Answers: <p>Found the issue... </p>
  
  <p>The documentation states that the "contribute" permission needs to be added to "Project Collection Build Service Accounts".
  There is also an USER called ""Project Collection Build Service". 
  After explicitly adding the "Project Collection Build Service" user to be able to contribute it worked as expected!</p>
  
Answers: CC BY-SA 4.0
Answers: 2019-08-13T15:58:11.973Z
Answers: 2019-08-13T15:58:11.973Z
Answers: Rodrigo
Body: <p>Here is the scenario: We are trying to "automate" our Salesforce development with Azure Pipelines. Since Salesforce is very unique when it comes to deploying changes, I have tried to create a Pipeline that would be manually run to save any change made into a Salesforce Sandbox back to a Branch. 
  The goal is to eventually merge these changes into other branches and deploy them into other Salesforce environments.</p>
  
  <p>We are using the the SFDX cli for such tasks within the image. Below is a copy of my yml file:</p>
  
  <pre><code>trigger:
  - developer
  
  pool:
    vmImage: 'ubuntu-latest'
  
  variables:
  - group: DeveloperVariables
  
  steps:
  - checkout: self
    persistCredentials: true
  
  - task: DownloadSecureFile@1
    inputs:
      secureFile: server.key
  - task: Bash@3
    inputs:
      workingDirectory: ''
      targetType: inline
      script: |
        wget https://developer.salesforce.com/media/salesforce-cli/sfdx-linux-amd64.tar.xz;
        mkdir sfdx;
        tar xJf sfdx-linux-amd64.tar.xz -C sfdx --strip-components 1;
        sudo ./sfdx/install;
        sfdx force:auth:jwt:grant --clientid $CONSUMER_KEY --jwtkeyfile $DOWNLOADSECUREFILE_SECUREFILEPATH --username $USERNAME --setalias developer;
        sfdx force:mdapi:retrieve -u $USERNAME -k src/package.xml -r .;
        unzip unpackaged.zip;
        cd unpackaged;
        git config --global user.email "test@test.com"
        git config --global user.name "Test User"
        git checkout -t origin/developer;
        git add .;
        git status;
        echo "This is me: ";
        whoami;
        git commit -m "Retrieved latest Developer SB changes!"
        echo "Pushing now!!!";
        git push --set-upstream origin HEAD:developer;
  </code></pre>
  
  <p>As per Microsoft's documentation found <a href="https://docs.microsoft.com/en-us/azure/devops/pipelines/scripts/git-commands?view=azure-devops&amp;tabs=yaml" rel="nofollow noreferrer">here</a>, we need to make sure we grant permissions to the build service. All the permissions have been granted as requested but we still can't get it to work.</p>
  
  <p>Below is the copy of the logs generated when we run the Pipeline:</p>
  
  <p><a href="https://i.sstatic.net/v9TOU.png" rel="nofollow noreferrer"><img src="https://i.sstatic.net/v9TOU.png" alt="enter image description here"></a></p>
  
  <pre><code>##[section]Starting: Bash
  ==============================================================================
  Task         : Bash
  Description  : Run a Bash script on macOS, Linux, or Windows
  Version      : 3.151.3
  Author       : Microsoft Corporation
  Help         : https://docs.microsoft.com/azure/devops/pipelines/tasks/utility/bash
  ==============================================================================
  Generating script.
  ========================== Starting Command Output ===========================
  [command]/bin/bash --noprofile --norc /home/vsts/work/_temp/9d534f54-57b8-44a0-8d10-2e3d8c334bbf.sh
  --2019-08-13 13:27:00--  https://developer.salesforce.com/media/salesforce-cli/sfdx-linux-amd64.tar.xz
  Resolving developer.salesforce.com (developer.salesforce.com)... 151.101.249.145
  Connecting to developer.salesforce.com (developer.salesforce.com)|151.101.249.145|:443... connected.
  HTTP request sent, awaiting response... 200 OK
  Length: 19686680 (19M) [application/x-tar]
  Saving to: ‘sfdx-linux-amd64.tar.xz’
  
       0K .......... .......... .......... .......... ..........  0% 25.6M 1s
      50K .......... .......... .......... .......... ..........  0% 27.2M 1s
          ...
   19150K .......... .......... .......... .......... .......... 99%  171M 0s
   19200K .......... .......... .....                           100%  247M=0.1s
  
