DEVOPS-708 feat: add force_resolution_strategy option to update dependency task for install beta packages on sandbox orgs (#7)

jsun-clariti · coderabbitai[bot] · dipakparmar · web-flow · commit 77acbd98f021 · 2025-10-27T14:08:02.000-07:00
* DEVOPS-708 feat: add force_resolution_strategy option to UpdateDependencies task for sandbox orgs * DEVOPS-708 refactor: remove debug logging for resolution strategy in UpdateDependencies task * DEVOPS-708 fix: remove extra space Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Signed-off-by: Jessica Sun <45977467+jsun-clariti@users.noreply.github.com> * DEVOPS-708 chore: correct typo Signed-off-by: Dipak Parmar <hi@dipak.tech> * DEVOP-708 refactor: remove unnecessary blank lines in test_org_import_rejects_username_and_pool_id * DEVOPS-708 refactor: improve resolver removal logic in UpdateDependencies task * DEVOPS-708 fix: update error message for SF alias failure in test_set_sf_alias_failure * DEVOPS-708 refactor: remove unnecessary logging in test_init_options_force_resolution_strategy_sandbox * DEVOPS-708 refactor: remove redundant checks Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Signed-off-by: Jessica Sun <45977467+jsun-clariti@users.noreply.github.com> --------- Signed-off-by: Jessica Sun <45977467+jsun-clariti@users.noreply.github.com> Signed-off-by: Dipak Parmar <hi@dipak.tech> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: Dipak Parmar <hi@dipak.tech>
diff --git a/cumulusci/tasks/salesforce/tests/test_update_dependencies.py b/cumulusci/tasks/salesforce/tests/test_update_dependencies.py
@@ -186,6 +186,83 @@ def test_init_options_removes_unsafe_resolvers_persistent_org():
     )
     task.org_config = mock.Mock()
     task.org_config.scratch = False
+    task.org_config.is_sandbox = True
+
+    assert DependencyResolutionStrategy.BETA_RELEASE_TAG not in task.resolution_strategy
+    assert (
+        DependencyResolutionStrategy.COMMIT_STATUS_RELEASE_BRANCH
+        not in task.resolution_strategy
+    )
+
+
+def test_init_options_force_resolution_strategy_production():
+    """Test that force_resolution_strategy only checks safety for production orgs"""
+    task = create_task(
+        UpdateDependencies,
+        {
+            "dependencies": [
+                {
+                    "namespace": "ns",
+                    "version": "1.0",
+                }
+            ],
+            "resolution_strategy": "include_beta",
+            "force_resolution_strategy": True,
+        },
+    )
+    task.org_config = mock.Mock()
+    task.org_config.scratch = False
+    task.org_config.is_sandbox = False  # Production org
+
+    assert DependencyResolutionStrategy.BETA_RELEASE_TAG not in task.resolution_strategy
+    assert (
+        DependencyResolutionStrategy.COMMIT_STATUS_RELEASE_BRANCH
+        not in task.resolution_strategy
+    )
+
+
+def test_init_options_force_resolution_strategy_sandbox():
+    """Test that force_resolution_strategy allows unsafe resolvers in sandbox"""
+    org_config = mock.Mock()
+    org_config.scratch = False
+    org_config.is_sandbox = True  # Sandbox org
+    task = create_task(
+        UpdateDependencies,
+        {
+            "dependencies": [
+                {
+                    "namespace": "ns",
+                    "version": "1.0",
+                }
+            ],
+            "resolution_strategy": "include_beta",
+            "force_resolution_strategy": True,
+        },
+        project_config=None,
+        org_config=org_config,
+    )
+    assert DependencyResolutionStrategy.BETA_RELEASE_TAG in task.resolution_strategy
+
+
+def test_init_options_force_resolution_strategy_false():
+    """Test that when force_resolution_strategy is False, safety checks apply to all persistent orgs"""
+    org_config = mock.Mock()
+    org_config.scratch = False
+    org_config.is_sandbox = False  # Production org
+    task = create_task(
+        UpdateDependencies,
+        {
+            "dependencies": [
+                {
+                    "namespace": "ns",
+                    "version": "1.0",
+                }
+            ],
+            "resolution_strategy": "include_beta"
+        },
+        project_config=None,
+        org_config=org_config,
+    )
 
