I am using azure api call to list down all repositories under one organization: https://learn.microsoft.com/en-us/rest/api/azure/devops/git/repositories/list?view=azure-devops-rest-7.1&tabs=HTTP
And I use this specific endpoint:
GET https://dev.azure.com/{organization}/{project}/_apis/git/repositories?api-version=7.1-preview.1
But when I try to use this endpoint via shell script in the pipeline, it only lists down exactly one, the parent repository where the script is being written on instead of all repositories in the project.
Here is my code so far
steps:
- task: PowerShell@2
inputs:
targetType: 'inline'
script: |
$header = @{ Authorization = "Bearer $(System.AccessToken)" }
$allReposUrl = "$($env:SYSTEM_TEAMFOUNDATIONSERVERURI)_apis/git/repositories?api-version=6.0"
$allReposResponse = (Invoke-RestMethod -Uri $allReposUrl -Method Get -Headers $header).value
$allReposResponse | ForEach-Object {
echo "LOG: $($_)"
}
When I try to echo the URL and open it in the browser, it displays the expected count and enumerates all the repos in the project. There is inconsistency on the results of the pipeline and on the browser.
I already adjusted the security settings for build service but still no avail. Am I missing on modifying the setup for the build service user?
Thank you for your help!
4
I have tested your yaml file, it works fine and returns all the repos in the current project. Please check and try the followings in your organization.
-
Turn off the Protect access to repositories in YAML pipelines from Project Settings -> Pipeline Settings.
With this option enabled, the scope of access for all pipelines will be reduced to only Azure DevOps repositories explicitly referenced by a checkout step or a uses statement in the pipeline job that uses that repository. See the details from Protect access to repositories in YAML pipelines.
-
Please check whether your project has enabled Limit job authorization scope to current project for non-release pipelines from Project Settings -> Pipeline Settings. If this option is enabled, the build service account used is project-scoped. Otherwise, it’s collection-scoped.
- The collection-scoped build service account name has format: Project Collection Build Service ({OrgName})
- The project-scoped build service account name has format: {Project Name} Build Service ({Org Name})
Assign your target build service account with the Read permission of all your repos. Go to Project Settings -> Repositories -> Security -> Search your build service account and set the Read permission to Allow.
Update
If you can’t turn off Protect access to repositories in YAML pipelines in the Pipeline Settings, you can create a PAT with vso.code scope and add it to the pipeline as a secret variable. Use it in your scripts for authentication.
- task: PowerShell@2
inputs:
targetType: 'inline'
script: |
$token = "$(PAT)"
$token = [System.Convert]::ToBase64String([System.Text.Encoding]::ASCII.GetBytes(":$($token)"))
$header = @{ Authorization =" Basic $token" }
$allReposUrl = "$($env:SYSTEM_TEAMFOUNDATIONSERVERURI)_apis/git/repositories?api-version=6.0"
$allReposResponse = (Invoke-RestMethod -Uri $allReposUrl -Method Get -Headers $header).value
$allReposResponse | ForEach-Object {
echo "LOG: $($_)"
}
1