Excluding Specific Actions While Including Others When Using Deploy CLI

Get Help
,
1

Hi folks.

I have created a DevOps Pipeline which automates the deployment of Auth0 changes to the staging, dev and prod tenants. I have tested it by deploying the dev tenant config to staging but not done any deployments to dev or prod.

When it comes time to do the dev to prod tenant deployment, we have a potential problem: the dev tenant has 12 custom actions that prod tenant does not and my manager wants the pipeline to exclude those 12 extra actions when the DEV>PROD deployment happens so they stay in dev but don’t go into prod.

How do I accomplish this?

For context, here is the snippet of the pipeline doing the dev to prod deployment. I have censored the sensitive information as those are variables anyway:

  • stage: Deploy_Prod

    displayName: ‘Deploy to Prod’

    dependsOn: Deploy_Dev

    jobs:

    • job: DeployProd

      displayName: ‘Deploy Config to Auth0 Prod’

      pool:

      vmImage: ‘ubuntu-latest’

      steps:

      • checkout: self

      • task: NodeTool@0

        displayName: ‘Install Node.js’

        inputs:

        versionSource: ‘spec’

        versionSpec: ‘22.x’

      • task: CmdLine@2

        displayName: ‘Install Auth0 Deploy CLI via npm’

        inputs:

        script: ‘npm install -g auth0-deploy-cli’

      • script: |

        a0deploy import --config_file=tenant/config-prod.json --input_file=tenant.yaml

        displayName: ‘Deploy Config to Auth0 Prod’

        workingDirectory: tenant

        env:

        AUTH0_DOMAIN: $(prod_domain)

        AUTH0_CLIENT_ID: $(prod_client_id)

        AUTH0_CLIENT_SECRET: $(prod_client_secret)

        AUTH0_INCLUDED_ONLY: ‘[“actions”, “branding”, “emailTemplates”, “pages”]’

2

From your pipeline snippet, you deploy by running a0deploy import --config_file=tenant/config-prod.json --input_file=tenant.yaml . This means that any Auth0 entities (clients, actions, etc.) defined in tenant.yaml will get deployed to the prod tenant.

You could define two tenant.yaml files, one containing entities that exist in both dev and prod, and another for just dev entities. In your deploy config file (tenant/config-prod.json) set "AUTH0_ALLOW_DELETE": false so that when you import, it won’t delete entities from your tenant that don’t exist in the tenant.yaml you are importing.

3

Wait, in this page of documentation, it says I can do this for connections: “AUTH0_EXCLUDED_CONNECTIONS”: [“con_O1H3KyRMFP1IWRq3”, “con_9avEYuj19ihqKBOs”]. Could I not just do something like this but with actions?

4

Hi @shayan.bhattacharya

Thank you for reaching out to us!

I understand you need to exclude 12 specific Actions from your Dev tenant when running the deployment of your Pipeline towards the Prod tenant.

The Auth0 Deploy CLI does not natively support excluding individual Actions by name or ID. You can only exclude the entire “actions” category, so you must manage this exclusion at the repository or pipeline level. Excluding items by ID is only supported for rules, clients, databases, connections and resource servers.

Recommended Action: Remove from Source Control

Treat your tenant.yaml as the strict source of truth for Production, rather than an exact mirror of your Dev environment.

  • Step 1: Delete the 12 Dev-only actions from your tenant.yaml file in your repository.

  • Step 2: Ensure your config-dev.json contains "AUTH0_ALLOW_DELETE": false.

  • Result: The Production pipeline deploys only the approved actions in the code. The Dev pipeline is blocked from deleting the experimental actions that exist in the Dev tenant but not in the code.

Alternative 1: Programmatic Pipeline Stripping

If the 12 actions must remain in your source file, use yq (pre-installed on ubuntu-latest agents) to strip them out dynamically right before the deployment step runs.

  • Implementation: Add this script task before your a0deploy step.
    - script: |
        yq -i 'del(.actions[] | select(.name == "DevAction1" or .name == "DevAction2"))' tenant.yaml
      displayName: 'Exclude DEV-only Actions from YAML'
      workingDirectory: tenant

Note: Hardcoding 12 action names in a script is brittle. If possible, enforce a naming convention in Dev (like a DEV_ prefix) and update your yq command to match the regex: select(.name | test("^DEV_")).

Alternative 2: Switch to Directory Format

If you change your Auth0 export format from a single YAML file to the Directory format, every action generates its own standalone .json and .js file in an /actions folder.

  • Implementation: Use standard bash commands to delete the specific files during the pipeline run before the import occurs.
    - script: |
        rm tenant/actions/DevAction1.json
        rm tenant/actions/DevAction2.json
      displayName: 'Remove DEV-only Action files'

Let us know if the above information helped achieve the desired flow!

Best regards,
Gerald

6

Hi Gerald.

I tested out your first fix in the lower environments. We have staging, dev and prod and I am not currently allowed to deploy to dev and prod right now so here is what I did:

I created a new custom action in the dev tenant console called ‘shayan’. I then exported the dev tenant config, deleted the ‘shayan’ action from the fresh tenant.yml file and added in the allow delete line to the config-staging file and set to false.

Then git pushed it and ran the pipeline and the run was successful with the staging tenant being updated, but crucially, the shayan action remained in the dev tenant and didn’t appear in the staging tenant.

This is the outcome I wanted as I want to ensure that when I eventually do the dev to prod deployment that the 12 dev/stg-only actions stay in those tenants while ensuring they don’t go into prod.

Can you confirm I did this right, please?

Thanks.

7

Hey Shayan, just to let you know, that you will also need to use a script that will go through triggers/triggers.json in order to remove it from the triggers if you have not done that yet. Otherwise your a0deploy will fail.