Azure DevOps Pipeline中如何指定Pull Request创建者为请求用户？

当前你用az repos pr create创建PR时，因使用的是$(System.AccessToken)（流水线服务账号的令牌），PR创建者会显示为Pipeline Agent，而非发起流水线的用户。要让PR显示为请求用户并出现在「我的」标签页，可通过以下两种方式实现：

方案一：使用用户个人访问令牌（PAT）调用REST API #

这种方式需要发起用户提供自己的PAT（需包含创建PR的权限），并在流水线中配置为保密变量：

1. 配置用户PAT变量：在流水线的「变量」中添加保密变量UserPAT，值为发起用户的Azure DevOps PAT。
2. 替换PR创建步骤：将原有的Azure CLI步骤改为调用REST API的PowerShell脚本：

- pwsh: |
    $orgName = "$(System.TeamFoundationCollectionUri)" -replace 'https://dev.azure.com/','' -replace '/$',''
    $projName = "$(System.TeamProject)"
    $repoId = "$(Build.Repository.Id)"
    $branchName = "feature/{0}" -f $env:PIPELINENAME
    $title = "Experiment {0}" -f $env:PIPELINENAME

    $body = @{
        sourceRefName = "refs/heads/$branchName"
        targetRefName = "refs/heads/main" # 替换为你的目标分支
        title = $title
        description = "Auto-created PR from pipeline"
    } | ConvertTo-Json

    $headers = @{
        "Authorization" = "Basic {0}" -f [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(":$env:USERPAT"))
        "Content-Type" = "application/json"
    }

    Invoke-RestMethod -Uri "https://dev.azure.com/$orgName/$projName/_apis/git/repositories/$repoId/pullrequests?api-version=7.1-preview.1" `
                      -Method Post `
                      -Headers $headers `
                      -Body $body
  displayName: 'Create PR as requested user'
  env:
    USERPAT: $(UserPAT)
    PIPELINENAME: $(pipelineName)

方案二：使用用户模拟（Impersonation）调用REST API #

这种方式无需用户提供PAT，但需要给流水线服务账号配置「Impersonate」权限：

1. 配置服务账号权限：
   • 进入Azure DevOps组织设置 → 权限 → 用户，找到Project Collection Build Service ({你的组织名})
   • 勾选「Impersonate」权限为「允许」
2. 替换PR创建步骤：使用System.AccessToken并添加模拟请求头：

- pwsh: |
    $orgName = "$(System.TeamFoundationCollectionUri)" -replace 'https://dev.azure.com/','' -replace '/$',''
    $projName = "$(System.TeamProject)"
    $repoId = "$(Build.Repository.Id)"
    $branchName = "feature/{0}" -f $env:PIPELINENAME
    $title = "Experiment {0}" -f $env:PIPELINENAME
    $requestedUserId = "$(Build.RequestedForId)"

    $body = @{
        sourceRefName = "refs/heads/$branchName"
        targetRefName = "refs/heads/main" # 替换为你的目标分支
        title = $title
        description = "Auto-created PR from pipeline"
    } | ConvertTo-Json

    $headers = @{
        "Authorization" = "Basic {0}" -f [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(":$env:SYSTEM_ACCESSTOKEN"))
        "Content-Type" = "application/json"
        "X-VSS-Impersonate" = $requestedUserId
    }

    Invoke-RestMethod -Uri "https://dev.azure.com/$orgName/$projName/_apis/git/repositories/$repoId/pullrequests?api-version=7.1-preview.1" `
                      -Method Post `
                      -Headers $headers `
                      -Body $body
  displayName: 'Create PR as requested user (Impersonation)'
  env:
    SYSTEM_ACCESSTOKEN: $(System.AccessToken)
    PIPELINENAME: $(pipelineName)

说明 #

两种方案创建的PR都会显示为发起流水线的用户，从而出现在Repos>PullRequests的「我的」标签页中。方案二更适合团队场景，无需每个用户配置个人PAT；方案一则不需要修改服务账号权限，更灵活。

内容的提问来源于stack exchange，提问作者bryanbcook