We are using an ansible setup with roles, templates, central repos, etc for our deployments.
And are working on creating a new deployment pipeline where the source branch of 1 of the involved repos needs to be fixed per environment.
i.e. master_D for DEV, master_T for TST env, etc.

The user selects an Environment when triggering the deployment pipeline via the UI.

Environment gets translated to a branch name:

variables:
- name: Branch
  ${{ if eq(parameters['Environment'], 'DEV') }}:
    value: master_D

Branch name is used in the repo definition:

resources:
  repositories:
    - repository: SourceCode
      type: git
      name: Repos/SourceCode
      ref: $(Branch)

In the generic build template the repo is checked out for further processing:

stages:
  - stage: 'Build_ansible_playbook'
    displayName: 'Build ansible playbook'
    jobs:
      - job: 'Build_ansible_playbook'
        pool: 'Azure Pipelines'
        steps:
          - checkout: SourceCode
            fetchDepth: 1
            clean: true
            displayName: Checkout SourceCode inventories

This works fine. Almost.

The problem I’m facing is that in the UI there is a Resources menu where users are able to select a version for each involved repo. So basically, the user (and we have about 200 of them) is able to select a different branch for repo ‘SourceCode’ and this will simply override the branch setting of the pipeline.

I’m trying to prevent this. Lines of thought:

• Revise the ‘checkout’ step to specifically checkout the predefined branch, or

• Capture the branch name of the checked out branch (and verify it before proceeding with the playbook)

I’ve had zero luck with both. checkout does not seem to have any branch naming options, and capturing the branch name of the actually checked out repo is not supported out of the box. Any help would be much appreciated!