CircleCi config.yml for a workflow that tests the source on a scratch org, builds a package and deploys to staging and production.

production-build-job.yml

jobs:
  build_and_install_production:
    executor:
      name: sfdx-default
    steps:
      - checkout
      - sfdx/install
      - run:
          name: Setup SFDX CLI
          command: |
            echo $SFDX_JWT_KEY | base64 --decode --ignore-garbage > ./server.key
            sfdx auth:jwt:grant --clientid $SFDX_CONSUMER_KEY --jwtkeyfile server.key --username $USERNAME_PRODUCTION
            sfdx auth:jwt:grant --clientid $SFDX_CONSUMER_KEY_STAGING --jwtkeyfile server.key --username $USERNAME_STAGING --instanceurl https://test.salesforce.com
            mkdir -p force-app
      - run:
          name: Build Production Package
          command: |
            sfdx force:package:version:create -p $PACKAGE_ID -v $USERNAME_PRODUCTION -w 60 -k $INSTALLATION_KEY -c
      - run:
          name: Promote Latest Build
          command: |
            query=$(sfdx force:data:soql:query -t -q "SELECT SubscriberpackageVersionId FROM Package2Version WHERE Package2Id = '$PACKAGE_ID' ORDER BY CreatedDate DESC LIMIT 1" -u $USERNAME_PRODUCTION)
            SUBSCRIBER_PACKAGE_VERSION_ID=$(echo $query | grep -o '04t[a-zA-Z0-9]*')
            echo "Promoting latest package version: $SUBSCRIBER_PACKAGE_VERSION_ID ..."
            sfdx force:package:version:promote -v $USERNAME_PRODUCTION -p $SUBSCRIBER_PACKAGE_VERSION_ID -n
      - run:
          name: Install Package (Staging)
          command: |
            query=$(sfdx force:data:soql:query -t -q "SELECT SubscriberpackageVersionId FROM Package2Version WHERE Package2Id = '$PACKAGE_ID' ORDER BY CreatedDate DESC LIMIT 1" -u $USERNAME_PRODUCTION)
            SUBSCRIBER_PACKAGE_VERSION_ID=$(echo $query | grep -o '04t[a-zA-Z0-9]*')
            echo "Installing latest package version: $SUBSCRIBER_PACKAGE_VERSION_ID ..."
            sfdx force:package:install -w 10 -b 10 -u $USERNAME_STAGING -p $SUBSCRIBER_PACKAGE_VERSION_ID -k $INSTALLATION_KEY -r
      - run:
          name: Install Package (Production)
          command: |
            query=$(sfdx force:data:soql:query -t -q "SELECT SubscriberpackageVersionId FROM Package2Version WHERE Package2Id = '$PACKAGE_ID' ORDER BY CreatedDate DESC LIMIT 1" -u $USERNAME_PRODUCTION)
            SUBSCRIBER_PACKAGE_VERSION_ID=$(echo $query | grep -o '04t[a-zA-Z0-9]*')
            echo "Installing latest package version: $SUBSCRIBER_PACKAGE_VERSION_ID ..."
            sfdx force:package:install -w 10 -b 10 -u $USERNAME_PRODUCTION -p $SUBSCRIBER_PACKAGE_VERSION_ID -k $INSTALLATION_KEY -r
      - run:
          name: Run Tests (Production)
          command: |
            mkdir -p ~/test-results/apex
            export SFDX_IMPROVED_CODE_COVERAGE="true"
            sfdx force:apex:test:run -w 10 -u $USERNAME_PRODUCTION -r junit -d ~/test-results/apex -c
      - run:
          name: Clean Duplicate Test Results
          command: |
            rm -f ~/test-results/apex/test-result.xml
          when: always
      - store_test_results:
          path: ~/test-results

scratch-org-test-job.yml

jobs:
  scratch_org_test:
    executor:
      name: sfdx-default
    steps:
      - checkout
      - sfdx/install
      - run:
          name: Setup SFDX CLI
          command: |
            echo $SFDX_JWT_KEY | base64 --decode --ignore-garbage > ./server.key
            sfdx auth:jwt:grant --clientid $SFDX_CONSUMER_KEY --jwtkeyfile server.key --username $USERNAME_PRODUCTION
            mkdir -p force-app
      - run:
          name: Run Org Setup
          command: |
            bash scripts/setup/macOS.sh -a CircleCi -v $USERNAME_PRODUCTION
      - run:
          name: Run Tests (Scratch Org)
          command: |
            mkdir -p ~/test-results/apex
            export SFDX_IMPROVED_CODE_COVERAGE="true"
            sfdx force:apex:test:run -w 10 -r junit -d ~/test-results/apex -c
      - run:
          name: Clean Scratch Org
          command: |
            sfdx force:org:delete -u CircleCi --noprompt
          when: always
      - run:
          name: Clean Duplicate Test Results
          command: |
            rm -f ~/test-results/apex/test-result.xml
          when: always
      - store_test_results:
          path: ~/test-results

setup-script.sh

#!bin/bash
set -e

alias=
duration=7
configFile=config/default-scratch-def.json
devhubusername=

while getopts a:d:f:v: option
do
    case "${option}" in
        a )             alias=${OPTARG};;
        d )             duration=${OPTARG};;
        f )             configFile=${OPTARG};;
        v )             devhubusername=${OPTARG};;
    esac
done

