Remove tag from run in Azure Pipelines

Question

I am using build pipelines and release pipelines to manage AWS infrastructure.

The build pipeline runs tests on the code to ensure the code meets certain standards.

The release pipeline spins up a temporary environment and runs integration tests.

I want to configure the release pipeline so that if the integration tests fail, it marks the particular build it used as failed. So that if someone were to trigger the release pipeline again, it would use the most recent successful build, not the one it just used.

I've tried to achieve this by adding a tag to the build run at the build run state, either of "succeeded" if the build pipeline tests or "failed" if the build pipeline fails.

Then the release pipeline is configured to use the artifact from the latest build which is marked as "succeeded".

The intention was that if the integration tests in the release pipeline fail, there is a step which removes the "succeeded" tag from the that build run and replaces it with "failed".

However, I can't find a way of automatically changing those tags as part of the release pipeline. Is there a way? Am I approaching this from the wrong angle?

I have a build pipeline that tags the run as "succeeded" if tests are passed, and "failed" if tests do not pass.

If the build is successful, the release pipeline spins up some infrastructure, deploys the build, and then runs integration tests.

If those tests fail, I'd like the pipeline to remove the "succeeded" tag from the run that it took the artifact from, and to add a "failed" tag.

The only documentation I've found is here, but this looks like it's referring to a different type of tag.

Is there a way of doing it from the release pipeline?

Just to clarify, are you wanting to tag a build or update the tags of a build from a release? If so, you should be able to pass in the "Allow scripts to access OAuth token" from the agent job of the release and call the build API. Or are you wanting to update a release? — m00nbeam360.0
Thanks for your comments. I've rephrased the question to make my intentions clearer. The "Allow scripts to access OAuth token" is interesting and could prove to be very useful. — Dicky Moore

m00nbeam360.0 m00nbeam360.0 · Accepted Answer · 2019-09-04T19:06:24

You're close. If you want to update a build tag (or call the REST API in general) from a release pipeline, you will want to enable the "Allow scripts to access OAuth token" checkbox in the agent job. (https://docs.microsoft.com/en-us/azure/devops/pipelines/build/variables?view=azure-devops&tabs=classic) This will pass in a security token that you can reference using $System.AccessToken.

Then, you'll want to delete the succeeded tag, and then add the failed tag using the REST API. Haven't tested this with build tags but since it's documented then it should work. You can also test this manually by using something like Postman and using a PAT.

Potentially something like (in PowerShell):

$accessToken = $env:SYSTEM_ACCESSTOKEN

# Get the build ID for the artifact, note that you need the alias already

$buildId = $env:RELEASE_ARTIFACTS_{alias}_BUILDID

$deleteSucceededTagUri = "https://dev.azure.com/{organization}/{project}/_apis/build/builds/$($buildId)/tags/succeeded?api-version=5.1"

# Delete the succeeded tag
$response = Invoke-RestMethod -Method DELETE -Uri $deleteSucceededTagUri -Headers @{ Authorization = "Bearer $($accessToken)" }

$addFailedTagUri = "https://dev.azure.com/{organization}/{project}/_apis/build/builds/$($buildId)/tags/failed?api-version=5.1"

# Add the failed tag
$response = Invoke-RestMethod -Method PUT -Uri $addFailedTagUri -Headers @{ Authorization = "Bearer $($accessToken)" }

You can also write this in a different language but the theory should be the same.

Also link for release variables: https://docs.microsoft.com/en-us/azure/devops/pipelines/release/variables?view=azure-devops&tabs=batch

Remove tag from run in Azure Pipelines

2 Answers