Pre-deploy CI gate

Fail a pull request that deletes or renames a field something else depends on, before the deploy rather than three weeks after it.

What this gate does

For each field a pull request touches, it asks Meshie what references that field and fails the check when the answer is “something does” or “I cannot tell”. The exit codes do the work, so the workflow stays a few lines of shell.

Against a hosted workspace

Use this when the graph spans systems the CI runner has no copy of, which is the whole point of the product. It needs a CLI token, which is a Pro feature. Store the secret as a repository secret and set two environment variables.

name: Meshie impact check
on: pull_request

jobs:
  impact:
    runs-on: ubuntu-latest
    env:
      MESHIE_API_TOKEN: ${{ secrets.MESHIE_API_TOKEN }}
      MESHIE_WORKSPACE: acme
      MESHIE_API_URL: https://meshie.ai
    steps:
      - uses: actions/checkout@v4
        with:
          fetch-depth: 0
      - uses: actions/setup-python@v5
        with:
          python-version: "3.11"
      - run: pip install 'meshie[remote]'
      - name: Check every field this PR touches
        run: ./scripts/meshie-gate.sh

.github/workflows/meshie.yml

The script turns changed field files into node ids and checks each one. Adjust the id derivation to match your repository layout:

#!/usr/bin/env bash
set -euo pipefail

status=0
changed=$(git diff --name-only "origin/${GITHUB_BASE_REF}...HEAD" \
  | grep -E 'objects/[^/]+/fields/[^/]+\.field-meta\.xml$' || true)

for path in $changed; do
  object=$(echo "$path" | sed -E 's#.*objects/([^/]+)/fields/.*#\1#')
  field=$(basename "$path" .field-meta.xml)
  node="salesforce:CustomField:${object}.${field}"

  # `|| code=$?` rather than a bare call: under `set -e` a non-zero
  # exit would end the script before the case statement ran.
  code=0
  meshie remote impact "$node" --json > "impact-${field}.json" || code=$?

  case $code in
    0) echo "ok: nothing references $node" ;;
    3) echo "ok: $node is not in the graph yet (new field)" ;;
    5) echo "::error::$node is reachable through a reference Meshie cannot verify"; status=1 ;;
    *) echo "::error::meshie exited $code for $node"; status=1 ;;
  esac
done

exit $status

scripts/meshie-gate.sh

Without a token, from a metadata export

If the repository already contains the Salesforce metadata, the local commands need no account, no token and no network:

uv tool install git+https://github.com/cr-digital-services/meshie.git
meshie scan --source ./force-app --out .meshie/snapshot.json
meshie impact "$NODE" --json > impact.json

The graph is then only as wide as the export, so this catches breakage inside Salesforce and nothing beyond it. It is a reasonable first step and a poor last one.

Reading the exit codes

0: the query ran. Look at the payload to decide what to do.
3: no such node. Usually a field the PR is adding, which is why the script treats it as a pass.
4: the token is missing, wrong or revoked. Fail loudly; do not treat an auth failure as a clean bill of health.
5: an unverifiable answer. This is the case a gate exists for. See Unknown edges.

Never collapse this to || true. A gate that cannot fail is a log line.
Keep the JSON as a build artifact. When someone asks why the check failed, the answer should be a file, not a rerun.

The full table is on the CLI page.