How to create a permission set in a scratch org without including it in the package

Question

We are developing a 1GP with SFDX and part of the process is creating a scratch org to develop and run tests on. The default user in the scratch org needs a permission set that assigns permission to Develop on the org and run the tests successfully, but I do not want this permission set to end up in the final package. How can I create this permission set in the scratch org without adding it in the main/default directory that the package is built from?

Answer 1

Use unpackagedMetadata and apexTestAccess to specify permissions for tests. Example from the documentation:

"packageDirectories": [
    {
        "path": "force-app",
        "package": "TV_unl", 
        "versionName": "ver 0.1",
        "versionNumber": "0.1.0.NEXT",
        "default": true, 
        "unpackagedMetadata": {
            "path": "my-unpackaged-directory"
        },
        "apexTestAccess": {
               "permissionSets": [
                   "Permission_Set_1",
                   "Permission_Set_2"
               ],
               "permissionSetLicenses": [
                   "SalesConsoleUser"
               ]
           }

    }, 
    {
        "path": "my-unpackaged-directory",
        "default": false
    }
]

Note that you're not putting those permissions in force-app/main/default, but in an entirely separate directory altogether (my-unpackaged-directory). You can also independently deploy this folder (force:source:deploy) if you want to use that metadata for testing purposes in an org.

Answer 2

This is something that the .forceignore file should be able to handle, I'd think.

A quick search turned up this documentation which seems to explicitly state that .forceignore exhibits the behavior you're looking for (emphasis mine)

How to Exclude Source When Syncing or Converting

When syncing metadata between your local file system and a target org, you often have source files you want to exclude. Similarly, you often want to exclude certain files when converting source to Salesforce DX source format. In both cases, you can exclude individual files or all files in a specific directory with a .forceignore file.

Use your favorite text editor to create a .forceignore file to specify the files or directories you want to exclude.

The .forceignore file excludes files when running all the force:source:* commands, such as force:source:push, force:source:pull, force:source:deploy, and force:source:retrieve.

Other Files That the Source Commands Ignore

The source commands ignore these files even if they aren’t included in your .forceignore file.

• Any source file or directory that begins with a “dot”, such as .DS_Store or .sfdx
• Any file that ends in .dup
• package2-descriptor.json
• package2-manifest.json

Exclude Remote Changes Not Yet Synced with Your Local Source

Sometimes, you make a change directly in a scratch org but you don’t want to pull that change into your local DX project. To exclude remote metadata changes, use the format . in .forceignore.

If you have a permission set named “dreamhouse,” add dreamhouse.permissionset to .forceignore.