A CI pipeline

The promotion model assumes git is the source of truth. The pipeline below runs on every push to main that touches the templates/ directory: it installs the CLI and plugin, authenticates to prod, validates the artefacts offline, previews the diff against the target org, then imports with --fail-on-warnings so any warning rolls the build back.

name: Promote templates to prod

on:
  push:
    branches: [main]
    paths: ['templates/**']

jobs:
  promote:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - uses: actions/setup-node@v4
        with:
          node-version: 20

      - name: Install sf CLI and plugin
        run: |
          npm install -g @salesforce/cli
          sf plugins install @Sliick/sfdx-plugin

      - name: Authenticate
        run: |
          echo "${{ secrets.SFDX_AUTH_URL }}" | sf org login sfdx-url --sfdx-url-stdin --alias prod

      - name: Validate artefacts
        run: sf Sliick docs validate templates/

      - name: Preview changes
        run: sf Sliick docs diff templates/ --target-org prod

      - name: Import
        run: sf Sliick docs import templates/ --target-org prod --fail-on-warnings

If you prefer JWT auth over sfdx-url, swap the Authenticate step:

      - name: Authenticate (JWT)
        run: |
          echo "${{ secrets.JWT_KEY }}" > server.key
          sf org login jwt \
            --username ${{ secrets.SF_USERNAME }} \
            --jwt-key-file server.key \
            --client-id ${{ secrets.SF_CLIENT_ID }} \
            --alias prod