Azure Pipelines：IaC作业被跳过后后续部署作业误跳过的问题

问题场景 #

我的Pipeline流程为：Build -> Detect IaC changes -> IaC -> Deploy Dev/Test。其中IaC用于部署Azure DevOps资源，仅希望在存在实际变更时才执行IaC部署（避免不必要的耗时）。当前已实现变更检测逻辑，但遇到问题：当Detect IaC changes判定无变更导致IaC作业被跳过，后续的Deploy Dev/Test作业也被意外跳过，这不符合预期。

当前配置 #

主Pipeline配置 #

jobs:
  - template: '../../../infra/devops/deploy-azure-resources.yml'
    parameters:
      ...
      forceIaC: ${{ parameters.forceIaC }}
  - template: '../../../infra/devops/deploy-app-service.yml'
    parameters:
      dependsOn: ['iac']
      ...
      appName: ${{variables.appName}}
      useDeploymentSlots: true

deploy-azure-resources.yml 配置 #

jobs:
  - job: detect_iac_changes
    displayName: 'Detect IaC changes'
    steps:
      - checkout: self
        fetchDepth: 2

      - task: PowerShell@2
        name: detection
        displayName: 'Detect bicep file changes'
        inputs:
          targetType: 'inline'
          script: |
            if ('${{ parameters.forceIaC }}' -eq 'true') {
              Write-Host "ForceIaC is enabled. Skipping detection."
              Write-Host "##vso[task.setvariable variable=shouldDeployIaC;isOutput=true]true"
              return
            }

            $bicepChanges = git diff --name-only HEAD~1 HEAD | Where-Object { $_ -eq '${{ parameters.bicepFile }}' }

            if ($bicepChanges) {
              Write-Host "Bicep file '${{ parameters.bicepFile }}' has changed."
              Write-Host "##vso[task.setvariable variable=shouldDeployIaC;isOutput=true]true"
            } else {
              Write-Host "No changes detected in '${{ parameters.bicepFile }}'. Skipping deployment."
              Write-Host "##vso[task.setvariable variable=shouldDeployIaC;isOutput=true]false"
            }

  - job: iac
    displayName: 'Deploy IaC'
    dependsOn: detect_iac_changes
    condition: eq(dependencies.detect_iac_changes.outputs['detection.shouldDeployIaC'], 'true')
    steps:
      - checkout: self

      - task: AzureResourceManagerTemplateDeployment@3
        displayName: 'Run bicep file'
        inputs:
          deploymentScope: 'Subscription'
          connectedServiceName: '${{ parameters.serviceConnection }}'
          location: 'westeurope'
          csmFile: '${{ parameters.bicepFile }}'
          overrideParameters: '-environmentCode ${{ parameters.environmentCode }}'

      - task: PowerShell@2
        displayName: 'Purge Cache'
        inputs:
          targetType: 'inline'
          script: |
            az cache purge

deploy-app-service.yml 配置 #

parameters:
  - name: dependsOn
    type: object
    default: []
  - name: environmentName
    displayName: 'Environment name'
    default: ''
  - name: jobName
    displayName: 'Name of the deployment job'
    default: 'deploy'

jobs:
  - deployment: ${{ parameters.jobName }}
    environment: ${{ parameters.environmentName }}
    dependsOn: ${{ parameters.dependsOn }}
    strategy:
      runOnce:
...

解决方案 #

问题根源：Deploy作业依赖iac作业，Azure DevOps默认会在依赖作业被跳过（skipped）时，也跳过后续作业。需要通过调整Deploy作业的条件，让它在两种场景下都能运行：IaC作业成功执行，或者IaC作业因无变更被跳过。

具体修改步骤 #

1. 更新主Pipeline的dependsOn配置：让Deploy作业同时依赖detect_iac_changes和iac，这样可以获取到变更检测阶段的输出变量：

- template: '../../../infra/devops/deploy-app-service.yml'
  parameters:
    dependsOn: ['detect_iac_changes', 'iac']
    ...
    appName: ${{variables.appName}}
    useDeploymentSlots: true

2. 在deploy-app-service.yml中添加condition：修改deployment作业的条件，允许在IaC成功或无需部署时运行：

jobs:
  - deployment: ${{ parameters.jobName }}
    environment: ${{ parameters.environmentName }}
    dependsOn: ${{ parameters.dependsOn }}
    # 条件：要么IaC作业成功，要么无需部署IaC
    condition: or(succeeded('iac'), eq(dependencies.detect_iac_changes.outputs['detection.shouldDeployIaC'], 'false'))
    strategy:
      runOnce:
...

逻辑说明 #

• succeeded('iac')：当IaC作业实际执行并成功完成时，Deploy作业运行。
• eq(dependencies.detect_iac_changes.outputs['detection.shouldDeployIaC'], 'false')：当变更检测判定无需部署IaC时，直接运行Deploy作业。

这种方式相比直接判断iac作业是否被跳过更可靠，因为它直接基于变更检测的结果变量，避免因其他原因导致IaC被跳过的误判。

内容的提问来源于stack exchange，提问作者Nermin