Check-Only Deployment Mode

Attribute	Type	Description	Package Types Applicable
checkOnlyAgainst	string[]	Array of org aliases where this package should be validated using check-only (validate-only) deployment. When the target org matches an alias in this array, a check-only deployment is performed; otherwise skipped.	unlocked org-dependent unlocked source diff

Certain packages cannot be validated in pooled review environments (scratch orgs or sandboxes) - for example, Data Cloud packages that require specific provisioning, or integration-heavy packages that depend on connected apps and named credentials not available in pools.

The checkOnlyAgainst attribute allows these packages to be validated against persistent orgs using Salesforce's check-only deployment, which verifies deployability without committing changes to the target org.

Check-only deployment itself happens only under sfp validate org. No other stage reads the attribute to change how a package is deployed.

The single-package-per-domain constraint below is a separate matter — it is enforced whenever the release config is loaded, so it also applies to deploy, release, prepare, sync, and domain commands.

To run a check-only deployment outside validation, use the --check-only flag on sfp install, which is a separate mechanism — see Install without committing the change.

{
  "packageDirectories": [
    {
      "package": "dc-connector",
      "path": "src/dc-connector",
      "type": "source",
      "checkOnlyAgainst": ["review"]
    }
  ]
}

When running sfp validate org --targetorg datacloud-dev --releaseconfig config/dc-domain.yaml, the package will be validated using check-only deployment against the specified org.

Behavior

When using sfp validate org with a --releaseconfig:

• If --targetorg matches one of the aliases in checkOnlyAgainst → Check-only deployment
• If --targetorg does NOT match any alias → Package is skipped

The comparison is a literal string match against the value passed to --targetorg. Passing a username where the attribute lists an alias — or the reverse — does not match, and the package is silently skipped rather than validated.

sfp validate pool ignores checkOnlyAgainst entirely. The attribute is read only when validating against a provided org, so in a pool the package is validated like any other: it is deployed for real into the scratch org, not check-only and not skipped. Packages that cannot survive a real deployment into a pooled org should be excluded from pool validation by other means.

Requirements

Release Config Required

Check-only deployment is applied only when --releaseconfig is provided.

Single Package Per Domain

Domains containing a package with checkOnlyAgainst must have exactly one package. This avoids dependency ordering complexity.

The count is taken from the domain's resolved package list, and the check runs when the release config is loaded — so a domain that breaks this rule fails the command even on a run that does not touch the check-only package, and on commands other than validate.

Org Authentication

The org alias in --targetorg must be pre-authenticated in your CI environment.