Azure DevOps：如何确保流水线所有阶段使用同一工作目录

核心优化思路 #

• 单独搞一个代码检出阶段，一次性拉取两个仓库的代码，然后把整个工作目录打包成流水线工件发布。
• 后续所有需要用代码的阶段，直接下载这个工件恢复工作目录，不用重复检出代码。
• 针对Terraform Plan生成的outfile这类跨阶段依赖的成果，单独发布为工件，供Apply阶段调用。
• 人工审核阶段不用处理文件，保持原逻辑即可。

修改后的完整流水线YAML #

resources:
  repositories:
    - repository: AzureRepoDatagovernance
      type: git
      name: DIF_data_governance
      ref: develop

trigger:
  branches:
    include:
      - main
  paths:
    include:
      - terraform/DIF

variables:
  - group: PRD_new_resources
  - name: initial_deployment
    value: false
  - name: artifactName.SourceCode
    value: "SourceCode"
  - name: artifactName.TerraformPlan
    value: "TerraformPlan"

pool: $(agent_pool_name)

stages:
  # 阶段1：一次性完成代码检出并发布为工件
  - stage: CheckoutCode
    jobs:
      - job: CheckoutAndPublish
        steps:
          - checkout: self
            displayName: "检出主仓库代码"
          - checkout: AzureRepoDatagovernance
            displayName: "检出AzureRepoDatagovernance仓库代码"
          # 发布整个工作目录为工件，供后续阶段使用
          - task: PublishPipelineArtifact@1
            inputs:
              targetPath: $(System.DefaultWorkingDirectory)
              artifact: $(artifactName.SourceCode)
              publishLocation: "Container"
            displayName: "发布源代码工件"

  # 阶段2：变量检查与调整
  - stage: VariableCheck
    dependsOn: CheckoutCode
    jobs:
      - job: VariableMerge
        steps:
          # 下载之前发布的源代码工件到当前工作目录
          - task: DownloadPipelineArtifact@2
            inputs:
              artifact: $(artifactName.SourceCode)
              path: $(System.DefaultWorkingDirectory)
            displayName: "下载源代码工件"
          - ${{ if eq(variables.initial_deployment, 'false') }}:
              - task: PythonScript@0
                inputs:
                  scriptSource: filePath
                  scriptPath: DIF-devops/config/dynamic_containers.py
                  pythonInterpreter: /usr/bin/python3
                  arguments: --automount-path $(System.DefaultWorkingDirectory)/DIF_data_governance/data_ingestion_framework/$(env)/AutoMount_Config.json --variables-path $(System.DefaultWorkingDirectory)/DIF-devops/terraform/DIF/DIF.tfvars.json
                displayName: "调整variables.tf.json中的容器名称"
          # 发布修改后的工作目录，确保后续阶段拿到最新文件
          - task: PublishPipelineArtifact@1
            inputs:
              targetPath: $(System.DefaultWorkingDirectory)
              artifact: $(artifactName.SourceCode)
              publishLocation: "Container"
            displayName: "发布更新后的源代码工件"

  # 阶段3：Terraform Plan
  - stage: Plan
    dependsOn: VariableCheck
    jobs:
      - job: Plan
        steps:
          - task: DownloadPipelineArtifact@2
            inputs:
              artifact: $(artifactName.SourceCode)
              path: $(System.DefaultWorkingDirectory)
            displayName: "下载源代码工件"
          - script: |
              cd $(System.DefaultWorkingDirectory)/$(terraform_folder_name) && ls -lah
              terraform init
              terraform plan -out=outfile -var-file=DIF.tfvars.json
            displayName: "生成$(terraform_folder_name)环境的基础设施变更计划"
          # 单独发布Terraform Plan文件
          - task: PublishPipelineArtifact@1
            inputs:
              targetPath: $(System.DefaultWorkingDirectory)/$(terraform_folder_name)/outfile
              artifact: $(artifactName.TerraformPlan)
              publishLocation: "Container"
            displayName: "发布Terraform Plan工件"

  # 阶段4：人工审核
  - stage: ManualCheck
    dependsOn: Plan
    jobs:
      - job: ManualCheck
        pool: server
        steps:
          - task: ManualValidation@0
            timeoutInMinutes: 5
            displayName: "验证配置变更"

  # 阶段5：Terraform Apply
  - stage: Apply
    dependsOn: ManualCheck
    jobs:
      - job: Apply
        steps:
          - task: DownloadPipelineArtifact@2
            inputs:
              artifact: $(artifactName.SourceCode)
              path: $(System.DefaultWorkingDirectory)
            displayName: "下载源代码工件"
          - task: DownloadPipelineArtifact@2
            inputs:
              artifact: $(artifactName.TerraformPlan)
              path: $(System.DefaultWorkingDirectory)/$(terraform_folder_name)
            displayName: "下载Terraform Plan工件"
          - script: |
              cd $(System.DefaultWorkingDirectory)/$(terraform_folder_name) && ls -lah
              terraform apply -auto-approve "outfile"
            displayName: "应用$(terraform_folder_name)环境的基础设施变更"

关键优化点说明 #

1. 单次代码检出：
   新增CheckoutCode阶段一次性拉取两个仓库的代码，发布为SourceCode工件。后续阶段通过DownloadPipelineArtifact直接恢复工作目录，避免重复拉取代码浪费资源。

2. 共享修改后的文件：
   VariableCheck阶段完成脚本修改后，重新发布SourceCode工件，确保后续Plan阶段能拿到最新的DIF.tfvars.json文件。

3. 传递Terraform Plan文件：
   Plan阶段生成outfile后单独发布为TerraformPlan工件，Apply阶段下载到对应目录，保证能正确引用之前生成的计划文件。

4. 明确阶段依赖：
   通过dependsOn指定阶段执行顺序，确保流水线按「检出代码→变量调整→生成计划→人工审核→应用变更」的逻辑运行。

内容的提问来源于stack exchange，提问作者Niviral