如何基于分支/PR在Azure DevOps Pipeline实现多环境Docker构建？

核心思路 #

通过Docker构建参数（--build-arg）结合Azure DevOps变量组、Key Vault，将不同环境的配置在构建阶段注入镜像，避免硬编码生产配置到appsettings.json。同时根据分支/PR自动关联对应变量组，实现环境差异化构建。

步骤1：配置Azure DevOps变量组与Key Vault #

• 分环境创建变量组：比如Production-Vars、Test-Vars、Dev-Vars，非敏感配置直接存入变量组，敏感配置（如数据库密码、API密钥）通过链接Key Vault的方式关联到对应变量组。
• 配置权限控制：确保生产环境变量组仅在main分支构建时可访问，避免非授权场景泄露敏感数据。

步骤2：修改Dockerfile支持构建参数注入 #

在Dockerfile中添加ARG指令接收构建参数，生成对应环境的appsettings.{Environment}.json（符合.NET配置优先级规则，会自动覆盖appsettings.json默认值）：

# 基础运行镜像
FROM mcr.microsoft.com/dotnet/aspnet:6.0 AS base
WORKDIR /app
EXPOSE 80

# 构建阶段
FROM mcr.microsoft.com/dotnet/sdk:6.0 AS build
WORKDIR /src
COPY ["YourProject.csproj", "."]
RUN dotnet restore "./YourProject.csproj"
COPY . .
WORKDIR "/src/."

# 声明构建参数
ARG ASPNETCORE_ENVIRONMENT
ARG ConnectionString
ARG ApiKey

# 生成环境专属配置文件
RUN echo '{ "ConnectionStrings": { "Default": "'"$ConnectionString"'" }, "ApiSettings": { "Key": "'"$ApiKey"'" } }' > appsettings.$ASPNETCORE_ENVIRONMENT.json

RUN dotnet build "YourProject.csproj" -c Release -o /app/build

# 发布阶段
FROM build AS publish
RUN dotnet publish "YourProject.csproj" -c Release -o /app/publish /p:UseAppHost=false

# 最终镜像
FROM base AS final
WORKDIR /app
COPY --from=publish /app/publish .
# 设置环境变量，让.NET自动加载对应环境的配置
ENV ASPNETCORE_ENVIRONMENT=$ASPNETCORE_ENVIRONMENT
ENTRYPOINT ["dotnet", "YourProject.dll"]

步骤3：修改Azure DevOps流水线YAML，实现分支/PR关联变量组 #

根据分支名称、PR目标分支自动加载对应变量组，并在Docker构建任务中传递参数：

trigger:
  - main
  - test
  - development

variables:
  - name: vmImageName
    value: 'ubuntu-latest'
  - name: imageRepository
    value: 'your-repo-name'
  - name: dockerfilePath
    value: '**/Dockerfile'
  # 分支匹配：加载对应环境变量组与标识
  - ${{ if eq(variables['Build.SourceBranchName'], 'main') }}:
      - group: Production-Vars
      - name: buildEnvironment
        value: 'Production'
  - ${{ if eq(variables['Build.SourceBranchName'], 'test') }}:
      - group: Test-Vars
      - name: buildEnvironment
        value: 'Test'
  - ${{ if eq(variables['Build.SourceBranchName'], 'development') }}:
      - group: Dev-Vars
      - name: buildEnvironment
        value: 'Development'
  # PR场景匹配：根据目标分支加载对应配置
  - ${{ if eq(variables['Build.Reason'], 'PullRequest') }}:
      - ${{ if eq(variables['System.PullRequest.TargetBranchName'], 'main') }}:
          - group: Production-Vars
          - name: buildEnvironment
            value: 'Production'
      - ${{ if eq(variables['System.PullRequest.TargetBranchName'], 'test') }}:
          - group: Test-Vars
          - name: buildEnvironment
            value: 'Test'

stages:
- stage: Build
  displayName: Build stage
  jobs:
  - job: Build
    displayName: Build
    pool:
      vmImage: $(vmImageName)
    steps:
    - task: Docker@2
      displayName: Build and push an image to container registry
      inputs:
        command: buildAndPush
        repository: $(imageRepository)
        dockerfile: $(dockerfilePath)
        containerRegistry: $(dockerRegistryServiceConnection)
        tags: |
          $(tag)
          latest
        # 传递构建参数，变量来自变量组/Key Vault
        buildArguments: |
          --build-arg ASPNETCORE_ENVIRONMENT=$(buildEnvironment)
          --build-arg ConnectionString=$(ConnectionString)
          --build-arg ApiKey=$(ApiKey)

关键说明 #

• 配置优先级：.NET会优先读取appsettings.{Environment}.json的配置，自动覆盖appsettings.json中的默认值，符合官方配置分层策略。
• 敏感数据安全：Key Vault中的变量会被Azure DevOps自动屏蔽，不会在流水线日志中泄露。
• PR验证：针对PR场景，通过目标分支关联对应环境配置，确保PR验证使用的配置与目标分支一致。

内容的提问来源于stack exchange，提问作者Vladimir Petukhov