如何将Azure流水线生成的PDF工件自动附加到指定分支PR中

要实现从develop/test分支向master分支提交PR时，自动将流水线生成的最新PDF工件附加到PR中，可按以下步骤修改流水线配置并完成权限设置：

1. 调整流水线触发规则 #

首先确保流水线会在PR创建/更新时触发，在YAML顶部添加触发配置，保留原分支修改触发的同时新增PR触发规则：

trigger:
  branches:
    include:
      - develop
      - test
pr:
  branches:
    include:
      - master
  paths:
    exclude:
      - README.md # 按需排除无需触发流水线的文件路径

2. 添加PR附件提交步骤 #

在流水线的Build任务末尾，新增下载工件并调用Azure DevOps API将PDF附加到PR评论的步骤：

# 放在PublishPipelineArtifact步骤之后
- task: DownloadPipelineArtifact@2
  inputs:
    buildType: 'current'
    artifactName: 'report'
    targetPath: '$(Pipeline.Workspace)/downloaded-report'
  displayName: "下载最新生成的PDF报告"

- script: |
    # 获取当前PR编号（Azure DevOps自动注入的系统变量）
    PR_ID=$(System.PullRequest.PullRequestId)
    # 替换为你的Azure DevOps组织名和项目名
    ORGANIZATION="你的组织名称"
    PROJECT="你的项目名称"
    # 构造PR评论API请求地址
    API_URL="https://dev.azure.com/$ORGANIZATION/$PROJECT/_apis/git/repositories/$(Build.Repository.ID)/pullRequests/$PR_ID/comments?api-version=7.1-preview.3"
    
    # 构造包含附件的评论请求体
    COMMENT_PAYLOAD=$(cat <<EOF
    {
      "content": "流水线自动生成的报告已附加：",
      "attachments": [
        {
          "fileName": "report.pdf",
          "_links": {
            "self": {
              "href": "$(Pipeline.Workspace)/downloaded-report/report.pdf"
            }
          }
        }
      ]
    }
    EOF
    )
    
    # 使用系统令牌调用API提交评论
    curl -X POST -H "Content-Type: application/json" -H "Authorization: Bearer $(System.AccessToken)" -d "$COMMENT_PAYLOAD" $API_URL
  displayName: "将PDF附件添加到PR评论"

3. 配置流水线权限 #

• 进入项目设置 → 存储库 → 目标代码库 → 权限，找到Project Collection Build Service (你的组织名)，赋予它Contribute to pull requests权限（允许评论PR）
• 在流水线编辑页面，点击右上角「...」→ 触发器 → YAML，勾选「允许脚本访问OAuth令牌」（确保System.AccessToken变量可用）

修改后的完整YAML示例 #

trigger:
  branches:
    include:
      - develop
      - test
pr:
  branches:
    include:
      - master

jobs:
- job: Build
  pool:
    vmImage: ${{ parameters.vmImage }}

  variables:
    PIP_CACHE_DIR: $(Pipeline.Workspace)/.pip

  steps:

  - task: Cache@2
    inputs:
      key: 'pip | "$(Agent.OS)" | requirements.txt'
      restoreKeys: | 
        pip | "$(Agent.OS)"
      path: $(PIP_CACHE_DIR)
    displayName: "Cache pip packages"

  - script: |
      pip install -r requirements.txt
    displayName: "Install report tool dependencies"

  - script: |
      python report.py
    displayName: 'Running report tool'

  - task: PublishPipelineArtifact@1
    inputs:
      targetPath: 'report.pdf'
      artifactType: 'pipeline'
      artifactName: 'report'
    displayName: "Publish the report Artifact"

  - task: DownloadPipelineArtifact@2
    inputs:
      buildType: 'current'
      artifactName: 'report'
      targetPath: '$(Pipeline.Workspace)/downloaded-report'
    displayName: "下载最新生成的PDF报告"

  - script: |
      PR_ID=$(System.PullRequest.PullRequestId)
      ORGANIZATION="你的组织名称"
      PROJECT="你的项目名称"
      API_URL="https://dev.azure.com/$ORGANIZATION/$PROJECT/_apis/git/repositories/$(Build.Repository.ID)/pullRequests/$PR_ID/comments?api-version=7.1-preview.3"
      
      COMMENT_PAYLOAD=$(cat <<EOF
      {
        "content": "流水线自动生成的报告已附加：",
        "attachments": [
          {
            "fileName": "report.pdf",
            "_links": {
              "self": {
                "href": "$(Pipeline.Workspace)/downloaded-report/report.pdf"
              }
            }
          }
        ]
      }
      EOF
      )
      
      curl -X POST -H "Content-Type: application/json" -H "Authorization: Bearer $(System.AccessToken)" -d "$COMMENT_PAYLOAD" $API_URL
    displayName: "将PDF附件添加到PR评论"

注意事项 #

• 务必替换ORGANIZATION和PROJECT为你的实际Azure DevOps组织和项目名称
• 若API调用失败，检查服务主体权限是否配置正确，或尝试更新API版本号

内容的提问来源于stack exchange，提问作者AKD