deploying-ui-bundle
MUST activate when the project contains a uiBundles/*/src/ directory or sfdx-project.json and the task involves deploying, pushing to an org, or post-deploy setup. Use this skill when deploying a UI bundle app to a Salesforce org. Covers the full deployment sequence: org authentication, pre-deploy build, metadata deployment, permission set assignment, data import, GraphQL schema fetch, and codegen. Activate when files like *.uibundle-meta.xml or sfdx-project.json exist and the user mentions depl
Security Assessment
About deploying-ui-bundle
A deployment-sequencing skill for shipping a UI bundle application to a Salesforce org, where the order of operations is critical. It activates when a project contains a `uiBundles/*/src/` directory or `sfdx-project.json` and the task involves deploying, pushing to an org, or post-deploy setup, including when files like `*.uibundle-meta.xml` or `sfdx-project.json` exist and the user mentions deploying or org setup. It lays out the canonical end-to-end flow from authentication through final build.
The sequence begins by checking and, if needed, authenticating the org, since all later steps require it. Next it installs dependencies and builds the UI bundle to produce `dist/`, required before deploying UI bundle entities. Metadata deployment then checks for a manifest (`manifest/package.xml` or `package.xml`) and deploys via the manifest if present, otherwise deploying all project metadata—objects, layouts, permission sets, Apex classes, UI bundles, and more—which must complete before schema fetch because the schema reflects org state. Post-deploy configuration assigns permission sets and groups (required for GraphQL introspection to return the correct schema), ensures correct profiles, and sets up named credentials, connected apps, custom settings, and flow activation; after a successful deploy it proactively discovers permission sets under `force-app/main/default/permissionsets/` and assigns each one or asks the user.
Optional data import runs only when `data/data-plan.json` exists, deleting in reverse plan order (children before parents) and importing via Anonymous Apex with duplicate-rule save enabled, always with user confirmation. Finally it sets the default org, fetches the GraphQL schema via introspection (writing `schema.graphql` at the project root), runs codegen against the local schema, and builds the UI bundle if not already built. Critical rules emphasize deploying metadata before fetching schema, assigning permissions before schema fetch so field-level security is correct, and re-running schema fetch and codegen after every metadata deployment that changes objects, fields, or permissions—never silently skipping permission assignment or data import.
FAQ
Why does the order of operations matter so much?
Because the GraphQL schema reflects org state. Metadata must be deployed and permissions assigned before fetching the schema, otherwise custom objects and fields will be missing or hidden by field-level security.
When is the UI bundle built during deployment?
Before deploying UI bundle entities, dependencies are installed and the bundle is built to produce `dist/`. A final build runs at the end if it was not already done earlier.
How does it decide how to deploy metadata?
It checks for a manifest (`manifest/package.xml` or `package.xml`) first and deploys using it if present; otherwise it deploys all metadata from the project.
When does it import data?
Only if `data/data-plan.json` exists. Deletion runs in reverse plan order (children before parents) and import uses Anonymous Apex with duplicate-rule save enabled, always after asking the user.
What must I do after changing objects or permissions?
Re-run the GraphQL schema fetch and codegen. The schema and generated types only reflect the new state after deployment and permission assignment.
Install deploying-ui-bundle
Quick Setup:
- Copy the skill folder to
.claude/skills/ - Claude will automatically detect and use the skill
Repository
forcedotcom/sf-skills