Azure DevOps拒绝审批后后续部署任务未执行的问题排查

核心问题 #

当你拒绝环境的手动批准时，ManualApproval部署任务的最终状态是Failed，而非你预期的Canceled。你的条件not(canceled())虽然能排除任务被主动取消的情况，但Azure DevOps默认会因为前置依赖任务失败而直接跳过后续任务，不会触发AutomateActions。此外，若批准被拒绝，ManualApproval的部署步骤根本不会执行，导致isApproved输出变量未被创建，后续PowerShell任务会因变量不存在直接报错。

具体修复步骤 #

1. 调整后续任务的执行条件
   将AutomateActions的条件修改为覆盖前置任务成功/失败/跳过的所有非取消状态，确保无论前置任务是批准通过还是被拒绝，只要没被主动取消，后续任务都会触发：

condition: not(canceled()) and (succeeded('ManualApproval') or failed('ManualApproval') or skipped('ManualApproval'))

更简洁的写法可以用always()结合not(canceled())（需排除Canceled状态）：

condition: always() and not(canceled())

2. 处理未初始化的isApproved变量
   由于批准被拒绝时ManualApproval的部署步骤未执行，isApproved变量不存在，需要在AutomateActions的PowerShell任务中先判断变量是否存在并设置默认值：

$isApproved = if (Test-Path env:isApproved) { $env:isApproved -eq 'true' } else { $false }
if (-not $isApproved) {
    throw "trigger failed job condition"
}
Write-Host "trigger success job condition"

3. 完整修改后的YAML片段

jobs:
 - deployment: ManualApproval
   displayName: Approve manual oversight gate
   environment: ${{ variables.gateEnvironment }}
   strategy:
     runOnce:
       deploy:
         steps:
         - download: none
         - checkout: none
         - task: Bash@3
           displayName: "Set variable"
           inputs:
             targetType: 'inline'
             script: |
               echo "##vso[task.setvariable variable=isApproved;isoutput=true]true"
 - deployment: AutomateActions
   displayName: Run conditional steps
   dependsOn: [ManualApproval]
   # 修改条件，覆盖前置任务成功/失败/跳过的非取消状态
   condition: always() and not(canceled())
   pool:
     name: dpy-pool-dev
   environment: 'AKS'
   strategy:
     runOnce:
       deploy:
         steps:
         - download: none
         - checkout: none
         - task: PowerShell@2
           displayName: "Check variable"
           inputs:
             targetType: 'inline'
             script: |
               # 判断变量是否存在，设置默认值为false
               $isApproved = if (Test-Path env:isApproved) { $env:isApproved -eq 'true' } else { $false }
               if ((-not $isApproved)) {
                 throw "trigger failed job condition"
               }
               Write-Host "trigger success job condition"
       on:
         success:
           steps:
           - download: none
           - checkout: none
           - ${{ if eq(parameters.stageName, 'ValidateApp') }}:
             - task: PowerShell@2
               condition: eq(variables['Build.Reason'], 'PullRequest')
               displayName: "Delete backup image tag"
               env:
                 AZURE_DEVOPS_EXT_PAT: $(System.AccessToken)
               inputs:
                 targetType: 'inline'
                 script: |
                   # do something
         failure:
           steps:
           - download: none
           - checkout: none
           - task: PowerShell@2
             displayName: "Revert image tag"
             env:
               AZURE_DEVOPS_EXT_PAT: $(System.AccessToken)
             inputs:
               targetType: 'inline'
               script: |
                 # do something

补充说明 #

Azure DevOps中环境批准的状态对应任务状态规则：

• 批准通过：任务状态为Succeeded
• 批准拒绝：任务状态为Failed
• 手动取消任务：任务状态为Canceled
  所以必须在条件中明确覆盖Failed状态，才能让后续任务在拒绝批准时触发。

内容的提问来源于stack exchange，提问作者Bennimi