  2019-08-13 13:27:00 (133 MB/s) - ‘sfdx-linux-amd64.tar.xz’ saved [19686680/19686680]
  
  sfdx installed to ‌4m&amp;#x2F;usr&amp;#x2F;local&amp;#x2F;bin&amp;#x2F;sfdx‌
  sfdx-cli/7.8.1-8f830784cc linux-x64 node-v10.15.3
  (node:3433) [EACCES] Error Plugin: sfdx-cli: EACCES: permission denied, open '/home/vsts/.cache/sfdx/lastrun'
  module: @oclif/config@1.13.0
  task: runHook init
  plugin: sfdx-cli
  root: /usr/local/lib/sfdx
  See more details with DEBUG=*
  Successfully authorized pipeline@coop.org.developer with org ID 00D560340009rbvEAA
  (node:3469) [EACCES] Error Plugin: sfdx-cli: EACCES: permission denied, open '/home/vsts/.cache/sfdx/lastrun'
  module: @oclif/config@1.13.0
  task: runHook init
  plugin: sfdx-cli
  root: /usr/local/lib/sfdx
  See more details with DEBUG=*
  this.retrieveTargetPath: /home/vsts/work/1/s
  Retrieving source...
  
  === Status
  Status:  InProgress
  jobid:  09S56000001G6fmEAC
  ...
  === Result
  Status:  Succeeded
  jobid:  09S56000001G6fmEAC
  
  Wrote retrieve zip to /home/vsts/work/1/s/unpackaged.zip.
  Archive:  unpackaged.zip
    inflating: unpackaged/settings/Account.settings  
    ... 
    inflating: unpackaged/pathAssistants/TMG_CBE_Path.pathAssistant  
    inflating: unpackaged/package.xml  
  Switched to a new branch 'developer'
  Branch 'developer' set up to track remote branch 'developer' from 'origin'.
  On branch developer
  Your branch is up to date with 'origin/developer'.
  
  Changes to be committed:
    (use "git reset HEAD &lt;file&gt;..." to unstage)
  
      new file:   approvalProcesses/Billing_Item__c.Billable_Item_Less_than_0.approvalProcess
    ...
      new file:   workflows/Touchpoint__c.workflow
      new file:   workflows/User.workflow
  
  Untracked files:
    (use "git add &lt;file&gt;..." to include in what will be committed)
  
      ../sfdx-linux-amd64.tar.xz
      ../sfdx/
      ../unpackaged.zip
  
  This is me: 
  vsts
  
  [developer f8ea8ed] Retrieved latest Developer SB changes!
   1332 files changed, 452246 insertions(+)
   create mode 100644 unpackaged/approvalProcesses/Billing_Item__c.Billable_Item_Less_than_0.approvalProcess
   ...
   create mode 100644 unpackaged/workflows/Touchpoint__c.workflow
   create mode 100644 unpackaged/workflows/User.workflow
  Pushing now!!!
  remote: 001f# service=git-receive-pack
  remote: 0000000000aaTF401027: You need the Git 'GenericContribute' permission to perform this action. Details: identity 'Build\49a2cab3-a4ad-46c4-994c-35f429c806d2', scope 'repository'.
  remote: TF401027: You need the Git 'GenericContribute' permission to perform this action. Details: identity 'Build\49a2cab3-a4ad-46c4-994c-35f429c806d2', scope 'repository'.
  fatal: unable to access 'https://dev.azure.com/cooporg/test/_git/test/': The requested URL returned error: 403
  ##[error]Bash exited with code '128'.
  ##[section]Finishing: Bash
  </code></pre>
  
  <p>I added the "whoami" command to confirm the running user and to our surprise it's running as "vsts". We tried searching for this user to grant it the permissions needed, but we can't find it.</p>
  
  <p>Has anybody implemented something similar? How do we execute Git commands as a specific user within a Pipeline, so we can push the changes back to our branch?
  The ideal scenario would be committing these changes based on the user that manually ran the Pipeline.</p>
  
  <p>Thanks.</p>
  
Comments: CC BY-SA 4.0
Comments: 2019-08-13T14:31:51.127Z
Comments: (node:3433) [EACCES] Error Plugin: sfdx-cli: EACCES: permission denied, open '/home/vsts/.cache/sfdx/lastrun'
  It looks like this is your first error, not executing the git commands.
Comments: Preston Martin
Comments: CC BY-SA 4.0
Comments: 2019-08-13T14:43:00.657Z
Comments: Hi @PrestonM, I'm not sure this is actually the issue, as all the SFDX cli commands run even with the error showing. My issue is mainly when I try to push back to the branch, saying that "I" don't have the correct permissions. Even though the user is "vsts" and not my user.
Comments: Rodrigo
Tags: <azure-devops><azure-pipelines>
Title: Pushing code changes from Pipeline back to repo/branch, using Git!
UserDisplayName: Rodrigo
ThreadText: # Pushing code changes from Pipeline back to repo/branch, using Git!
  