     assert DependencyResolutionStrategy.BETA_RELEASE_TAG not in task.resolution_strategy
     assert (
diff --git a/cumulusci/tasks/salesforce/update_dependencies.py b/cumulusci/tasks/salesforce/update_dependencies.py
@@ -64,6 +64,9 @@ class UpdateDependencies(BaseSalesforceTask):
         "base_package_url_format": {
             "description": "If `interactive` is set to True, display package Ids using a format string ({} will be replaced with the package Id)."
         },
+        "force_resolution_strategy": {
+            "description": "If True, forces the use of the specified resolution_strategy on scratch and sandbox orgs. Defaults to False."
+        },
         **{k: v for k, v in PACKAGE_INSTALL_TASK_OPTIONS.items() if k != "password"},
     }
 
@@ -138,18 +141,31 @@ def _init_options(self, kwargs):
             DependencyResolutionStrategy.BETA_RELEASE_TAG,
         ]
 
-        if (
-            self.org_config
-            and not self.org_config.scratch
-            and any(r in self.resolution_strategy for r in unsafe_prod_resolvers)
-        ):
+        force_strategy = process_bool_arg(self.options.get("force_resolution_strategy", False))
+        if force_strategy:
+            self.logger.warning(
+                "The force_resolution_strategy option is turned on and dependency resolution will be forced on scratch and sandbox orgs."
+            )
+
+        # Only remove resolvers for:
+        # 1. Non-scratch production orgs when force_strategy is True
+        # 2. All non-scratch orgs when force_strategy is False
+        should_remove_resolvers = (
+            self.org_config  # Have an org config
+            and not self.org_config.scratch  # Not a scratch org
+            and (
+                not force_strategy  # Remove for all non-scratch orgs
+                or (force_strategy and not self.org_config.is_sandbox)  # Remove for production orgs only
+            )
+        )
+
+        if should_remove_resolvers and any(r in self.resolution_strategy for r in unsafe_prod_resolvers):
             self.logger.warning(
                 "Target org is a persistent org; removing Beta resolvers. Consider selecting the `production` resolver stack."
             )
             self.resolution_strategy = [
                 r for r in self.resolution_strategy if r not in unsafe_prod_resolvers
             ]
-
         if (
             "prefer_2gp_from_release_branch" in self.options
             or "include_beta" in self.options
diff --git a/cumulusci/tests/test_cli_org_import.py b/cumulusci/tests/test_cli_org_import.py
@@ -14,8 +14,6 @@ def _load_keychain(self):
         # Tests bypass actual keychain loading.
         pass
 
-
-def test_org_import_rejects_username_and_pool_id(tmp_path):
 def test_org_import_rejects_username_and_pool_id(tmp_path):
     runner = CliRunner()
     runtime = FakeRuntime()
diff --git a/cumulusci/tests/test_utils_clariti.py b/cumulusci/tests/test_utils_clariti.py
@@ -180,7 +180,7 @@ def fake_run(command, check, text, capture_output, env):
     success, message = set_sf_alias("target", "username")
 
     assert success is False
-    assert message is not None and message.startswith("Clariti alias failed")
+    assert message is not None and message.startswith("Failed to set SF alias")
     assert "Alias failure" in message
 
 
diff --git a/docs/config.md b/docs/config.md
@@ -46,6 +46,16 @@ functionality to suit your project's specific needs.
 If you repeatedly specify the same value for an option while running a
 task, you can configure CumulusCI to use that value as a default value.
 
+For example: Let's configure the update_dependencies task to force resolution strategies in sandbox orgs. The task's `force_resolution_strategy` option controls whether to force the use of specified resolution strategies even in persistent orgs:
+
+```yaml
+update_dependencies:
+    options:
+        force_resolution_strategy: True
+```
+
+When True, this allows beta and 2GP resolvers to be used in sandbox orgs, while still enforcing safety checks in production orgs. When False (default), safety checks are enforced in all persistent orgs.
+
 For example: Let's enforce a 90% code coverage requirement for Apex
 code in your project. The `run_tests` task, which executes all Apex
 tests in a target org, can enforce code coverage at a given percentage
