en/level-3-release-manager/3-8-monitor-your-production-org/

[giscus[bot]]

en/level-3-release-manager/3-8-monitor-your-production-org/

Set up nightly sfdx-hardis monitoring on your Salesforce production org, read its first report, and decide which alerts are worth receiving.

https://sfdx-hardis-training.cloudity.com/en/level-3-release-manager/3-8-monitor-your-production-org/

[gbshahaq]

I'm stuck on setting up the auth variables. The docs say that "Configure Org Monitoring" will guide me through creating each variable - but it has the same inputs/outputs as "Install Org Monitoring" and now I'm stuck with this error, with no env variables configured in my monitoring repo:

GitHub refused this push: the credentials git used are not allowed to create or update workflow files (.github/workflows), they lack the workflow scope. Sign in to GitHub again with credentials that have it (in VS Code: Accounts menu, sign out of GitHub, then sign in again and accept the requested permissions, or use a personal access token with the workflow scope), then run this command again.
Command error (58s)
To https://github.com/gbshahaq/sfdx-hardis-monitoring.git
! refs/heads/monitoring_d700000009o68eae_dev_ed:refs/heads/monitoring_d700000009o68eae_dev_ed [remote rejected] (refusing to allow an OAuth App to create or update workflow .github/workflows/org-monitoring.yml without workflow scope)
Done
POST git-receive-pack (19272 bytes)
Pushing to https://github.com/gbshahaq/sfdx-hardis-monitoring.git
error: failed to push some refs to 'https://github.com/gbshahaq/sfdx-hardis-monitoring.git'

[gbshahaq]

ok- this was on me for not initialising the new local git repo first...
Now got to configure the secrets - but still got this message at completion:

GitHub refused this push: the credentials git used are not allowed to create or update workflow files (.github/workflows), they lack the workflow scope. Sign in to GitHub again with credentials that have it (in VS Code: Accounts menu, sign out of GitHub, then sign in again and accept the requested permissions, or use a personal access token with the workflow scope), then run this command again.

[gbshahaq]

Worked this one out too - I got a successful push to remote - but i was on a new branch created, so not main. Once i created a PR, merged, then i was able to continue and run the workflow.
Docs could definitely be more explicit around the steps needed around this :)

[nvuillam]

Thanks for writing down each step as you went: that is what showed me the bug, and it was ours.

When GitHub refuses the push of the workflow to main, the message says to run the command again. But the second run found nothing new to commit on main, skipped the push, and still said it was done. That is why you ended up merging the monitoring branch to get the workflow there. It is fixed in hardisgroupcom/sfdx-hardis#2364, and it will be in the next sfdx-hardis release: the second run then pushes what the refused push left behind. The doc page the command opens still said to create the workflow by hand. It now describes what the command does. And yes, Configure Org Monitoring and Install Org Monitoring run the same command.

Lab 3.8 now says not to merge the monitoring branch into main. It also says that each run makes a new certificate, so the two secrets have to be the ones from the last run. That is most likely why your 12:46 run failed at login and the 13:07 one passed. It is on the site now.

Nothing to redo on your side: last night's scheduled run passed. Your main now holds a copy of the monitoring branch, which does no harm, because the job reads the org from its own branch.

[arkonautom]

a) "Clone it the way Lab 1.2 cloned this one: File > Open Folder on an empty folder" is not quite as lab used Clone Repo option instead? Options provided by Source Control are different ("Initialize repository" and "Publish to GitHub") when empty folder is open. Also "green Code button of your new repository"?
b) Launching "Install Org Monitoring" led me to secret set up as per "https://sfdx-hardis.cloudity.com/salesforce-monitoring-config-github/" with "For each variable the sfdx-hardis command Configure org monitoring tells you to define" where I am missing "name and value given in the sfdx-hardis command logs".
Lied "yes" on question about git config and got "GitHub refused this push: ..." error. Afterwards I did prod part of reference Lab 3.1 and got things somewhat working ... but encountered warning in instruction to not push changes to main. Not tried pushing the branch created by failed install.

10 min is barely enough to read all the text. Will avoid further drift and reset monitoring repo to start over (after removing extra app in prod). Discarding thousand of changes can take time, for me it was faster to stash all and discard that (or clean/commit+reset).

