Permission Set Groups Cause Deploy Failure in Namespaced Scratch Org

[Bilal-Z]

Summary

When attempting to deploy metadata with extracted from a dev org with no namespace to a scratch org with a namespace, the deploy fails due to permission set groups with the following error:

PS C:\Users\bilal\Documents\XYZ-Project> sfdx force:source:push 
*** Pushing v55.0 metadata with SOAP API v53.0 connection *** 
DEPLOY PROGRESS | ████████████████████████████████████████ | 99/99 Components 
=== Component Failures [1] 
Type Name Problem 
───── ───────────────────────── ────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────────── 
Error FSC_Community_Permissions Cannot create permission set group components since the following permission set names are invalid: XYZ_for_Community

Contents of FSC_Community_Permissions.permissionsetgroup-meta.xml are as follows:

<?xml version="1.0" encoding="UTF-8"?>
<PermissionSetGroup  xmlns="http://soap.sforce.com/2006/04/metadata">
<description></description>
<hasActivationRequired>false</hasActivationRequired>
<label>FSC Community Permissions</label>
<permissionSets>XYZ_for_Community</permissionSets>
<permissionSets>force__FinancialServicesForCmtyExtension</permissionSets>
<status>Updated</status>
</PermissionSetGroup>

manually editing FSC_Community_Permissions.permissionsetgroup-meta.xml and prepending the namespace of the target scratch org, like as follows:

<permissionSets>Example_Namespace__XYZ_for_Community</permissionSets>

fixes the issue.

Expected result

Metadata should be deployed successfully. the cli should recognize the permission set XYZ_for_Community reference in FSC_Community_Permissions.permissionsetgroup-meta.xml as the permission set defined in XYZ_for_Community.permissionset-meta.xml that has been added to deploy queue as Example_Namespace__XYZ_for_Community

Actual result

Deployment fails with the error message Cannot create permission set group components since the following permission set names are invalid: XYZ_for_Community.

System Information

{
        "cliVersion": "sfdx-cli/7.150.0",
        "architecture": "win32-x64",
        "nodeVersion": "node-v16.15.0",
        "pluginVersions": [
                "@oclif/plugin-autocomplete 0.3.0 (core)",
                "@oclif/plugin-commands 1.3.0 (core)",
                "@oclif/plugin-help 3.3.1 (core)",
                "@oclif/plugin-not-found 1.2.6 (core)",
                "@oclif/plugin-plugins 1.10.11 (core)",
                "@oclif/plugin-update 1.5.0 (core)",
                "@oclif/plugin-warn-if-update-available 1.7.3 (core)",
                "@oclif/plugin-which 1.0.4 (core)",
                "@salesforce/sfdx-plugin-lwc-test 0.1.7 (core)",
                "alias 2.0.0 (core)",
                "apex 0.11.0 (core)",
                "auth 2.0.2 (core)",
                "community 1.1.4 (core)",
                "config 1.4.6 (core)",
                "custom-metadata 1.1.0 (core)",
                "data 0.6.15 (core)",
                "generator 2.0.0 (core)",
                "info 2.0.0 (core)",
                "limits 2.0.0 (core)",
                "org 1.12.1 (core)",
                "salesforce-alm 54.3.0 (core)",
                "schema 2.1.0 (core)",
                "sfdx-cli 7.150.0 (core)",
                "sfdx-falcon 0.0.93",
                "signups 1.0.0 (core)",
                "source 1.9.7 (core)",
                "telemetry 1.4.0 (core)",
                "templates 54.6.0 (core)",
                "trust 1.1.0 (core)",
                "user 1.7.1 (core)"
        ],
        "osVersion": "Windows_NT 10.0.22621"
}

[github-actions[bot]]

Thank you for filing this issue. We appreciate your feedback and will review the issue as soon as possible. Remember, however, that GitHub isn't a mechanism for receiving support under any agreement or SLA. If you require immediate assistance, contact Salesforce Customer Support.

[git2gus[bot]]

This issue has been linked to a new work item: W-12081228

[mattmartin26]

We are experiencing the same issue. Will attempt namespace injection (using CumulusCI) and report back if a successful workaround.

Exception in task install_2gp_commit.install_managed        

Error: (Chancery_Administrator) Cannot create permission set group components 
since the following permission set names are invalid: Agreements_Management, 
Assignments_Management, Chancery_Core_App, Committees_Management, 
Sacraments_Management_Diocese, 

Details: Chancery_Administrator: Cannot create 
permission set group components since the following permission set names are 
invalid: Agreements_Management, Assignments_Management, Chancery_Core_App, 
Committees_Management, Sacraments_Management_Diocese```

[aesanch2]

@mattmartin26 did you have any success with namespace injection?

[aozomaro]

Did this issue go anywhere?

[mwannamaker41]

Would be nice to get an update on this issue and the workitem that was created. This is still a problem for me.

[WillieRuemmele]

sorry to let this thread die. But looking into it now

[WillieRuemmele]

Has anyone attempted to use our string replacement feature with this? I was able to get it working with this permission set group example

I added this bit to the sfdx-project.json

  "replacements": [{
    "filename": "force-app/main/default/permissionsetgroups/test.permissionsetgroup-meta.xml",
    "stringToReplace": "set1",
    "replaceWithEnv": "REPLACE"
  }],

 ➜  REPLACE='cristiand391__set1' sf project deploy start --source-dir force-app/main/default/permissionsetgroups/test.permissionsetgroup-meta.xml
Deploying v60.0 metadata to [email protected] using the v61.0 REST API.
Deploy ID: 0Af9A00000frdFoSAI
Status: Succeeded | ████████████████████████████████████████ | 1/1 Components | Tracking: 0/0

Deployed Source
===============================================================================================================
| State     Name Type               Path                                                                        
| ───────── ──── ────────────────── ─────────────────────────────────────────────────────────────────────────── 
| Unchanged test PermissionSetGroup force-app/main/default/permissionsetgroups/test.permissionsetgroup-meta.xml 

and then without it,

 ➜  sf project deploy start --source-dir force-app/main/default/permissionsetgroups/test.permissionsetgroup-meta.xml
Deploying v60.0 metadata to [email protected] using the v61.0 REST API.
Deploy ID: 0Af9A00000frdFeSAI
Status: Failed | ████████████████████████████████████████ | 1/1 Components | Errors: 1

Component Failures [1]
=================================================================================================================================
| Type  Name Problem                                                                                                  Line:Column 
| ───── ──── ──────────────────────────────────────────────────────────────────────────────────────────────────────── ─────────── 
| Error test Cannot create permission set group components since the following permission set names are invalid: set1  

In the documentation we have examples for replacing certain strings for certain environments, which would probably be the most applicable example to follow