Why including a permission set group into a 2gmp package version breaks installation of unvalidated beta package version into an org?

Question

Why including a permission set group into a 2gmp package version breaks installation of unvalidated beta package version into an org?

Is permission set group feature not product ready? Is this defected feature? What is going on?

Including a PermissionSetGroup (PSG) metadata in SFDX project and creating a beta package version using (--skipvalidation) will upload the beta package version successfully. However, this beta package version will fail validation during package install. The validation error during install will look something similar to:

TestPSG: Cannot create permission set group components since the following permission set names are invalid: TestPS1, TestPS2, TestPS3

Contrarily, creating the same beta package version without (--skipvalidation) using the identical PSG metadata will also upload the beta package successfully. However, this beta package install succeeds.

Repro

1. The metadata of the managed package is as follows.

Permission sets metadata:

; Test ps1 to check ps and psg false TestPS1

Permission Set Group metadata:

; Test PSG to check if PS and PSG can be skipvalidated false TestPSG TestPS1 TestPS2 TestPS3 Updated

2. Create a managed package with few permission sets, and permission set group

3. Create a managed package version with --skipvalidation parameter

4. Create a managed package version without --skipvalidation parameter

Result:

1. Managed Package version created with --skipvalidation fails to get installed to an org and displays an error message, as (Test_PSG: Cannot create permission set group components since the following permission set names are invalid: Test PS1, Test PS2, Test PS3).

2. Managed Package version created without --skipvalidation, can be installed to any org.

Answer 1

I have open a case in Salesforce support on 9/23/2022.

Today (December 19, 2022) I have got a response that a known issue has been created.

Also received some details about difference between building a validated and unvalidated package versions.

If you set skipValidation switch, a deploy is not performed to some dynamically created org before the package version is set, but the package version is created directly from package details located in the source folder.

While for validated package version, there is a deploy test running to some dynamically created org before actually creating a package version.

Workarounds.

1. Always build validated package versions, or
2. Edit the PermissionSetGroup (PSG) metadata file in SFDX project (e.g. TestPSG.permissionsetgroup-meta.xml) and explicitly insert the package namespace prefix for each of the Permission Set names. For instance, replace TestPS1 with packagenamespace__TestPS1.