azure-devops

Azure DevOps Pipelines

使用 Azure Pipelines，通过 YAML 或经典编辑器构建、测试和部署应用程序。

何时使用此技能

在以下情况下使用此技能：

• 在 Azure DevOps 中创建 CI/CD 管道
• 配置构建和发布阶段
• 管理 Azure DevOps 服务连接
• 部署到 Azure 或其他云平台
• 设置多阶段 YAML 管道

前提条件

• Azure DevOps 组织和项目
• 目标环境的服务连接
• YAML 基础知识
• Azure 订阅（用于 Azure 部署）

YAML 管道结构

在存储库根目录中创建 azure-pipelines.yml：

trigger:
  branches:
    include:
      - main
      - develop
  paths:
    include:
      - src/*

pool:
  vmImage: 'ubuntu-latest'

variables:
  buildConfiguration: 'Release'
  nodeVersion: '20.x'

stages:
  - stage: Build
    jobs:
      - job: BuildJob
        steps:
          - task: NodeTool@0
            inputs:
              versionSpec: $(nodeVersion)
          - script: |
              npm ci
              npm run build
            displayName: 'Build application'
          - publish: $(Build.ArtifactStagingDirectory)
            artifact: drop

  - stage: Deploy
    dependsOn: Build
    condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
    jobs:
      - deployment: DeployWeb
        environment: 'production'
        strategy:
          runOnce:
            deploy:
              steps:
                - script: echo Deploying to production

触发器

分支触发器

trigger:
  branches:
    include:
      - main
      - release/*
    exclude:
      - feature/*
  tags:
    include:
      - v*

拉取请求触发器

pr:
  branches:
    include:
      - main
  paths:
    include:
      - src/*
    exclude:
      - docs/*

定时触发器

schedules:
  - cron: '0 2 * * *'
    displayName: 'Nightly build'
    branches:
      include:
        - main
    always: true

作业和阶段

并行作业

stages:
  - stage: Test
    jobs:
      - job: UnitTests
        pool:
          vmImage: 'ubuntu-latest'
        steps:
          - script: npm run test:unit
      
      - job: IntegrationTests
        pool:
          vmImage: 'ubuntu-latest'
        steps:
          - script: npm run test:integration

矩阵策略

jobs:
  - job: Build
    strategy:
      matrix:
        linux:
          vmImage: 'ubuntu-latest'
        windows:
          vmImage: 'windows-latest'
        mac:
          vmImage: 'macos-latest'
    pool:
      vmImage: $(vmImage)
    steps:
      - script: npm test

作业依赖项

stages:
  - stage: Build
    jobs:
      - job: A
        steps:
          - script: echo Job A
      - job: B
        dependsOn: A
        steps:
          - script: echo Job B

变量和参数

变量组

variables:
  - group: 'production-secrets'
  - name: buildConfiguration
    value: 'Release'

运行时参数

parameters:
  - name: environment
    displayName: 'Environment'
    type: string
    default: 'dev'
    values:
      - dev
      - staging
      - prod

stages:
  - stage: Deploy
    variables:
      env: ${{ parameters.environment }}
    jobs:
      - job: Deploy
        steps:
          - script: echo "Deploying to $(env)"

密钥变量

variables:
  - name: mySecret
    value: $(SECRET_FROM_PIPELINE)  # Set in pipeline settings

steps:
  - script: |
      echo "Using secret"
      ./deploy.sh
    env:
      API_KEY: $(mySecret)

模板

作业模板

# templates/build-job.yml
parameters:
  - name: nodeVersion
    default: '20'

jobs:
  - job: Build
    steps:
      - task: NodeTool@0
        inputs:
          versionSpec: ${{ parameters.nodeVersion }}
      - script: npm ci && npm run build

使用模板

# azure-pipelines.yml
stages:
  - stage: Build
    jobs:
      - template: templates/build-job.yml
        parameters:
          nodeVersion: '20'

阶段模板

# templates/deploy-stage.yml
parameters:
  - name: environment
    type: string
  - name: serviceConnection
    type: string

stages:
  - stage: Deploy_${{ parameters.environment }}
    jobs:
      - deployment: Deploy
        environment: ${{ parameters.environment }}
        strategy:
          runOnce:
            deploy:
              steps:
                - task: AzureWebApp@1
                  inputs:
                    azureSubscription: ${{ parameters.serviceConnection }}
                    appName: 'myapp-${{ parameters.environment }}'

部署

环境部署

stages:
  - stage: DeployStaging
    jobs:
      - deployment: DeployWeb
        environment: 'staging'
        strategy:
          runOnce:
            deploy:
              steps:
                - download: current
                  artifact: drop
                - script: ./deploy.sh staging

审批关卡

在 Azure DevOps UI 中配置：

1. 转到 Environments
2. 选择环境
3. 添加审批检查
4. 配置审批者

滚动部署

jobs:
  - deployment: Deploy
    environment: 'production'
    strategy:
      rolling:
        maxParallel: 2
        deploy:
          steps:
            - script: ./deploy.sh

Azure 服务任务

Azure Web App 部署

- task: AzureWebApp@1
  inputs:
    azureSubscription: 'my-azure-connection'
    appType: 'webAppLinux'
    appName: 'my-web-app'
    package: '$(Pipeline.Workspace)/drop/*.zip'

Azure Container Apps

- task: AzureContainerApps@1
  inputs:
    azureSubscription: 'my-azure-connection'
    containerAppName: 'my-container-app'
    resourceGroup: 'my-rg'
    imageToDeploy: 'myregistry.azurecr.io/myapp:$(Build.BuildId)'

Azure Kubernetes Service

- task: KubernetesManifest@0
  inputs:
    action: 'deploy'
    kubernetesServiceConnection: 'my-aks-connection'
    namespace: 'default'
    manifests: |
      $(Pipeline.Workspace)/manifests/deployment.yml
      $(Pipeline.Workspace)/manifests/service.yml
    containers: |
      myregistry.azurecr.io/myapp:$(Build.BuildId)

Docker 构建

- task: Docker@2
  inputs:
    containerRegistry: 'my-acr-connection'
    repository: 'myapp'
    command: 'buildAndPush'
    Dockerfile: '**/Dockerfile'
    tags: |
      $(Build.BuildId)
      latest

自托管 Agent

安装 Agent

# Download agent
mkdir myagent && cd myagent
curl -o vsts-agent.tar.gz https://vstsagentpackage.azureedge.net/agent/3.227.2/vsts-agent-linux-x64-3.227.2.tar.gz
tar zxvf vsts-agent.tar.gz

# Configure
./config.sh --url https://dev.azure.com/myorg --auth pat --token PAT_TOKEN --pool default

# Run as service
sudo ./svc.sh install
sudo ./svc.sh start

使用自托管池

pool:
  name: 'my-self-hosted-pool'
  demands:
    - docker
    - Agent.OS -equals Linux

常见问题

问题：服务连接失败

问题：无法向 Azure 进行身份验证 解决方案：验证服务主体权限，并在项目设置中检查连接

问题：找不到构件

问题：下载构件失败 解决方案：确保发布任务已成功运行，并检查构件名称是否匹配

问题：找不到环境

问题：部署到环境失败 解决方案：先在 Pipelines > Environments 中创建环境

最佳实践

• 优先使用 YAML 管道，而非经典编辑器
• 使用模板实现组件复用
• 使用变量组共享配置
• 为生产环境配置审批
• 使用权限最小化的服务连接
• 实施构件版本控制
• 缓存依赖项以加快构建

相关技能

• github-actions - GitHub CI/CD 替代方案
• terraform-azure - Azure IaC
• azure-aks - AKS 部署