Azure DevOps流水线无法更新同项目Wiki的权限问题排查

问题描述 #

尝试通过同项目的Azure DevOps流水线更新Project Wiki时，收到错误：
Repository associated with wiki ID 'acf82e19-xxxx-xxxx-xxxx-xxxxxxxxxxxx' does not exist or you do not have permissions for the operation you are attempting.

• az devops wiki show命令执行成功，但wiki page create失败
• 本地用az login执行相同命令正常，确认是流水线权限问题
• 已为「[项目名称] Build Service ([组织名称])」用户授予Wiki的Contribute权限
• 已将Wiki Git仓库添加为YAML资源，尝试过PowerShell调用API，均报相同错误

流水线YAML代码：

trigger: none

resources:
  repositories:
    - repository: WikiGit
      type: git
      name: [Project name].wiki

steps:
  - script: |
      az devops wiki show --wiki "[Project name].wiki" --verbose
      az devops wiki page create --path NewPage --wiki "[Project name].wiki" --comment "added a new page" --content "# New Wiki Page Created!" --verbose
    env:
      AZURE_DEVOPS_EXT_PAT: $(System.AccessToken)

完整错误输出：

INFO: Detect: Url discovery took 0:00:00.002002
INFO: received PAT from environment variable
INFO: Creating connection with personal access token.
INFO: Command ran in 0.660 seconds (init: 0.130, invoke: 0.530)
{
  "id": "acf82e19-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "mappedPath": "/",
  "name": "[Project name].wiki",
  "projectId": "5feec93a-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "properties": null,
  "remoteUrl": "https://dev.azure.com/[Org name]/5feec93a-xxxx-xxxx-xxxx-xxxxxxxxxxxx/_wiki/wikis/acf82e19-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "repositoryId": "acf82e19-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "type": "projectWiki",
  "url": "https://dev.azure.com/[Org name]/5feec93a-xxxx-xxxx-xxxx-xxxxxxxxxxxx/_apis/wiki/wikis/acf82e19-xxxx-xxxx-xxxx-xxxxxxxxxxxx",
  "versions": [
    {
      "version": "wikiMaster",
      "versionOptions": null,
      "versionType": null
    }
  ]
}
INFO: Detect: Url discovery took 0:00:00.001961
INFO: received PAT from environment variable
INFO: Creating connection with personal access token.
ERROR: Repository associated with wiki ID 'acf82e19-xxxx-xxxx-xxxx-xxxxxxxxxxxx' does not exist or you do not have permissions for the operation you are attempting.
INFO: Command ran in 0.511 seconds (init: 0.131, invoke: 0.380)

解决方案 #

1. 给Build Service账户授予Wiki底层Git仓库权限 #

Project Wiki本质是隐藏的Git仓库，仅配置Wiki页面权限不够，需要直接给仓库授权：

• 进入项目的项目设置 -> 仓库
• 勾选「显示隐藏的仓库」，找到[Project name].wiki仓库
• 进入该仓库的安全设置，添加「[项目名称] Build Service ([组织名称])」用户
• 授予该用户Contribute和Read权限，保存设置

2. 使用Wiki ID替代名称执行命令 #

名称识别可能存在歧义，改用Wiki的ID执行创建命令：
修改脚本中的wiki page create命令：

az devops wiki page create --path NewPage --wiki acf82e19-xxxx-xxxx-xxxx-xxxxxxxxxxxx --comment "added a new page" --content "# New Wiki Page Created!" --verbose

3. 确保流水线AccessToken包含Git权限 #

默认的$(System.AccessToken)可能缺少Git操作权限，需开启脚本访问权限：

• 编辑流水线，进入变量 tab，启用「允许脚本访问OAuth令牌」
• 或在YAML中显式配置：

steps:
  - script: |
      az devops wiki show --wiki "[Project name].wiki" --verbose
      az devops wiki page create --path NewPage --wiki "[Project name].wiki" --comment "added a new page" --content "# New Wiki Page Created!" --verbose
    env:
      AZURE_DEVOPS_EXT_PAT: $(System.AccessToken)
    displayName: 'Update Wiki'
    env:
      SYSTEM_ACCESSTOKEN: $(System.AccessToken)

4. 直接操作Git仓库更新Wiki #

如果上述方法无效，可直接克隆Wiki仓库推送修改：

# 克隆Wiki仓库
git clone https://$(System.AccessToken)@dev.azure.com/[Org name]/[Project name]/_git/[Project name].wiki
# 创建新页面文件（Wiki页面对应仓库中的.md文件）
echo "# New Wiki Page Created!" > NewPage.md
# 提交并推送
git add .
git commit -m "added a new page"
git push origin wikiMaster

内容的提问来源于stack exchange，提问作者Mike