Azure DevOps发布成功但Azure SQL生产库未部署变更

数据老陈

2026-7-2

问题

我正在通过Azure DevOps发布管道部署SQL DacPac文件，将变更从DEV环境推广至Azure SQL Database生产环境。作为Azure DevOps新手，我已参考官方文档及谷歌完成配置，但遇到如下问题：构建与发布管道均显示成功，但生产数据库未体现变更。

发布管道YAML：

steps:
- task: SqlAzureDacpacDeployment@1
  displayName: 'Azure SQL DacpacTask'
  inputs:
    azureSubscription: 'azure_subscription'
    ServerName: server_name
    DatabaseName: 'database_name'
    SqlUsername: user_name
    SqlPassword: password
    DeploymentAction: DeployReport
    DacpacFile: '$(System.DefaultWorkingDirectory)/AzureDB_Test/Test/bin/Debug/Test.dacpac'

Azure SQL DacPacTask日志：

2024-01-06T21:27:27.9410537Z ##[section]Starting: Azure SQL DacpacTask
2024-01-06T21:27:27.9722384Z ==============================================================================
2024-01-06T21:27:27.9722835Z Task         : Azure SQL Database deployment
2024-01-06T21:27:27.9723374Z Description  : Deploy an Azure SQL Database using DACPAC or run scripts using SQLCMD
2024-01-06T21:27:27.9723284Z Version      : 1.232.0
2024-01-06T21:27:27.9723394Z Author       : Microsoft Corporation
2024-01-06T21:27:27.9723957Z Help         : https://docs.microsoft.com/azure/devops/pipelines/tasks/deploy/sql-azure-dacpac-deployment
2024-01-06T21:27:27.9723395Z ==============================================================================
2024-01-06T21:27:29.7550294Z Added TLS 1.2 in session.
2024-01-06T21:27:44.6571057Z Temporary inline SQL file: C:\Users\VssAdministrator\AppData\Local\Temp\tmpC89E.tmp
2024-01-06T21:27:44.9123856Z Invoke-Sqlcmd -ServerInstance "server_name" -Database "database_name" -Username "user_name"  -Password "password"  -Inputfile "C:\Users\VssAdministrator\AppData\Local\Temp\tmpC89E.tmp"  **-ConnectionTimeout 120**
2024-01-06T21:27:58.3224482Z DACPAC file path: D:\a\r1\a\_nEDS_AzureDB_Test\nEDS_Test\bin\Debug\nEDS_Test.dacpac
2024-01-06T21:27:58.6926284Z ##[command]"D:\a\_tasks\SqlAzureDacpacDeployment_ch87a08b-a478-4e2b-8369-1d37u9ab560f\1.232.0\vswhere.exe" -version [15.0,18.0) -latest -format json
2024-01-06T21:27:59.5484384Z "C:\Program Files\Microsoft SQL Server\160\DAC\bin\SqlPackage.exe" /Action:DeployReport /SourceFile:"D:\a\r1\a\AzureDB_Test\Test\bin\Debug\Test.dacpac" /TargetServerName:"server_name" /TargetDatabaseName:"database_name" /TargetUser:"user_name" /TargetPassword:"password" /OutputPath:"D:\a\r1\a\GeneratedOutputFiles\ACAEDS_Prod_DevOps_DeployReport.xml"  /**TargetTimeout:120**
2024-01-06T21:28:04.0578492Z Generating report for database 'database_name' on server 'server_name'.
2024-01-06T21:28:23.7792056Z Successfully generated report to file D:\a\r1\a\GeneratedOutputFiles\Report.xml.
2024-01-06T21:28:23.7803000Z Changes to connection setting default values were incorporated in a recent release.  More information is available at https://aka.ms/dacfx-connection
2024-01-06T21:28:23.7806733Z Time elapsed 0:00:20.21
2024-01-06T21:28:23.8142166Z Generated file D:\a\r1\a\GeneratedOutputFiles\Report.xml. Uploading file to the logs.
2024-01-06T21:28:23.8160223Z Setting output variable 'SqlDeploymentOutputFile' to 'D:\a\r1\a\GeneratedOutputFiles\.xml'
2024-01-06T21:28:23.8509958Z ##[section]Finishing: Azure SQL DacpacTask

请问生产数据库的该问题是否与资源组上仅为服务主体分配Reader角色有关？执行这些操作是否必须具备Contributor角色？我目前无法获取资源组的Contributor角色。

解答

核心问题：未执行实际部署
你的YAML中DeploymentAction设置为DeployReport，这个选项仅会生成部署变更报告（日志里也显示成功生成了Report.xml），不会对目标数据库执行任何实际的变更操作。要真正部署DacPac，需要将DeploymentAction改为Publish。修改后的YAML片段如下：
```
DeploymentAction: Publish
```
关于资源组角色的疑问
当前任务使用的是SqlUsername和SqlPassword进行SQL身份验证，直接连接到Azure SQL Database，这种情况下资源组的RBAC角色（Reader/Contributor）不影响该任务的执行。真正需要的是SQL账号拥有目标数据库的权限：至少需要db_ddladmin角色（用于执行架构变更），或者db_owner角色（权限更高）。

内容的提问来源于stack exchange，提问作者Nilesh Patel