead lookup rejected duplicates
The sink tests that verify their record reached the second org intermittently failed at the
very end, with every assertion already green and no error shown:
Cause
data:record:getrequires the where-clause to resolve to exactly one record:The sink connectors insert — never upsert — so a shared org accumulates Leads, and any
run that dies before its cleanup trap leaves one behind.
LEAD_FIRSTNAMEisJohn_$RANDOM(0–32767), so a later run redrawing that pair fails permanently, even though the record
it just wrote is present and correct. The org used for these tests holds ~500
Company='Confluent'Leads, so orphans accumulate and each poisons its own name pair.The error was invisible in CI because the command runs under
set -e, so the followingcat /tmp/result.lognever executed — the run showed only a bareRESULT: FAILURE.Fix
data:queryreturns every match and exits 0. The existinggrepstill fails when therecord is genuinely absent, so the assertion keeps its meaning — it just stops requiring a
uniqueness the tests never guaranteed.
|| trueis added socatalways runs.Verification
data:record:getdata:querygreppassesretrieved: 0,grepfails — regression still caughtFull
salesforce-sobject-sink.shrun with one duplicate pre-seeded in the second org:RESULT: FAILURE,is not a unique qualifier for Lead; 2 records were retrievedRESULT: SUCCESS,/tmp/result.logshowing both rowsApplied to all six affected tests, including the proxy variants.
2.
sfdx force:auth:logout --allin cleanup was a no-op that broke later stepsThe cleanup traps ended with a logout, justified by a comment claiming a run "accumulates
sessions against the same user and later logins evict earlier ones". Both halves are wrong:
Request Limits (requests running ≥20s) and returns
REQUEST_LIMIT_EXCEEDEDrather thanevicting.
sfdx-cli 7.209.6,plugin-auth 2.8.4,@salesforce/core 4.3.10) it resolves to deleting~/.sfdx/<user>.json; there is no reference toservices/oauth2/revokein eitherpackage. Sessions lapsed on idle timeout either way.
Config folder does not exists, Creating Folderon every login. The store already startsempty.
What it did do is delete credentials later steps need. Querying the second org after a test
consistently failed with
No authorization information found for <user>until the accountwas re-authenticated.
Verified:
salesforce-sobject-sink.shpasses with the call removed, and a query againstthe second org afterwards now succeeds with no re-login — previously it always failed.
bash -nclean on all changed files.