Not Signed workaround in a Github Action

[RaviVaranasi]

Below is the GitHub action yml file:

    runs-on: ubuntu-latest
    steps:
      - name: Check out files
        uses: actions/checkout@v4

      - name: Install Salesforce CLI
        run: npm install -g @salesforce/cli@latest
      - name: Install Salesforce Code Analyzer Plugin
        run: sf plugins install @salesforce/sfdx-scanner@latest

      - name: Install flow scanner plugin
        run: |
          y | sf plugins:install lightning-flow-scanner

      - name: Run flow scanner
        id: run-flow-scanner
        run: sf flow:scan -d force-app/main/default/flows

Below is the output that shows that the plugin failed to install:

Run y | sf plugins:install lightning-flow-scanner
  y | sf plugins:install lightning-flow-scanner
  shell: /usr/bin/bash -e {0}
/home/runner/work/_temp/e8af88da-[3](https://github.com/invitation-homes/salesforce-blueprint/actions/runs/8318861097/job/22761347331?pr=746#step:5:3)1bb-[4](https://github.com/invitation-homes/salesforce-blueprint/actions/runs/8318861097/job/22761347331?pr=746#step:5:5)d86-9d79-80de3f84ae16.sh: line 1: y: command not found
? This plugin isn't signed by Salesforce. Only install the plugin if you trust
its creator. Do you want to continue the installation?, (y/N)

[nvuillam]

Try echo y | sf plugins:install... :)

[RubenHalman]

@RaviVaranasi At the time of creation, I dont think it was possible for plugins to get signed by Salesforce yet.
I believe it was coming or perhaps it already exists. T

@nvuillam do you happen to know if this is now possible?

[nvuillam]

@RubenHalman a tool must be officially supported by Salesforce to be signed (even sfdx-git-delta is not ! )

So... no choice but using echo y | ... :) (or use a tool that embeded LFS, like MegaLinter ^^ )

[Damecek]

you should be able to bypass this using unsignedPluginWhiteList, here is more information about that.