sf project retrieve not working properly for permission sets

[gavignon]

Summary

With source tracking enabled, the command sf project retrieve start --ignore-conflicts is not working properly when we are working with Permission Set Groups.
If a permission set is changed, only the PermissionSetGroup that contains the changed permission set is retrieved instead of the permission set itself.

Steps To Reproduce

• Create a permission set group that contains a permission set
• Run command sf project retrieve start --ignore-conflicts
• Update the permission set
• Run command sf project retrieve start --ignore-conflicts

Expected result

The permission set changes should be retrieved

Actual result

Only the Permission Set Group is retrieved

System Information

{
  "architecture": "darwin-x64",
  "cliVersion": "@salesforce/cli/2.14.6",
  "nodeVersion": "node-v16.20.2",
  "osVersion": "Darwin 22.6.0",
  "rootPath": "/Users/gavignon/.npm-global/lib/node_modules/@salesforce/cli",
  "shell": "zsh",
  "pluginVersions": [
    "@oclif/plugin-autocomplete 2.3.10 (core)",
    "@oclif/plugin-commands 3.0.3 (core)",
    "@oclif/plugin-help 6.0.3 (core)",
    "@oclif/plugin-not-found 3.0.2 (core)",
    "@oclif/plugin-plugins 3.9.2 (core)",
    "@oclif/plugin-search 1.0.3 (core)",
    "@oclif/plugin-update 4.1.2 (core)",
    "@oclif/plugin-version 2.0.3 (core)",
    "@oclif/plugin-warn-if-update-available 3.0.1 (core)",
    "@oclif/plugin-which 3.0.5 (core)",
    "@salesforce/cli 2.14.6 (core)",
    "apex 2.3.20 (core)",
    "auth 2.8.22 (core)",
    "data 2.5.19 (core)",
    "deploy-retrieve 1.19.2 (core)",
    "dev 1.2.1 (user)",
    "info 2.6.49 (core)",
    "limits 2.3.39 (core)",
    "login 1.2.37 (core)",
    "marketplace 0.3.0 (core)",
    "org 2.11.4 (core)",
    "packaging 1.20.0 (user)",
    "schema 2.3.30 (core)",
    "settings 1.4.35 (core)",
    "signups 1.4.22 (user)",
    "sobject 0.2.13 (core)",
    "source 2.10.43 (core)",
    "telemetry 2.3.6 (core)",
    "templates 55.5.14 (core)",
    "trust 2.6.20 (core)",
    "user 2.3.37 (core)"
  ]
}

[github-actions]

Thank you for filing this issue. We appreciate your feedback and will review the issue as soon as possible. Remember, however, that GitHub isn't a mechanism for receiving support under any agreement or SLA. If you require immediate assistance, contact Salesforce Customer Support.

[cristiand391]

I followed your steps but can't repro

1. created psg-test and add dreamhouse permset
2. sf project retrieve start --ignore-conflicts
3. modify dreamhouse permset to add the FileUtilities apex class
4. sf project retrieve start --ignore-conflicts retrieves both the psg and permset:

does sf project retrieve preview --ignore-conflicts show anything with that org?

[gavignon]

@cristiand391 I tested with an apex class permission and it's working, could you please test with adding a FLS instead ? On my side I reproduce it with FLS.

[gavignon]

I thought it was fixed in 2.16.7 but it's finally not.

[cristiand391]

Hey, sorry for the late reply 👋🏼 triaging old issues...

I tried again as suggested adding a FLS instead, also changing object permissions in both a standard and custom object but I'm always able to retrieve both the permset and permset group

sf -v
@salesforce/cli/2.27.6 darwin-x64 node-v20.10.0

If you or anyone else experience this, getting a repro on GH would help us debug this much faster. Thanks!

[cristiand391]

Sorry, was expecting the label would trigger the GH bot. If anyone got a repro please open a new issue as it might be a MD-specific bug.