[nvuillam]

Thanks for writing down each step, it made both problems easy to find.

a) You are right, Lab 3.8 contradicted Lab 1.2. Lab 1.2 clones with no folder open, and with an empty folder open Source Control only offers Initialize Repository and Publish to GitHub, as you saw. An empty repository has no green Code button either: the address is in the Quick setup box. Step 1 now says File > New Window, then Clone Repository with the address from Quick setup. The "35 minutes" in Before you start was wrong too. Both are on the site once #351 is merged.

b) The names and values of the two secrets only exist once the command reaches the certificate: it stops there (step 5) and prints them, and that is when the doc page means you to create them. GitHub refused this push is the workflow permission: Accounts icon, sign out of GitHub, then Install Org Monitoring again and accept what it asks. That is the first entry of If it goes wrong. Your monitoring repository only has its initial commit on main, so starting over from there is fine.

[arkonautom]

I got confused by "The second answer ... opens that page and ends the command" part, as if not to press it, got stuck and went sideways (ignoring the rest of step 2).

[arkonautom]

Few more things that were unclear to me and required a pause to consider whether it is as expected, part of my deviated setup, etc.
a) I believe workflow scope issue is present for all people following labs. "Click the Accounts icon at the bottom of the activity bar, sign out of GitHub" explanation could be a part of happy path before "Install Org Monitoring". With a good point to sign in back at Step 8.
b) "Open the Monitoring Config Workbench panel" can be reached via "Org Monitoring" -> "Edit monitoring config".
c) Should there be guidance on suggested handling of uncommited "and a set of reports" in hardis-report of monitoring repo? They are not covered by ignore files or earlier "stage .sfdx-hardis.yml with the + on its row". Also .sfdx-hardis.[username].yml.
d) "Do: start with your mailbox Open your mailbox: the run sent an email ..." and keeps referring to it as single email further. I got 9 - 4 errors and 5 warnings.
e) hardis:org:diagnose:legacyapi gets unfinished "Starting" progress bar, sligthly confusing visually. I launched all reports and kept doing other things while glancing on a bar to progress ... before noticing smallish "completed" text below.

f) "In Detect unsecured Connected Apps, Salesforce CLI, marked Unsecured" is visible in a previos line (that needs to be unfolded) on "There are 2 unsecured Connected Apps with OAuth Tokens that are not found among installed Connected Apps. Do you want to ignore some of them in future scans ?" -> yes/no. It is followed up by "Do you want to select OAuth Tokens to delete because they are related to not installed / blocked / deleted Connected Apps?" (cli + 2 orgfarm) -> no.
g) Lab 3.7 validation rule is at force-app\main\default\objects\Installation__c\validationRules\Installation_Date_Not_Past.validationRule-meta.xml
h) "Silencing a check? Write the reason in the configuration file." - is it up to us or there is a suggested file?
i) "On helios-prod, put ActiveScratchOrgs in Track" - as a mental excercise, with no UI to act in? E.g. for "You should now see Every finding in a bucket, and ActiveScratchOrgs in Track".

[nvuillam]

Thanks for keeping notes all the way through Lab 3.8. Several of these were wrong for everybody, not just your setup.

About step 2 (your October 31 comment): you read it right, the lab never said which answer to take. The answer is Yes: the prerequisites are the two secrets, and the command gives their names and values on the way. The step now says so.

a) gbshahaq hit the same refused push a few days before you, so it is not you. It does not happen to everybody though: it depends on how git signs in to GitHub on your computer. The lab now warns about it before you click Install Org Monitoring, with the way out.

b) Right, Edit monitoring config in the Org Monitoring panel opens the same one.

c) That one is a bug in sfdx-hardis. The monitoring repository is meant to ignore hardis-report/ and config/user/, but the file that does it never made it into the published package. That is why config/user/.sfdx-hardis.nikit.yml is in commit ef75b028 of your monitoring repository. Do not commit the reports: discard them, and add hardis-report/ and config/user/ to the .gitignore of your monitoring branch. The next version of sfdx-hardis writes them for you: hardisgroupcom/sfdx-hardis#2437.

d) Also right. Many checks send an email at Warning by default, so 9 emails on a first run is normal. Steps 3 and 5 now say so.

e) A bug in the extension: a check with nothing to download (no event logs on a Developer Edition org) leaves its progress bar at "Starting...". The next version of the extension shows it as finished: hardisgroupcom/vscode-sfdx-hardis#605.

f) This one explains the reports of c) too. A card does not open a report: it runs the check again from your computer. Answer No to both questions: ignoring an app is the decision of step 6, and deleting the Salesforce CLI tokens could log your own sf out of the org. Step 5 now says the card runs the check and how to answer.

g) Yes, that is the file.

h) .sfdx-hardis.yml at the root of your monitoring branch. The Monitoring Config Workbench rewrites that file and drops comments though, so write the reason in the commit message. The tip now says that.

i) Yes, a decision with nothing to click. On a real project it would become a backlog story. Here, deciding is the exercise.

The lab changes are on the site now: #354.