Azure DevOps Job级变量未解析，服务连接引用失败

问题现象 #

运行Pipeline时触发错误：

The pipeline is not valid. [...] references service connection $(azureSubscription) which could not be found.

系统将$(azureSubscription)当作字面量的服务连接名称查找，而非解析为定义的变量值。将变量替换为订阅名称字面量时可正常运行，且Job级的整个variables字段似乎都未生效。

相关代码 #

主Pipeline文件 #

trigger:
  - main

extends:
  template: deploy-template.yml
  parameters:
    buildConfiguration: 'Release'

deploy-template.yml（简化版） #

parameters:
- name: buildConfiguration
  type: string
  default: ''

stages:
- stage: buildstage

  pool:
    vmImage: ubuntu-latest

  jobs:
  - job: buildjob

    variables:
      azureSubscription: 'name of our subscription'
      buildConfiguration: '${{ parameters.buildConfiguration }}'

    steps:

    (couple of tasks here)

    - task: AzureRmWebAppDeployment@4
      displayName: 'Deploy to slot'
      condition: succeeded()
      inputs:
        ConnectionType: 'AzureRM'
        azureSubscription: '$(azureSubscription)'
        appType: 'webApp'
        (etc)

问题原因 #

Azure DevOps对AzureRmWebAppDeployment这类涉及服务连接的任务存在预验证机制：

1. 该验证发生在Pipeline初始化阶段（模板编译、服务连接校验），早于Job级变量的解析时机（Job启动时才注入变量）。
2. 此时Job级的azureSubscription变量尚未被解析，系统只能将$(azureSubscription)当作服务连接的字面名称去匹配，自然找不到对应服务连接。

解决方法 #

方法1：将变量移至Stage级别 #

Stage级变量会在Pipeline初始化阶段被解析，能被预验证机制识别：

parameters:
- name: buildConfiguration
  type: string
  default: ''

stages:
- stage: buildstage
  # 把变量移到Stage级别
  variables:
    azureSubscription: 'name of our subscription'
  pool:
    vmImage: ubuntu-latest

  jobs:
  - job: buildjob
    variables:
      buildConfiguration: '${{ parameters.buildConfiguration }}'
    steps:
    (couple of tasks here)

    - task: AzureRmWebAppDeployment@4
      displayName: 'Deploy to slot'
      condition: succeeded()
      inputs:
        ConnectionType: 'AzureRM'
        azureSubscription: '$(azureSubscription)'
        appType: 'webApp'
        (etc)

方法2：使用模板参数传递订阅名称 #

参数在模板编译阶段就会被替换，优先级高于变量解析，可避开预验证的限制：

主Pipeline修改

trigger:
  - main

extends:
  template: deploy-template.yml
  parameters:
    buildConfiguration: 'Release'
    azureSubscription: 'name of our subscription' # 添加订阅参数

deploy-template.yml修改

parameters:
- name: buildConfiguration
  type: string
  default: ''
- name: azureSubscription # 新增订阅参数
  type: string
  default: ''

stages:
- stage: buildstage
  pool:
    vmImage: ubuntu-latest

  jobs:
  - job: buildjob
    variables:
      buildConfiguration: '${{ parameters.buildConfiguration }}'
    steps:
    (couple of tasks here)

    - task: AzureRmWebAppDeployment@4
      displayName: 'Deploy to slot'
      condition: succeeded()
      inputs:
        ConnectionType: 'AzureRM'
        azureSubscription: '${{ parameters.azureSubscription }}' # 使用参数替换变量
        appType: 'webApp'
        (etc)

内容的提问来源于stack exchange，提问作者ingredient_15939