如何为Azure DevOps中触发/计划的每个部署设置审批？

Hey there! Let me walk you through exactly how to set up approval mechanisms for every triggered or scheduled deployment in Azure DevOps—whether you're using classic release pipelines or YAML pipelines, I've got you covered.

If you're working with classic release pipelines, here's how to lock down deployments with approvals:

• Head to your Azure DevOps project, go to Pipelines > Releases, and open your existing release pipeline or create a new one.
• Switch to the Environments tab, then locate the environment you want to add approvals to (like Production or Staging).
• Click the ⋯ icon in the top-right corner of the environment, then select Approvals and checks.
• In the panel that pops up, click Add and choose Approvals from the list of check types.
• Configure your approval rules:
  • Pick specific users, security groups, or teams who need to sign off on deployments.
  • Set options like whether all approvers need to agree, or just one. I recommend leaving the "Allow approvers to approve their own deployments" option disabled for better governance.
  • Set a timeout period (e.g., 48 hours) so unapproved deployments don't hang indefinitely.
• Once saved, every deployment to this environment—whether triggered manually, by a CI build, or via a schedule—will require approval before proceeding.

For YAML pipelines (the modern, code-first approach), you'll tie approvals to environments, then reference those environments in your pipeline stages:

Step 1: Define your pipeline with environments #

First, structure your YAML to include deployment stages linked to specific environments:

stages:
- stage: Build
  jobs:
  - job: BuildApplication
    steps:
    - script: echo "Building application artifacts..."

- stage: DeployToStaging
  displayName: Deploy to Staging
  jobs:
  - deployment: DeployStaging
    environment: Staging
    strategy:
      runOnce:
        deploy:
          steps:
          - script: echo "Deploying to Staging environment..."

- stage: DeployToProduction
  displayName: Deploy to Production
  jobs:
  - deployment: DeployProduction
    environment: Production
    strategy:
      runOnce:
        deploy:
          steps:
          - script: echo "Deploying to Production environment..."

Step 2: Add approvals to your environments #

• Go to Pipelines > Environments in your Azure DevOps project.
• Select the environment you want to secure (e.g., Production), then click Approvals and checks.
• Add an Approvals check just like you did for classic pipelines, configuring the required approvers and rules.
• Any deployment to this stage—whether triggered by a commit, manual run, or scheduled trigger—will now pause for approval.

Step 3: Set up scheduled deployments (if needed) #

If you want scheduled deployments to also follow the approval flow, add a schedules block to your YAML:

schedules:
- cron: "0 0 * * *" # Runs daily at midnight UTC
  displayName: Daily Production Deployment
  branches:
    include:
    - main
  always: true # Runs even if there are no new commits

Since the production stage is linked to an environment with approvals, this scheduled run will automatically trigger the approval workflow before deploying.

• Combine approvals with other checks: Beyond manual approvals, add checks like Azure Resource Group Validation or Invoke REST API to ensure pre-deployment conditions are met (e.g., no active incidents in your monitoring tool).
• Customize notifications: Configure approval alerts via email or Microsoft Teams so approvers get notified immediately when a deployment is waiting for their sign-off.
• Environment-specific rules: Tailor approvals per environment—you might require two approvers for production, but only one for staging.

Hope these steps help you set up solid approval gates for all your deployments. Let me know if you hit any snags!

内容的提问来源于stack exchange，提问作者Amruta