Azure DevOps构建流水线自动创建PR失败，PAT配置问题求助

我尝试用以下PowerShell脚本在Azure DevOps中自动创建Pull Request（PR）：

CreatePRBuildTask.ps1 #

$user = ""
$branchTarget = "refs/heads/main"
$branchSource = "refs/heads/develop"
$branchTargetPath = $branchTarget -replace "refs/heads/", ""
$teamProject = "Project"
$repoName = "Repo"
$organization = "Org"

$base64AuthInfo = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(("{0}:{1}" -f $user,$token)))
 
$uriBranchStatus = "https://dev.azure.com/$organization/$teamProject/_apis/git/repositories/$repoName/stats/branches?name=$branchTargetPath&api-version=5.1"
$uriCheckActivePR = "https://dev.azure.com/$organization/$teamProject/_apis/git/repositories/$repoName/pullrequests?searchCriteria.targetRefName=$branchTarget&searchCriteria.sourceRefName=$branchSource&api-version=5.1"
$uriCreatePR = "https://dev.azure.com/$organization/$teamProject/_apis/git/repositories/$repoName/pullrequests?api-version=5.1"

Write-Host $token
Write-Host $uriBranchStatus
Write-Host $uriCheckActivePR
Write-Host $uriCreatePR

# $resultStatus = Invoke-RestMethod -Uri $uriBranchStatus -Method Get -ContentType "application/json" -Headers @{Authorization=("Basic {0}" -f $base64AuthInfo)}

# if ($resultStatus.behindCount -eq 0)
# {
#     Write-Host "Current branch contains last changes from master"
#     Return
# }

# $resultActivePR = Invoke-RestMethod -Uri $uriCheckActivePR -Method Get -ContentType "application/json" -Headers @{Authorization=("Basic {0}" -f $base64AuthInfo)}

# if ($resultActivePR.count -gt 0) 
# {
#     Write-Host "PR exists already"
#     Return
# }

$bodyCreatePR = "{sourceRefName:'$branchSource',targetRefName:'$branchTarget',title:'Sync changes from $branchSource'}"

$result = Invoke-RestMethod -Uri $uriCreatePR -Method Post -ContentType "application/json" -Headers @{Authorization=("Basic {0}" -f $base64AuthInfo)} -Body $bodyCreatePR

Write-Host "Created PR" $result.pullRequestId

我已生成PAT并添加为流水线变量，同时配置了如下YAML流水线及模板文件：

主YAML流水线 #

name: 1.0

trigger:
- develop
- main

pool:
  vmImage: "windows-latest"

variables:
  "Token": $(CUSTOM_ACCESSTOKEN)

stages:

- template: build.yml
  parameters:
    token: $(Token)

build.yml 模板 #

parameters:
- name: token
  type: string

stages:

- stage: Build
  jobs:
  - job: Build

    steps:
    - task: PowerShell@2
      displayName: 'PowerShell Script'
      inputs:
        targetType: filePath
        filePath: ./Scripts/CreatePRBuildTask.ps1
        arguments: '-token ${{ parameters.token }}'

运行构建后，日志显示“Created PR”但实际未生成PR，还输出了Azure DevOps登录页面的HTML内容，推测是PAT读取或使用异常。请问如何在YAML中正确使用PAT，以及如何修复该问题？

1. 让PowerShell脚本接收Token参数 #

脚本未定义$token参数，导致无法接收流水线传递的值，这是核心问题。修改脚本开头，添加参数定义：

param(
    [Parameter(Mandatory=$true)]
    [string]$token
)

# 原脚本剩余内容...
$user = ""
$branchTarget = "refs/heads/main"
...

2. 修正JSON请求体格式 #

当前请求体用单引号包裹属性值，不符合标准JSON规范（要求双引号），会导致API解析失败。修改为：

$prBodyObject = @{
    sourceRefName = $branchSource
    targetRefName = $branchTarget
    title = "Sync changes from $branchSource"
}
$bodyCreatePR = $prBodyObject | ConvertTo-Json

3. 正确处理PAT的保密性 #

• 在Azure DevOps流水线设置中，将CUSTOM_ACCESSTOKEN标记为保密变量，避免明文泄露。
• 主YAML变量定义简化为：

  variables:
    Token: $(CUSTOM_ACCESSTOKEN)
  

• 删除脚本中Write-Host $token的敏感输出代码。

4. 验证PAT的权限范围 #

确保PAT拥有以下权限：

• 代码：读取 & 写入
• 拉取请求：读取 & 写入
  权限范围不足会导致无法创建PR。

5. 启用分支检查逻辑 #

取消注释脚本中关于分支状态和已有PR的检查代码，避免无效操作：

$resultStatus = Invoke-RestMethod -Uri $uriBranchStatus -Method Get -ContentType "application/json" -Headers @{Authorization=("Basic {0}" -f $base64AuthInfo)}

if ($resultStatus.behindCount -eq 0)
{
    Write-Host "Current branch contains last changes from main"
    Return
}

$resultActivePR = Invoke-RestMethod -Uri $uriCheckActivePR -Method Get -ContentType "application/json" -Headers @{Authorization=("Basic {0}" -f $base64AuthInfo)}

if ($resultActivePR.count -gt 0) 
{
    Write-Host "PR exists already"
    Return
}

6. 添加错误捕获与调试 #

在Invoke-RestMethod后增加错误处理，便于排查问题：

try {
    $result = Invoke-RestMethod -Uri $uriCreatePR -Method Post -ContentType "application/json" -Headers @{Authorization=("Basic {0}" -f $base64AuthInfo)} -Body $bodyCreatePR
    Write-Host "Created PR" $result.pullRequestId
}
catch {
    Write-Error "Failed to create PR: $_"
    Write-Error "Response content: $($_.Exception.Response.Content.ReadAsStringAsync().Result)"
}

内容的提问来源于stack exchange，提问作者user989988