How to use my token to az pipelines run command? - azure-devops

Question

I have created a new pipeline to run another pipeline with pwsh as below,
steps:
- pwsh: |
az pipelines run --branch "$(Build.SourceBranch)" `
--name "another-pipeline" `
--organization "$(System.CollectionUri)" `
--project "$(System.TeamProject)"
displayName: 'Enqueue another pipeline'
env:
AZURE_DEVOPS_EXT_PAT: $(System.AccessToken)
After ran this step, it will start another-pipeline but it is not me who starts the pipeline because it is using $(System.AccessToken).
Let's say anyone in my team can run the new pipeline.
How to get their access token and use it or any others solution?

Answer 1

The variable: $(System.AccessToken) is a predefined variable. It represents the role of the build service account.
So when you run the Az Pipelines run command with this PAT, it will show that the pipeline is running by build service account.
How to get my access token and use it?
You need to manually create Personal Access Token. Refer to this doc: Create PAT
Then you can add an variable in Pipeline and set it as secret.
For example:
You can use the secret variable in the pipeline.
steps:
- pwsh: |
az pipelines run --branch "$(Build.SourceBranch)" `
--name "another-pipeline" `
--organization "$(System.CollectionUri)" `
--project "$(System.TeamProject)"
displayName: 'Enqueue another pipeline'
env:
AZURE_DEVOPS_EXT_PAT: $(PAT)
Then the pipeline will running by your account.
Update:
When you use the Az Pipeline run to run the pipeline, it will run the pipeline with the user represented by PAT. It has no option to set the request user in the Azure CLI so you need to create PAT for all users.
Based on your requirement, you can change to use the Rest API to run the pipeline: Builds - Queue
When you use Rest API, you can set the requestedBy field in the body to set the user alias to run the pipeline.
For example:
$body = '
{
"definition": {
"id": number
} ,
"requestedFor": {
"id": "userid"
}
}
'
$bodyJson=$body | ConvertFrom-Json
Write-Output $bodyJson
$bodyString=$bodyJson | ConvertTo-Json -Depth 100
Write-Output $bodyString
$user="name"
$token="PAT"
$base64AuthInfo = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(("{0}:{1}" -f $user,$token)))
$Uri = "https://account.visualstudio.com/project/_apis/build/builds?api-version=4.1"
$buildresponse = Invoke-RestMethod -Method Post -UseDefaultCredentials -ContentType application/json -Uri $Uri -Body $bodyString -Headers #{Authorization=("Basic {0}" -f $base64AuthInfo)}
write-host $buildresponse
Or you can use the Trigger Build task: Queue build in extension: Trigger Build Task
For example:
- task: TriggerBuild#4
displayName: 'Trigger a new build of 797'
inputs:
buildDefinition: name or id
queueBuildForUserThatTriggeredBuild: true
password: PAT
You can set the queueBuildForUserThatTriggeredBuild to true. Then the triggered pipeline will run by the same user as current pipeline run