Introduction

In Azure YAML pipelines there are two categories of variables:

• Compile-time variables: those you create using the variables keyword in the YAML file.
• Runtime variables (Output variables): those you create in scripts using the logging commands syntax.

My assumptions on these is as the following:

1. Compile-time variables have fixed values and can’t be overridden at queue or runtime.
2. Output variables are not defined anywhere else outside the task that defines them.
3. Output variables have a SINGLE purpose, that is to be used in downstream tasks or jobs. They have NO purpose or meaning to the script itself because the script will use its own syntax for variables to use internally (unless the name of the output variable is dynamically generated and taken from a script variable. Example, Write-Host "##vso[task.setvariable variable=$variableName]value")

Question

Based on the assumptions above, I am struggling to understand the use case of target.settableVariables property in a YAML pipeline step. Why do I need to block a variable from being outputted (to downstream jobs and tasks) if its sole purpose is to be outputted to downstream jobs and tasks? Why don’t I simply not create it?

The documentation provides the following example:

steps:
  - bash: |
      echo "##vso[task.setvariable variable=sauce;]crushed tomatoes"
      echo "##vso[task.setvariable variable=secretSauce;]crushed tomatoes with garlic"
    target:
     settableVariables:
      - sauce
    name: SetVars
  - bash: 
      echo "Sauce is $(sauce)"
      echo "secretSauce is $(secretSauce)"
    name: OutputVars

So (question), what’s the use case of secretSauce in here?

Note: there is a decent lack of knowledge on my part. For example, I don’t even know what the description of target.settableVariables property even mean:

Restrictions on which variables that can be set by a step.

I thought output variables can only be created and set by a step (script, pwsh, bash, etc.) So, why bother creating it in the first place if I am going to block it? The documentation example could be rewritten (according to my confused logic) as such:

steps:
  - bash: |
      echo "##vso[task.setvariable variable=sauce;]crushed tomatoes"
    name: SetVars
  - bash: 
      echo "Sauce is $(sauce)"
    name: OutputVars

And if I really need that variable then I don’t block it, I simply make it issecret.

Thanks ahead.