IAPL - Setup Drift

Find metadata changed by hand in a Salesforce org, outside any deploy, before a deploy overwrites it or a backpromote fails on it.

How it works

The panel opens at once with the current sf target-org selected; the other orgs load in the background. Pick an org and a period (1 to 90 days) and click Analyze. The extension reads:

• Last modified date and user of the component types that usually drift: Apex, custom fields and objects, validation rules, flows (each version), layouts, Lightning pages, LWC/Aura, custom labels, permission sets and groups, profiles, record types, email templates and the custom metadata records whose types are in the repository.
• DeployRequest: successful deploys (not validations) in the period.
• Setup Audit Trail, without user-administration noise (passwords, emails, login-as, and so on). Permission changes stay visible.

Each change is classified as follows:

• Manual: no deploy by the same user was running at that time. This is drift.
• Deploy: saved during a deploy. If iaplSetupDrift.pipelineUsers is set, deploys by other users are marked as run outside the pipeline.
• Pipeline: saved by one of the pipelineUsers.

Each component is also looked up in the workspace. A manual change in the repo will be overwritten by the next deploy; the panel shows the date of the file's last commit. A manual change only in the org is not versioned. A deployed component missing from the repo was likely deployed from an unmerged branch.

Dates use DD/MM/YYYY. Change tables sort by date, user, or type (click the header), and each user shows their profile underneath. In the Deploys tab, click a deploy to see its components (created, changed, deleted, or unchanged), with warnings and test totals.

From the Manual tab you can retrieve the selected components into the project and review them in Source Control. Profile retrieves are blocked: a single-profile retrieve returns a partial XML that would wipe local FLS (use IAPL Profile FLS). Copy Markdown produces a table for a ticket.

Limits

• Salesforce keeps DeployRequest for about 30 days. Older changes cannot be matched to a deploy; set pipelineUsers so pipeline changes are not reported as manual.
• Lightning pages and custom metadata records do not record who changed them. They are matched to deploys by time only.
• Changes that are not metadata (sharing settings, org settings, users) only show up in the Audit Trail tab.

Requirements

Salesforce CLI (sf) with an authenticated org, and git on PATH for commit dates. The session is read once per org with sf org display and kept in memory for REST queries. The token is never shown or stored.