if [ -z "$alias" ]; then
    echo "Missing required parameter: Alias. Use '-a MyAlias'"
    exit 1
fi
if [ -z "$INSTALLATION_KEY_FIRSTDEP" ]; then 
    echo 'Installation key for the converter dependency not set. Export key as environment variable with "export INSTALLATION_KEY_FIRSTDEP=key" to avoid this prompt.'
    read -p 'Enter installation key for the converter dependency: ' firstDepKey
    export INSTALLATION_KEY_FIRSTDEP=$firstDepKey
fi
if [ -z "$INSTALLATION_KEY_SECONDDEP" ]; then 
    echo 'Installation key for the core dependency not set. Export key as environment variable with "export INSTALLATION_KEY_SECONDDEP=key" to avoid this prompt.'
    read -p 'Enter installation key for the core dependency: ' secondDepKey
    export INSTALLATION_KEY_SECONDDEP=$secondDepKey
fi

if [ -z "$INSTALLATION_KEY_SECONDDEP" ] || [ -z "$INSTALLATION_KEY_FIRSTDEP" ]
then
    echo "At least one installation key is empty. Exiting ..." >&2
    exit 1
fi

echo "mkdir -p force-app"
mkdir -p force-app

if [ -z "$devhubusername" ]; then
    echo "sfdx force:org:create -d $duration -f $configFile -a $alias -s"
    sfdx force:org:create -d $duration -f $configFile -a $alias -s
else
    echo "sfdx force:org:create -v $devhubusername -d $duration -f $configFile -a $alias -s"
    sfdx force:org:create -v $devhubusername -d $duration -f $configFile -a $alias -s
fi

echo "sfdx force:package:install -p \"First Dependency Package Version\" -u $alias -w 10 -k $INSTALLATION_KEY_FIRSTDEP"
sfdx force:package:install -p "Second Dependency Package Version" -u $alias -w 10 -k $INSTALLATION_KEY_FIRSTDEP

echo "sfdx force:package:install -p \"Second Dependency Package Version\" -u $alias -w 10 -k $INSTALLATION_KEY_SECONDDEP"
sfdx force:package:install -p "Second Dependency Package Version" -u $alias -w 10 -k $INSTALLATION_KEY_SECONDDEP

echo "sfdx force:source:push -u $alias"
sfdx force:source:push -u $alias

echo "sfdx force:data:tree:import -p data/plans/standard-plan.json -u $alias"
sfdx force:data:tree:import -p data/plans/standard-plan.json -u $alias

echo "sfdx force:apex:execute -f scripts/apex/post-setup-script.apex -u $alias > /dev/null"
sfdx force:apex:execute -f scripts/apex/post-setup-script.apex -u $alias > /dev/null

echo "sfdx force:org:open -u $alias -p \"/lightning/setup/SetupOneHome/home\""
sfdx force:org:open -u $alias -p "/lightning/setup/SetupOneHome/home"

staging-install-job.yml

jobs:
  build_and_install_staging: 
    executor:
      name: sfdx-default
    steps:
      - checkout
      - sfdx/install
      - run:
          name: Setup SFDX CLI
          command: |
            echo $SFDX_JWT_KEY | base64 --decode --ignore-garbage > ./server.key
            sfdx auth:jwt:grant --clientid $SFDX_CONSUMER_KEY --jwtkeyfile server.key --username $USERNAME_PRODUCTION
            sfdx auth:jwt:grant --clientid $SFDX_CONSUMER_KEY_STAGING --jwtkeyfile server.key --username $USERNAME_STAGING --instanceurl https://test.salesforce.com
            mkdir -p force-app
      - run:
          name: Build Beta Package
          command: |
            sfdx force:package:version:create -p $PACKAGE_ID -v $USERNAME_PRODUCTION -w 60 -k $INSTALLATION_KEY --skipvalidation
      - run:
          name: Install Package (Staging)
          command: |
            query=$(sfdx force:data:soql:query -t -q "SELECT SubscriberpackageVersionId FROM Package2Version WHERE Package2Id = '$PACKAGE_ID' ORDER BY CreatedDate DESC LIMIT 1" -u $USERNAME_PRODUCTION)
            SUBSCRIBER_PACKAGE_VERSION_ID=$(echo $query | grep -o '04t[a-zA-Z0-9]*')
            echo "Installing latest package version: $SUBSCRIBER_PACKAGE_VERSION_ID ..."
            sfdx force:package:install -w 10 -b 10 -u $USERNAME_STAGING -p $SUBSCRIBER_PACKAGE_VERSION_ID -k $INSTALLATION_KEY -r
      - run:
          name: Run Tests (Staging)
          command: |
            mkdir -p ~/test-results/apex
            export SFDX_IMPROVED_CODE_COVERAGE="true"
            sfdx force:apex:test:run -w 10 -u $USERNAME_STAGING -r junit -d ~/test-results/apex -c
      - run:
          name: Clean Duplicate Test Results
          command: |
            rm -f ~/test-results/apex/test-result.xml
          when: always
      - store_test_results:
          path: ~/test-results

workflow.yml

workflows:
  package_build:
    jobs:
      - scratch_org_test:
          context:
            - salesforce
      - approve_staging:
          type: approval
          requires:
            - scratch_org_test
          filters:
            branches:
              only:
                - /^version/.*/
                - /^feature/.*/
      - build_and_install_staging:
          context:
            - salesforce
          requires:
            - approve_staging
          filters:
            branches:
              only:
                - /^version/.*/
                - /^feature/.*/
      - approve_production:
          type: approval
          requires:
            - build_and_install_staging
          filters:
            branches:
              only:
                - /^version/.*/
      - build_and_install_production:
          context:
            - salesforce
          requires:
            - approve_production
          filters:
            branches:
              only:
                - /^version/.*/