  (Asked by: username_0 on 2019-08-13)
  
  Here is the scenario: We are trying to "automate" our Salesforce development with Azure Pipelines. Since Salesforce is very unique when it comes to deploying changes, I have tried to create a Pipeline that would be manually run to save any change made into a Salesforce Sandbox back to a Branch.
  The goal is to eventually merge these changes into other branches and deploy them into other Salesforce environments.
  
  We are using the the SFDX cli for such tasks within the image. Below is a copy of my yml file:
  
  ```
  trigger:
  - developer
  
  pool:
    vmImage: 'ubuntu-latest'
  
  variables:
  - group: DeveloperVariables
  
  steps:
  - checkout: self
    persistCredentials: true
  
  - task: DownloadSecureFile@1
    inputs:
      secureFile: server.key
  - task: Bash@3
    inputs:
      workingDirectory: ''
      targetType: inline
      script: |
        wget https://developer.salesforce.com/media/salesforce-cli/sfdx-linux-amd64.tar.xz;
        mkdir sfdx;
        tar xJf sfdx-linux-amd64.tar.xz -C sfdx --strip-components 1;
        sudo ./sfdx/install;
        sfdx force:auth:jwt:grant --clientid $CONSUMER_KEY --jwtkeyfile $DOWNLOADSECUREFILE_SECUREFILEPATH --username $USERNAME --setalias developer;
        sfdx force:mdapi:retrieve -u $USERNAME -k src/package.xml -r .;
        unzip unpackaged.zip;
        cd unpackaged;
        git config --global user.email "test@test.com"
        git config --global user.name "Test User"
        git checkout -t origin/developer;
        git add .;
        git status;
        echo "This is me: ";
        whoami;
        git commit -m "Retrieved latest Developer SB changes!"
        echo "Pushing now!!!";
        git push --set-upstream origin HEAD:developer;
  
  ```
  
  As per Microsoft's documentation found [here](https://docs.microsoft.com/en-us/azure/devops/pipelines/scripts/git-commands?view=azure-devops&tabs=yaml), we need to make sure we grant permissions to the build service. All the permissions have been granted as requested but we still can't get it to work.
  
  Below is the copy of the logs generated when we run the Pipeline:
  
  [![enter image description here](https://i.sstatic.net/v9TOU.png)](https://i.sstatic.net/v9TOU.png)
  
