In our DX project we maintain 4 profiles (3 custom and the System Administrator profile). When a scratch org is created I can push the project and everything deploys correctly including the profiles and all of the previously configured field level security (FLS).
sfdx force:source:push -g -f -u SCRATCHORG
Here is the FLS configured on the profile before the push (as is in VC):
<fieldPermissions>
<editable>true</editable>
<field>Lead.Address</field>
<readable>true</readable>
</fieldPermissions>
<fieldPermissions>
<editable>true</editable>
<field>Lead.MobilePhone</field>
<readable>true</readable>
</fieldPermissions>
<fieldPermissions>
<editable>true</editable>
<field>Lead.AnnualRevenue</field>
<readable>true</readable>
</fieldPermissions>
<fieldPermissions>
<editable>true</editable>
<field>Lead.Closed_Reason__c</field>
<readable>true</readable>
</fieldPermissions>
<fieldPermissions>
<editable>true</editable>
<field>Lead.Description</field>
<readable>true</readable>
</fieldPermissions>
<fieldPermissions>
<editable>false</editable>
<field>Lead.DoNotCall</field>
<readable>false</readable>
</fieldPermissions>
<fieldPermissions>
<editable>true</editable>
<field>Lead.Email</field>
<readable>true</readable>
</fieldPermissions>
<fieldPermissions>
<editable>false</editable>
<field>Lead.Fax</field>
<readable>false</readable>
</fieldPermissions>
<fieldPermissions>
<editable>false</editable>
<field>Lead.HasOptedOutOfEmail</field>
<readable>false</readable>
</fieldPermissions>
<fieldPermissions>
<editable>false</editable>
<field>Lead.HasOptedOutOfFax</field>
<readable>false</readable>
</fieldPermissions>
<fieldPermissions>
<editable>true</editable>
<field>Lead.Industry</field>
<readable>true</readable>
</fieldPermissions>
<fieldPermissions>
<editable>true</editable>
<field>Lead.Jigsaw</field>
<readable>true</readable>
</fieldPermissions>
<fieldPermissions>
<editable>false</editable>
<field>Lead.LastTransferDate</field>
<readable>false</readable>
</fieldPermissions>
<fieldPermissions>
<editable>true</editable>
<field>Lead.LeadSource</field>
<readable>true</readable>
</fieldPermissions>
<fieldPermissions>
<editable>false</editable>
<field>Lead.Lead_Age_in_Days__c</field>
<readable>true</readable>
</fieldPermissions>
<fieldPermissions>
<editable>true</editable>
<field>Lead.NumberOfEmployees</field>
<readable>true</readable>
</fieldPermissions>
<fieldPermissions>
<editable>true</editable>
<field>Lead.Phone</field>
<readable>true</readable>
</fieldPermissions>
<fieldPermissions>
<editable>true</editable>
<field>Lead.Rating</field>
<readable>true</readable>
</fieldPermissions>
<fieldPermissions>
<editable>true</editable>
<field>Lead.Title</field>
<readable>true</readable>
</fieldPermissions>
<fieldPermissions>
<editable>true</editable>
<field>Lead.Website</field>
<readable>true</readable>
</fieldPermissions>
<fieldPermissions>
<editable>false</editable>
<field>Opportunity.ExpectedRevenue</field>
<readable>true</readable>
</fieldPermissions>
If I make any change to the profile (even just modifying the profile's description) and pull the changes locally via Salesforce CLI all of the previously configured FLS for all fields is missing and I need to manually reinstate them before I commit to version control (I can see my intended changes on the profile but also the entire code block above is missing from the XML).
sfdx force:source:pull -u SCRATCHORG
Is this a known bug with DX or am I doing something incorrectly? All of our developers that are working on the same DX repo are experiencing the same issue and it is causing a lot of time wasted to manually reinstate this FLS on all profiles that are pulled in order to commit actual changes to VC.
source:pull
I see all my Account custom FieldPermissions removed, I discard these changes and Isource:push
which appears to deploy successfully, but then I Edit/Save Admin profile with no changes in the scratch org and againsource:pull
only to again see my FieldPermissions removed :/