Azure DevOps Pipeline实现Pulumi阶段容器预拉取+审批等待

可以实现你的需求，核心思路是让两个阶段并行启动（同时拉取容器），在部署阶段添加等待逻辑，直到预览阶段的手动审批完成后再执行核心部署任务。以下是修改后的完整流水线配置：

trigger:
- master

pool:
  vmImage: 'ubuntu-latest'

stages:
- stage: Pulumi_Preview
  jobs:   
  - job: Preview
    container:
      image: REGISTRY.azurecr.io/REPOSITORY:latest
      endpoint: ServiceConnection
    steps:
    - task: Pulumi@1
      displayName: pulumi preview
      inputs:
        azureSubscription: 'Something'
        command: 'preview'
        args: '--diff --show-config --show-reads --show-replacement-steps'
        stack: $(pulumiStackShort)
        cwd: "./"
    - task: ManualValidation@0
      displayName: '等待手动审批预览结果'
      inputs:
        instructions: '请检查Pulumi Preview输出，确认无误后点击批准'
        onTimeout: 'reject'

- stage: Pulumi_Up
  displayName: "Pulumi (Up)"
  # 移除依赖，让该阶段与Preview阶段并行启动
  jobs:
  - job: Up
    container:
      image: REGISTRY.azurecr.io/REPOSITORY:latest
      endpoint: ServiceConnection
    steps:
    - task: PowerShell@2
      displayName: '等待Preview阶段审批完成'
      inputs:
        targetType: 'inline'
        script: |
          $orgUrl = "$(System.TeamFoundationCollectionUri)"
          $projectName = "$(System.TeamProject)"
          $buildId = "$(Build.BuildId)"
          $stageName = "Pulumi_Preview"
          $pat = "$(System.AccessToken)"

          $headers = @{
              Authorization = "Bearer $pat"
          }

          $stageStatus = "inProgress"
          while ($stageStatus -eq "inProgress" -or $stageStatus -eq "notStarted") {
              Write-Host "等待Preview阶段审批完成..."
              Start-Sleep -Seconds 30

              $stagesUrl = "$orgUrl/$projectName/_apis/build/builds/$buildId/stages?api-version=7.1-preview.1"
              $stages = Invoke-RestMethod -Uri $stagesUrl -Headers $headers -Method Get

              $targetStage = $stages.value | Where-Object { $_.name -eq $stageName }
              if ($targetStage) {
                  $stageStatus = $targetStage.status
                  Write-Host "当前Preview阶段状态: $stageStatus"
              }
          }

          if ($stageStatus -ne "succeeded") {
              Write-Error "Preview阶段未通过审批，终止部署"
              exit 1
          }
    - task: Pulumi@1
      inputs:
        azureSubscription: 'Something'
        command: 'up'
        args: "--yes --skip-preview"
        stack: $(pulumiStackShort)
        cwd: "./"

关键逻辑说明 #

1. 并行拉取容器：移除Pulumi_Up阶段的dependsOn配置，让两个阶段同时启动，容器镜像会被并行拉取，节省等待时间。
2. 预览阶段手动审批：在Pulumi_Preview阶段的pulumi preview任务后添加ManualValidation手动审批步骤，审批完成前该阶段会处于「进行中」状态。
3. 部署阶段等待逻辑：Pulumi_Up阶段拉取容器后，通过PowerShell脚本轮询Azure DevOps API，检测Pulumi_Preview阶段的状态，直到其变为「成功」（即审批通过）才执行后续的pulumi up任务；如果预览阶段被拒绝或失败，部署阶段会直接终止。

内容的提问来源于stack exchange，提问作者Tensing2009