  ```
  ##[section]Starting: Bash
  ==============================================================================
  Task         : Bash
  Description  : Run a Bash script on macOS, Linux, or Windows
  Version      : 3.151.3
  Author       : Microsoft Corporation
  Help         : https://docs.microsoft.com/azure/devops/pipelines/tasks/utility/bash
  ==============================================================================
  Generating script.
  ========================== Starting Command Output ===========================
  [command]/bin/bash --noprofile --norc /home/vsts/work/_temp/9d534f54-57b8-44a0-8d10-2e3d8c334bbf.sh
  --2019-08-13 13:27:00--  https://developer.salesforce.com/media/salesforce-cli/sfdx-linux-amd64.tar.xz
  Resolving developer.salesforce.com (developer.salesforce.com)... 151.101.249.145
  Connecting to developer.salesforce.com (developer.salesforce.com)|151.101.249.145|:443... connected.
  HTTP request sent, awaiting response... 200 OK
  Length: 19686680 (19M) [application/x-tar]
  Saving to: ‘sfdx-linux-amd64.tar.xz’
  
       0K .......... .......... .......... .......... ..........  0% 25.6M 1s
      50K .......... .......... .......... .......... ..........  0% 27.2M 1s
          ...
   19150K .......... .......... .......... .......... .......... 99%  171M 0s
   19200K .......... .......... .....                           100%  247M=0.1s
  
  2019-08-13 13:27:00 (133 MB/s) - ‘sfdx-linux-amd64.tar.xz’ saved [19686680/19686680]
  
  sfdx installed to ‌4m&#x2F;usr&#x2F;local&#x2F;bin&#x2F;sfdx‌
  sfdx-cli/7.8.1-8f830784cc linux-x64 node-v10.15.3
  (node:3433) [EACCES] Error Plugin: sfdx-cli: EACCES: permission denied, open '/home/vsts/.cache/sfdx/lastrun'
  module: @oclif/config@1.13.0
  task: runHook init
  plugin: sfdx-cli
  root: /usr/local/lib/sfdx
  See more details with DEBUG=*
  Successfully authorized pipeline@coop.org.developer with org ID 00D560340009rbvEAA
  (node:3469) [EACCES] Error Plugin: sfdx-cli: EACCES: permission denied, open '/home/vsts/.cache/sfdx/lastrun'
  module: @oclif/config@1.13.0
  task: runHook init
  plugin: sfdx-cli
  root: /usr/local/lib/sfdx
  See more details with DEBUG=*
  this.retrieveTargetPath: /home/vsts/work/1/s
  Retrieving source...
  
  === Status
  Status:  InProgress
  jobid:  09S56000001G6fmEAC
  ...
  === Result
  Status:  Succeeded
  jobid:  09S56000001G6fmEAC
  
  Wrote retrieve zip to /home/vsts/work/1/s/unpackaged.zip.
  Archive:  unpackaged.zip
    inflating: unpackaged/settings/Account.settings  
    ... 
    inflating: unpackaged/pathAssistants/TMG_CBE_Path.pathAssistant  
    inflating: unpackaged/package.xml  
  Switched to a new branch 'developer'
  Branch 'developer' set up to track remote branch 'developer' from 'origin'.
  On branch developer
  Your branch is up to date with 'origin/developer'.
  
  Changes to be committed:
    (use "git reset HEAD <file>..." to unstage)
  
      new file:   approvalProcesses/Billing_Item__c.Billable_Item_Less_than_0.approvalProcess
    ...
      new file:   workflows/Touchpoint__c.workflow
      new file:   workflows/User.workflow
  
  Untracked files:
    (use "git add <file>..." to include in what will be committed)
  
      ../sfdx-linux-amd64.tar.xz
      ../sfdx/
      ../unpackaged.zip
  
  This is me: 
  vsts
  
  [developer f8ea8ed] Retrieved latest Developer SB changes!
   1332 files changed, 452246 insertions(+)
   create mode 100644 unpackaged/approvalProcesses/Billing_Item__c.Billable_Item_Less_than_0.approvalProcess
   ...
   create mode 100644 unpackaged/workflows/Touchpoint__c.workflow
   create mode 100644 unpackaged/workflows/User.workflow
  Pushing now!!!
  remote: 001f# service=git-receive-pack
  remote: 0000000000aaTF401027: You need the Git 'GenericContribute' permission to perform this action. Details: identity 'Build\49a2cab3-a4ad-46c4-994c-35f429c806d2', scope 'repository'.
  remote: TF401027: You need the Git 'GenericContribute' permission to perform this action. Details: identity 'Build\49a2cab3-a4ad-46c4-994c-35f429c806d2', scope 'repository'.
  fatal: unable to access 'https://dev.azure.com/cooporg/test/_git/test/': The requested URL returned error: 403
  ##[error]Bash exited with code '128'.
  ##[section]Finishing: Bash
  
  ```
  
  I added the "whoami" command to confirm the running user and to our surprise it's running as "vsts". We tried searching for this user to grant it the permissions needed, but we can't find it.
  
  Has anybody implemented something similar? How do we execute Git commands as a specific user within a Pipeline, so we can push the changes back to our branch?
  The ideal scenario would be committing these changes based on the user that manually ran the Pipeline.
  
  Thanks.
  
  **Tags:** azure-devops, azure-pipelines
  
  > **Comments:**
  > **username_1**: (node:3433) [EACCES] Error Plugin: sfdx-cli: EACCES: permission denied, open '/home/vsts/.cache/sfdx/lastrun' It looks like this is your first error, not executing the git commands.  
  > **username_0**: Hi @PrestonM, I'm not sure this is actually the issue, as all the SFDX cli commands run even with the error showing. My issue is mainly when I try to push back to the branch, saying that "I" don't have the correct permissions. Even though the user is "vsts" and not my user.  
  
  ---
  
  ## 1 answers
  
  ### Answer by username_0 on 2019-08-13. Score: 3
  
  Found the issue...
  
  The documentation states that the "contribute" permission needs to be added to "Project Collection Build Service Accounts".
  There is also an USER called ""Project Collection Build Service".
  After explicitly adding the "Project Collection Build Service" user to be able to contribute it worked as expected!
  
  
  ---
  
  