Azure DevOps Terraform流水线Apply阶段无故跳过问题求助

重构Azure DevOps Terraform部署流水线后，已将tfplan转为流水线工件，修复状态锁问题并添加调试步骤，但Apply阶段无报错直接被跳过。Plan阶段明确显示将新增7项资源且检测到变更，Apply任务却未执行。

相关日志与配置 #

Plan阶段关键日志 #

Plan: 7 to add, 0 to change, 0 to destroy.

─────────────────────────────────────────────────────────────────────────────

Saved the plan to: main.tfplan

To perform exactly these actions, run the following command to apply:
    terraform apply "main.tfplan"

Finishing: Terraform Plan

Starting: Check for Terraform Plan Changes
==============================================================================
Task         : Command line
Description  : Run a command line script using Bash on Linux and macOS and cmd.exe on Windows
Version      : 2.250.1
Author       : Microsoft Corporation
==============================================================================
Generating script.
========================== Starting Command Output ===========================
/usr/bin/bash --noprofile --norc /home/vsts/work/_temp/921dfbc5-a753-4552-ad97-5aca70a5383e.sh
Changes detected

Finishing: Check for Terraform Plan Changes

Apply阶段日志 #

The job was skipped.

流水线核心配置（azure-pipelines.yml） #

# ... 省略环境准备阶段 ...

- stage: Plan
  dependsOn: DeployingIaCTerraform
  jobs:
    - job: TerraformPlan
      displayName: 'Plan Terraform Deployment'
      steps:
        # ... 省略init和plan步骤 ...
        - script: |
            terraform show -no-color main.tfplan > plan_output.log
            if grep -q "No changes. Infrastructure is up-to-date." plan_output.log; then
              echo "No changes detected"
              echo "##vso[task.setvariable variable=terraformPlanChanges;isOutput=true]false"
            else
              echo "Changes detected"
              echo "##vso[task.setvariable variable=terraformPlanChanges;isOutput=true]true"
            fi
          displayName: 'Check for Terraform Plan Changes'
          name: checkChanges
        - publish: $(System.DefaultWorkingDirectory)/main.tfplan
          artifact: main.tfplan
          displayName: 'Publish main.tfplan artifact'
          
- stage: Apply
  dependsOn: Plan
  variables:
    runApply: $[stageDependencies.Plan.TerraformPlan.outputs['checkChanges.terraformPlanChanges']]
  condition: eq(variables['runApply'], 'true')
  jobs:
    - job: TerraformApply
      displayName: 'Apply Terraform Plan'
      timeoutInMinutes: 120
      steps:
        # ... 省略调试和下载步骤 ...
        - task: TerraformTaskV4@4
          displayName: 'Terraform Apply'
          inputs:
            provider: 'azurerm'
            command: 'apply'
            workingDirectory: '$(System.DefaultWorkingDirectory)'
            environmentServiceNameAzureRM: '$(azureServiceConnection)'
            commandOptions: "$(System.DefaultWorkingDirectory)/main.tfplan -input=false"

问题诊断 #

核心原因是跨阶段变量传递的语法未被正确解析：

• Apply阶段通过中间变量runApply传递值时，表达式解析出现隐性问题，导致无法正确获取Plan阶段输出的terraformPlanChanges值，最终eq(variables['runApply'], 'true')条件不成立，阶段被跳过。
• Azure DevOps跨阶段引用作业输出变量时，必须确保阶段名、作业名、步骤名完全匹配，且表达式语法无歧义。

修复方案 #

1. 简化条件判断逻辑 #

直接在Apply阶段的condition中引用Plan阶段的输出变量，跳过中间变量传递，避免解析问题：

- stage: Apply
  dependsOn: Plan
  # 直接在condition中引用输出变量，无需定义runApply
  condition: eq(stageDependencies.Plan.TerraformPlan.outputs['checkChanges.terraformPlanChanges'], 'true')
  jobs:
    - job: TerraformApply
      # ... 其余配置不变 ...

2. 验证变量传递（调试步骤） #

在Plan阶段的checkChanges步骤中添加打印，确认变量被正确设置：

echo "##vso[task.setvariable variable=terraformPlanChanges;isOutput=true]true"
echo "terraformPlanChanges set to: true" # 新增该行，直观确认变量值

同时在Apply阶段开头添加步骤，验证变量是否传递成功：

- script: |
    echo "Cross-stage variable value: $(stageDependencies.Plan.TerraformPlan.outputs['checkChanges.terraformPlanChanges'])"
  displayName: 'Verify cross-stage variable'

3. 修正Terraform Apply命令参数 #

由于已通过DownloadPipelineArtifact将tfplan下载到工作目录，直接使用文件名即可，无需完整路径：

commandOptions: 'main.tfplan -input=false'

验证修复 #

重新运行流水线：

1. 确认Plan阶段的checkChanges步骤输出Changes detected和变量设置日志。
2. Apply阶段将不再被跳过，会执行所有步骤并完成7项资源的部署。

内容的提问来源于stack exchange，提问作者jma