Azure DevOps添加ManualValidation任务报错及自托管代理需求问题

错误原因 #

ManualValidation@0是Azure DevOps的服务器端任务，这类任务只能在指定pool: server的job中运行，无法在使用自托管代理或微软托管代理的job（包括deployment类型的job）里执行，这就是你遇到"Step references task 'ManualValidation' at version '0.238.0' which is not valid for the given job target"错误的根源。

解决方案 #

将流程拆分为独立的job，通过依赖关系保证执行顺序，既让Terraform任务在自托管代理terraform-vm上运行，又让ManualValidation任务在server pool中执行：

• 第一个job：在自托管代理上完成Terraform初始化、验证、计划操作
• 第二个job：使用pool: server执行人工验证
• 第三个job：依赖前两个job成功后，在自托管代理上执行Terraform应用

修改后的terraform.yaml模板 #

stages:
- stage: "TF_tasks"
  condition:  and(succeeded(), or(eq(variables['Build.SourceBranchName'], 'main'), eq(variables['Build.SourceBranchName'], 'dev'), eq(variables['Build.SourceBranchName'], 'uat')))
  displayName: "Terraform tasks"
  jobs:
    # Job 1: 自托管代理上执行Terraform init/validate/plan
    - job: TerraformPlan
      displayName: 'Terraform Plan (Dev)'
      condition: eq(variables['Build.SourceBranchName'], 'dev')
      pool: terraform-vm
      steps:
        - task: TerraformInstaller@1
          inputs:
              terraformVersion: 'latest'

        - task: TerraformTaskV4@4
          displayName: "Terraform Init"
          inputs:
              provider: 'azurerm'
              command: 'init'
              workingDirectory: '$(Pipeline.Workspace)/s'
              backendServiceArm: 'xxxxxxxxx'
              backendAzureRmResourceGroupName: 'xxxxxxxxxxxxx'
              backendAzureRmStorageAccountName: 'xxxxx'
              backendAzureRmContainerName: 'xxxxxxxxxx'
              backendAzureRmKey: 'xxxxxxxxxxxx'
      
        - task: TerraformTaskV4@4
          displayName: "Terraform_validate"
          inputs:
              provider: 'azurerm'
              command: 'validate'
              environmentServiceNameAzureRM: 'xxxxxxxxxxxxx'
              workingDirectory: '$(Pipeline.Workspace)/s'

        - task: TerraformTaskV4@4
          displayName: "Terraform plan"
          inputs:
              provider: 'azurerm'
              command: 'plan'
              workingDirectory: '$(Pipeline.Workspace)/s'
              commandOptions: '-var-file=tfvars/dev.tfvars'
              environmentServiceNameAzureRM: 'xxxxxxxxxxxxx'

    # Job 2: Server pool执行人工验证
    - job: ManualApproval
      displayName: 'Manual Approval (Dev)'
      condition: eq(variables['Build.SourceBranchName'], 'dev')
      pool: server
      dependsOn: TerraformPlan
      steps:
        - task: ManualValidation@0
          timeoutInMinutes: 5
          inputs:
            notifyUsers: "xxxxxxxxxxxxxxx"

    # Job 3: 自托管代理上执行Terraform Apply，依赖前两个job成功
    - deployment: DeploymentToDev
      displayName: 'Deploy To Dev'
      condition: eq(variables['Build.SourceBranchName'], 'dev')
      environment: 'dev'
      pool: terraform-vm
      dependsOn: ManualApproval
      strategy:
        runOnce:
          deploy:
            steps:
              - task: TerraformInstaller@1
                inputs:
                    terraformVersion: 'latest'

              - task: TerraformTaskV4@4
                displayName: "Terraform Apply"
                inputs:
                    provider: 'azurerm'
                    command: 'apply'
                    workingDirectory: '$(Pipeline.Workspace)/s'
                    commandOptions: '-var-file=tfvars/dev.tfvars'
                    environmentServiceNameAzureRM: 'xxxxxxxxxxxxxx'

关键修改说明 #

1. 拆分Job：将原有的单个deployment job拆分为三个独立job，明确每个job的执行环境
2. 指定Pool：ManualValidation所在的job显式设置pool: server，其他job指定pool: terraform-vm（或继承顶级流水线的pool配置）
3. 依赖控制：通过dependsOn属性设置job执行顺序，确保只有前序任务成功后才会执行后续任务
4. 保留Environment配置：DeploymentToDev这个deployment job依然保留environment: 'dev'配置，符合你的部署环境需求

内容的提问来源于stack exchange，提问作者Sharat Bhaskar