Azure DevOps Pipeline发布工件时遇路径权限拒绝错误

问题场景 #

执行PublishBuildArtifacts任务时触发权限拒绝错误，YAML脚本如下：

- task: PublishBuildArtifacts@1
  inputs:
    PathtoPublish: '$(Build.ArtifactStagingDirectory)/DockerImage.tar'
    ArtifactName: 'Docker-Image'
    publishLocation: 'Container'

错误日志：

Fail to upload '/home/vsts/work/1/a/DockerImage.tar' due to 'Access to the path '/home/vsts/work/1/a/DockerImage.tar' is denied.'.
System.UnauthorizedAccessException: Access to the path '/home/vsts/work/1/a/DockerImage.tar' is denied.
---> System.IO.IOException: Permission denied
--- End of inner exception stack trace ---
at Interop.ThrowExceptionForIoErrno(ErrorInfo errorInfo, String path, Boolean isDirectory, Func2 errorRewriter) at Interop.CheckIo(Error error, String path, Boolean isDirectory, Func2 errorRewriter)
at Microsoft.Win32.SafeHandles.SafeFileHandle.Open(String path, OpenFlags flags, Int32 mode)
at Microsoft.Win32.SafeHandles.SafeFileHandle.Open(String fullPath, FileMode mode, FileAccess access, FileShare share, FileOptions options, Int64 preallocationSize)
at System.IO.Strategies.OSFileStreamStrategy..ctor(String path, FileMode mode, FileAccess access, FileShare share, FileOptions options, Int64 preallocationSize)
at Microsoft.VisualStudio.Services.Agent.Worker.Build.FileContainerServer.UploadAsync(IAsyncCommandContext context, Int32 uploaderId, CancellationToken token) in /mnt/vss/_work/1/s/src/Agent.Worker/Build/FileContainerServer.cs:line 251

解决步骤 #

1. 调整文件权限与所有权 #

Linux代理环境下，生成的DockerImage.tar可能存在权限过严或用户归属不符的情况，在发布任务前添加权限调整脚本：

- script: |
    # 赋予文件可读权限
    chmod 644 $(Build.ArtifactStagingDirectory)/DockerImage.tar
    # 若存在所有权问题，将文件归属改为Pipeline执行用户（示例为vsts）
    # sudo chown vsts:vsts $(Build.ArtifactStagingDirectory)/DockerImage.tar
  displayName: '调整Docker镜像文件权限'

2. 验证文件存在性 #

添加文件检查步骤，确认目标文件已生成且路径正确：

- script: |
    ls -la $(Build.ArtifactStagingDirectory)/
  displayName: '检查Artifact目录文件'

若文件不存在，需先排查镜像打包步骤是否执行成功。

3. 配置Pipeline服务账号权限 #

进入项目设置，确保构建服务账号拥有足够权限：

• 路径：项目设置 → 工件 → 选择对应工件库 → 点击「权限」
• 添加构建服务账号（格式：[项目名称] Build Service ([组织名称])），赋予读取和写入权限
• 同时检查项目设置 → 管道 → 权限，确保该账号拥有管道的编辑和执行权限

4. 切换至新版发布任务 #

PublishBuildArtifacts@1为旧版任务，建议使用兼容性更好的PublishPipelineArtifact@1：

- task: PublishPipelineArtifact@1
  inputs:
    targetPath: '$(Build.ArtifactStagingDirectory)/DockerImage.tar'
    artifact: 'Docker-Image'
    publishLocation: 'Container'

内容的提问来源于stack exchange，提问作者Sanskar Arya