Controlled AI-assisted delivery, DevSecOps and compliance engineering, written from inside environments where somebody eventually has to answer for the outcome. 3 posts and counting.
How do you raise a Copado user story when there is no metadata to deploy, only a script that has to run? The story is still the unit of work. Commit the script to the story branch, let a Function or a manual task execute it, and keep the evidence inside the pipeline where it belongs.
Merging Salesforce security metadata does not resolve the disagreement between two branches. It just makes the disagreement happen automatically, on the way to production, with nobody watching. Keep an approved Golden Set in its own branch, overwrite the promotion branch before Salesforce sees it, and there is nothing left to merge.
Real Copado release management is chaos with a suit on. Everything looks mostly green until you hit validate, back promote or prod deploy, and then a component is missing: the team swears it was deployed, the pipeline swears it was validated, and you are stuck in the gap between what Salesforce contains and what Copado believes is in scope.
