Deploying permissions through Delta CI

Deploying permissions to a delta CI job can sometimes lead to confusing interactions. Delta CI deployments tend to involve two comparisons: which we will refer to as the Delta comparison (accessed via the "view delta comparison" button in CI job history) and the Main comparison (accessed via the "view comparison" button in CI job history).

To diagnose issues with delta CI deployments, it is often a good idea to compare these two comparisons, and identify differences across them.

Sometimes, when environments are out of sync, the difference type of a permission when being compared in the delta comparison, may be different to the difference type of that same permission when being compared in the main comparison. Generally, we ignore these discrepancies in difference type and, as long as the names of the permissions line up, we will deploy the permission regardless of its difference type.

However, a Delta CI job can be configured to disallow specific difference types (e.g: allowing or disallowing deletions), if the difference type of a permission changes across the two comparisons to a disallowed difference type, then the permission in question will not be deployed.

Precision selections of individual permissions are mapped between each other across the two comparisons.

Even if a permissions row is fully selected in the delta comparison (i.e: no explicit precision selections are made), only the individual permissions that were selected in the delta comparison will be selected in the main comparison, and any extra permissions present on that row in the main comparison will not be included.

Sometimes, when the difference type of an entire profile or permission set is mismatched between the delta (branch -> branch) comparison and the main (branch -> org) comparison, delta CI might not deploy the profile or permission set, on the grounds that they may not necessarily align as expected.

The table below outlines the main cases and their expected deployment behaviour: