vulkro-sf diff

Compare two metadata folders and score how risky deploying the difference would be.

Command reference

Generated from vulkro-sf diff --help (vulkro-sf 0.28.0). Run scripts/gen-docs.sh in the product repository to refresh it; do not edit this section by hand.

Compare two metadata folders and score how risky deploying the difference would be.

vulkro-sf diff [OPTIONS] <orgA-src> <orgB-src>

Arguments

Argument	Description
<orgA-src>	Base / source-of-truth metadata tree (org A)
<orgB-src>	Target / candidate metadata tree (org B). The risk is scored for moving from A to B.

Options

Flag	Description
-f, --format <FORMAT>	Output format: table or json. Default: table.
-v, --verbose...	Bump stderr log verbosity. -v enables debug-level tracing for the vulkro + vulkro_sf targets; -vv enables trace. Honoured only when RUST_LOG is unset (an explicit RUST_LOG always wins)
-q, --quiet	Print only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged.
--no-color	Turn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb.
-h, --help	Print help (see a summary with '-h')

Full vulkro-sf diff --help

Compare two metadata folders and score how risky deploying the difference would be.

Compare two metadata source trees and score the deployment risk of the delta (org-to-org metadata diff).

`<orgA-src>` and `<orgB-src>` are retrieved-metadata folders or SFDX source trees, one per org (typically a sandbox / staging tree and the production tree, or two orgs being reconciled). The command builds a component map for each tree, computes which components are ADDED (in B, not A), REMOVED (in A, not B), or MODIFIED (in both, different content), and scores the deployment risk of moving from A to B.

Risk = sum over changes of `base(change) * multiplier(meta-type)`, mapped to a 0-100 score with a saturating curve. REMOVED weighs more than MODIFIED weighs more than ADDED; access / trust types (sharing rules, named credentials, connected apps, profiles, permission sets) and code (Apex, triggers, flows) weigh most. The JSON output lists every change with its individual weight so the score is explainable.

Security deltas: the command also says what moving from A to B GRANTS and to whom (a guest or external user gaining access to a sensitive field, a dangerous system permission, a weakened OAuth app, and more), with the same analysis `vulkro-sf review` runs on a git change. They are listed under the risk line in the table and as an additive `security_deltas` array in the JSON (present only when there is at least one). The risk score and the exit code do not change.

This is BEST-EFFORT and static. A deploy plan (`sf project deploy --dry-run`) is still authoritative for merge conflicts, missing dependencies, and test-coverage failures; this command answers "how big and how risky is the delta", not "will the deploy succeed".

CI wiring: run it between the source-of-truth tree and a candidate tree and fail the pipeline above a risk threshold, e.g.

risk=$(vulkro-sf diff prod-src candidate-src --format json | \ jq .deployment_risk.score) [ "$risk" -lt 50 ] || { echo "deployment risk $risk too high"; exit 1; }

Exit codes: 0 = trees identical (no delta); 1 = a delta was found and scored; 2 = error (an input path is not a readable directory, or neither tree holds any metadata).

Usage: vulkro-sf diff [OPTIONS] <orgA-src> <orgB-src>

Arguments:
  <orgA-src>
          Base / source-of-truth metadata tree (org A)

  <orgB-src>
          Target / candidate metadata tree (org B). The risk is scored for moving from A to B

Options:
  -f, --format <FORMAT>
          Output format: table or json
          
          [default: table]

  -v, --verbose...
          Bump stderr log verbosity. `-v` enables debug-level tracing for the `vulkro` + `vulkro_sf` targets; `-vv` enables trace. Honoured only when `RUST_LOG` is unset (an explicit `RUST_LOG` always wins)

  -q, --quiet
          Print only warnings and errors on stderr: no progress, tips or next-step hints. Results on stdout and exit codes are unchanged

      --no-color
          Turn off coloured output. Colour is also off when NO_COLOR is set to a non-empty value or TERM=dumb

  -h, --help
          Print help (see a summary with '-h')