本地可用的PAT在Azure发布管道中触发未授权访问错误

问题场景 #

• 本地使用Full Access PAT令牌可正常查询并创建Azure DevOps工作项/缺陷
• 在Azure发布管道中通过.NET Core任务集成代码，将PAT设为秘密变量并映射到环境变量后，执行时抛出授权异常

管道配置与代码实现 #

管道环境变量映射 #

env:
    Mapped_PAT: $(PAT)

C#代码获取环境变量 #

string mapped_pat = Environment.GetEnvironmentVariable("MAPPED_PAT", EnvironmentVariableTarget.Process);

异常信息 #

Unhandled exception. Microsoft.VisualStudio.Services.Common.VssUnauthorizedException: VS30063: You are not authorized to access https://dev.azure.com.
2023-03-30T19:32:02.8705595Z    at Microsoft.VisualStudio.Services.Common.VssHttpMessageHandler.SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
2023-03-30T19:32:02.8709311Z    at System.Net.Http.HttpClient.<SendAsync>g__Core|83_0(HttpRequestMessage request, HttpCompletionOption completionOption, CancellationTokenSource cts, Boolean disposeCts, CancellationTokenSource pendingRequestsCts, CancellationToken originalCancellationToken)
2023-03-30T19:32:02.8710466Z    at Microsoft.VisualStudio.Services.WebApi.VssHttpClientBase.SendAsync(HttpRequestMessage message, HttpCompletionOption completionOption, Object userState, CancellationToken cancellationToken)
2023-03-30T19:32:02.8711424Z    at Microsoft.VisualStudio.Services.WebApi.VssHttpClientBase.SendAsync[T](HttpRequestMessage message, Object userState, CancellationToken cancellationToken)
2023-03-30T19:32:02.8713547Z    at Microsoft.VisualStudio.Services.WebApi.VssHttpClientBase.GetResourceLocationsAsync(Boolean allHostTypes, Object userState, CancellationToken cancellationToken)
2023-03-30T19:32:02.8714732Z    at Microsoft.VisualStudio.Services.WebApi.VssHttpClientBase.EnsureResourceLocationsPopulated(Object userState, CancellationToken cancellationToken)
2023-03-30T19:32:02.8715955Z    at Microsoft.VisualStudio.Services.WebApi.VssHttpClientBase.GetResourceLocationAsync(Guid locationId, Object userState, CancellationToken cancellationToken)
2023-03-30T19:32:02.8718068Z    at Microsoft.VisualStudio.Services.WebApi.VssHttpClientBase.CreateRequestMessageAsync(HttpMethod method, IEnumerable`1 additionalHeaders, Guid locationId, Object routeValues, ApiResourceVersion version, HttpContent content, IEnumerable`1 queryParameters, Object userState, CancellationToken cancellationToken, String mediaType)
2023-03-30T19:32:02.8719344Z    at Microsoft.VisualStudio.Services.WebApi.VssHttpClientBase.SendAsync[T](HttpMethod method, IEnumerable`1 additionalHeaders, Guid locationId, Object routeValues, ApiResourceVersion version, HttpContent content, IEnumerable`1 queryParameters, Object userState, CancellationToken cancellationToken)

排查与解决 #

• 已确认映射的环境变量存在有效值
• 尝试修剪PAT末尾的逗号，未解决问题
• 最终通过在Azure管道环境变量中使用SYSTEM_ACCESSTOKEN替代自定义PAT变量，成功解决授权异常

内容的提问来源于stack exchange，提问作者Blueguy2240