Azure DevOps：使用作业矩阵变量填充安全文件引用

Question

对于上下文，我正在尝试使用 Azure 构建管道来构建 Android 应用程序的多种风格。每种风格都有自己独立的签名密钥库，所有这些密钥库都存储在我的 'secure files' 库中。

但是，当我在 'android signing' 任务期间尝试取消引用 $(Keystore) 变量时，它似乎没有意识到这是一个存在的变量，而是试图找到一个名为'$(密钥库)'

我是不是做错了什么？这似乎应该有效。

经过清理的示例如下所示：

# Android
# Build your Android project with Gradle.
# Add steps that test, sign, and distribute the APK, save build artifacts, and more:
# https://docs.microsoft.com/azure/devops/pipelines/languages/android

trigger:
- feat/ci-setup

pool:
  vmImage: 'macos-latest'

variables:
  ${{ if startsWith(variables['build.sourceBranch'], 'refs/heads/feat/') }}: 
    Branch_Type: 'feature'
  ${{ if startsWith(variables['build.sourceBranch'], 'refs/heads/hotfix/') }}: 
    Branch_Type: 'hotfix'
  ${{ if startsWith(variables['build.sourceBranch'], 'refs/heads/release/') }}: 
    Branch_Type: 'release'
  ${{ if eq(variables['Branch_Type'], 'release') }}: 
    Configuration: 'release'
    ConfigurationCC: 'Release'
  ${{ if ne(variables['Branch_Type'], 'release') }}: 
    Configuration: 'debug'
    ConfigurationCC: 'Debug'

jobs:
- job: Build
  variables:
  - group: android_keystores
  strategy:
    maxParallel: 2
    matrix:
      Flavor_1:
        AppFlavor: '1'
        AppFlavorCC: '1'
        Keystore: 'flavor1.keystore'
        KeyAlias: 'flavor1'
        KeystorePass: '$(flavor1_storepass)'
        KeyPass: '$(flavor1_keypass)'
      Flavor_2:
        AppFlavor: '2'
        AppFlavorCC: '2'
        Keystore: 'flavor2.keystore'
        KeyAlias: 'flavor2'
        KeystorePass: '$(flavor2_storepass)'
        KeyPass: '$(flavor2_keypass)'

  steps:
  - task: Gradle@2
    inputs:
      workingDirectory: ''
      gradleWrapperFile: 'gradlew'
      gradleOptions: '-Xmx3072m'
      publishJUnitResults: false
      tasks: 'assemble$(AppFlavorCC)$(ConfigurationCC)'

  - task: AndroidSigning@3
    displayName: Signing .apk
    inputs:
      apkFiles: 'app/build/outputs/apk/$(AppFlavor)/$(Configuration)/*.apk'
      apksign: true
      apksignerKeystoreFile: '$(Keystore)'
      apksignerKeystorePassword: '$(KeystorePass)'
      apksignerKeystoreAlias: '$(KeyAlias)'
      apksignerKeyPassword: '$(KeyPass)'
      zipalign: true

  - task: Bash@3
    displayName: Move APK to Artifact Folder
    continueOnError: true
    inputs:
      targetType: 'inline'
      script: |
        mv \
        app/build/outputs/apk/$(AppFlavor)/$(Configuration)/*.apk \
        $(Build.ArtifactStagingDirectory)/$(ArtifactName)/

  - task: PublishBuildArtifacts@1
    displayName: Publish Build Artifacts
    inputs:
      PathtoPublish: '$(Build.ArtifactStagingDirectory)'
      ArtifactName: 'Blueprint-Build'
      publishLocation: 'Container'

但是当管道运行时我被告知：

There was a resource authorization issue: "The pipeline is not valid. Job Build: Step AndroidSigning input keystoreFile references secure file $(Keystore) which could not be found. The secure file does not exist or has not been authorized for use. For authorization details, refer to https://aka.ms/yamlauthz."

Answer 1

您缺少下载安全文件的步骤。与变量组不同，您需要明确下载它们才能通过安全文件名进行访问。

您需要在提取安全文件的步骤中添加类似于以下示例任务的内容。然后，您将通过 NAME_PARAMETER.secureFilePath:

访问您的安全文件

          - task: DownloadSecureFile@1
            displayName: "Download Keyfile 1"
            name: "YOUR_SECUREFILE_NAME"
            inputs:
                secureFile: keyfile1
          - task: AndroidSigning@3
            displayName: Signing .apk
            inputs:
                apkFiles: 'app/build/outputs/apk/$(AppFlavor)/$(Configuration)/*.apk'
                apksign: true
                apksignerKeystoreFile: '$(YOUR_SECUREFILE_NAME.secureFilePath)'
                apksignerKeystorePassword: '$(KeystorePass)'
                apksignerKeystoreAlias: '$(KeyAlias)'
                apksignerKeyPassword: '$(KeyPass)'
                zipalign: true

Answer 2

Azure DevOps: Populating secure file references with job matrix variables

这是任务本身的限制。

当我们用Classic模式测试时，发现Keystore file选项的值无法手动输入，只能select一个通过下拉菜单选择某个文件：

这就是为什么它似乎没有认识到这是一个存在的变量，而是试图找到一个名为“$(Keystore)”的文件的原因。

要解决此问题，您可以将任务版本从3更改为1，支持手动输入：

作为另一种解决方案，您还可以使用命令行对 *.apk 进行签名：

Android apk signing: sign an unsigned apk using command line

Azure DevOps：使用作业矩阵变量填充安全文件引用

Azure DevOps: Populating secure file references with job matrix variables

continuous-integration

devops

azure-devops