Azure DevOps：使用作业矩阵变量填充安全文件引用

Question

就上下文而言，我正在尝试使用 Azure 构建管道来构建多种风格的 Android 应用程序。每种风格都有自己独立的签名密钥库，所有这些密钥库都存储在库中我的“安全文件”中。

但是，当我尝试在“android 签名”任务期间取消引用 $(Keystore) 变量时，它似乎没有识别出这是一个存在的变量，而是尝试找到一个名为“$(密钥库）'

我在这里做错了吗？这似乎应该可以工作。

经过净化的示例如下所示：

# Android
# Build your Android project with Gradle.
# Add steps that test, sign, and distribute the APK, save build artifacts, and more:
# https://docs.microsoft.com/azure/devops/pipelines/languages/android

trigger:
- feat/ci-setup

pool:
  vmImage: 'macos-latest'

variables:
  ${{ if startsWith(variables['build.sourceBranch'], 'refs/heads/feat/') }}: 
    Branch_Type: 'feature'
  ${{ if startsWith(variables['build.sourceBranch'], 'refs/heads/hotfix/') }}: 
    Branch_Type: 'hotfix'
  ${{ if startsWith(variables['build.sourceBranch'], 'refs/heads/release/') }}: 
    Branch_Type: 'release'
  ${{ if eq(variables['Branch_Type'], 'release') }}: 
    Configuration: 'release'
    ConfigurationCC: 'Release'
  ${{ if ne(variables['Branch_Type'], 'release') }}: 
    Configuration: 'debug'
    ConfigurationCC: 'Debug'

jobs:
- job: Build
  variables:
  - group: android_keystores
  strategy:
    maxParallel: 2
    matrix:
      Flavor_1:
        AppFlavor: '1'
        AppFlavorCC: '1'
        Keystore: 'flavor1.keystore'
        KeyAlias: 'flavor1'
        KeystorePass: '$(flavor1_storepass)'
        KeyPass: '$(flavor1_keypass)'
      Flavor_2:
        AppFlavor: '2'
        AppFlavorCC: '2'
        Keystore: 'flavor2.keystore'
        KeyAlias: 'flavor2'
        KeystorePass: '$(flavor2_storepass)'
        KeyPass: '$(flavor2_keypass)'

  steps:
  - task: Gradle@2
    inputs:
      workingDirectory: ''
      gradleWrapperFile: 'gradlew'
      gradleOptions: '-Xmx3072m'
      publishJUnitResults: false
      tasks: 'assemble$(AppFlavorCC)$(ConfigurationCC)'

  - task: AndroidSigning@3
    displayName: Signing .apk
    inputs:
      apkFiles: 'app/build/outputs/apk/$(AppFlavor)/$(Configuration)/*.apk'
      apksign: true
      apksignerKeystoreFile: '$(Keystore)'
      apksignerKeystorePassword: '$(KeystorePass)'
      apksignerKeystoreAlias: '$(KeyAlias)'
      apksignerKeyPassword: '$(KeyPass)'
      zipalign: true

  - task: Bash@3
    displayName: Move APK to Artifact Folder
    continueOnError: true
    inputs:
      targetType: 'inline'
      script: |
        mv \
        app/build/outputs/apk/$(AppFlavor)/$(Configuration)/*.apk \
        $(Build.ArtifactStagingDirectory)/$(ArtifactName)/

  - task: PublishBuildArtifacts@1
    displayName: Publish Build Artifacts
    inputs:
      PathtoPublish: '$(Build.ArtifactStagingDirectory)'
      ArtifactName: 'Blueprint-Build'
      publishLocation: 'Container'

但是当管道运行时，我被告知：

There was a resource authorization issue: "The pipeline is not valid. Job Build: Step AndroidSigning input keystoreFile references secure file $(Keystore) which could not be found. The secure file does not exist or has not been authorized for use. For authorization details, refer to https://aka.ms/yamlauthz."

Answer 1

Azure DevOps：使用作业矩阵变量填充安全文件引用

这是任务本身的限制。

我们在Classic模式下测试时发现，Keystore file选项的值无法手动输入，只能通过下拉菜单选择某个文件：

这就是为什么它似乎没有认识到这是一个存在的变量，而是试图找到一个名为“$(Keystore)”的文件。

要解决此问题，您可以将任务版本从3 更改为支持手动输入的1：

作为另一种解决方案，您还可以使用命令行对 *.apk 进行签名：

Android apk signing: sign an unsigned apk using command line

Answer 2

您缺少下载安全文件的步骤。与变量组不同，您需要显式下载它们才能通过安全文件名进行访问。

您需要在提取安全文件的步骤中添加类似于以下示例任务的内容。然后，您将通过 NAME_PARAMETER.secureFilePath 访问您的安全文件：

          - task: DownloadSecureFile@1
            displayName: "Download Keyfile 1"
            name: "YOUR_SECUREFILE_NAME"
            inputs:
                secureFile: keyfile1
          - task: AndroidSigning@3
            displayName: Signing .apk
            inputs:
                apkFiles: 'app/build/outputs/apk/$(AppFlavor)/$(Configuration)/*.apk'
                apksign: true
                apksignerKeystoreFile: '$(YOUR_SECUREFILE_NAME.secureFilePath)'
                apksignerKeystorePassword: '$(KeystorePass)'
                apksignerKeystoreAlias: '$(KeyAlias)'
                apksignerKeyPassword: '$(KeyPass)'
                zipalign: true