Automatically push subtree changes to Azure repository

Question

I am using Azure DevOps to work on two projects I'll name P1 and P2. P1 is a project containing some code I'd like to reuse in P2. I'd like to use subtrees in order to do that. P1 will be driving most (if not all) that code so I'd favour a subtree over a submodule. I've setup a third project on Azure I'll call C meant to contain that shared code.

git-subtree-child (C)
  child.txt

git-subtree-parent-1 (P1)
  azure-pipelines.yml
  git-subtree-child (C)
    child.txt

git-subtree-parent-2 (P2)
  git-subtree-child (C)
    child.txt

My git client does not support subtrees. I can't ask my teammates to use the CLI to call git subtree push ... every time the shared code is updated (one will forget I'm sure!)

So, I'm setting up an Azure pipeline to push to C the code committed from P1. But I'm facing difficulties reaching C's git repository, located in the same organisation.

---

Pipeline script

trigger:
 branches:
   include:
     - release/*

pool:
  vmImage: ubuntu-latest

steps:
- checkout: self
  persistCredentials: true

- script: |
    branch=$(Build.SourceBranch)
    branch=${branch/#"refs/heads/"} # Remove "refs/heads/" from the source branch name
    echo $branch
    git subtree split --prefix=git-subtree-child --branch=extract-child-subtree
    git push https://dev.azure.com/<organisation>/GitSubtreeProofOfConcept/_git/git-subtree-child extract-child-subtree:$branch
    git branch --delete --force extract-child-subtree
  displayName: Push subtree to child repo

Job Output:

/usr/bin/bash --noprofile --norc /home/vsts/work/_temp/6cf48f51-4eb1-4797-9a26-2cb68b904f8d.sh
release/AzurePipeline
1/1 (0) [0]
Created branch 'extract-child-subtree'
f871ba0e0cf7a2ff48c3ed046a2c0eb56cbeed40
fatal: could not read Username for 'https://dev.azure.com': terminal prompts disabled
Deleted branch extract-child-subtree (was f871ba0).

I have the persistCredentials flag set to true in the checkout step, and I gave Contribution permissions as advised here to GitSubtreeProofOfConcept Build Service in the three projects (P1, P2 and C) (Project Settings → Repositories → <project> → Security). So it should be working from what I see online.

The only way I made it working is by providing an access token by replacing:

git push https://dev.azure.com/<organisation>/GitSubtreeProofOfConcept/_git/git-subtree-child

by

git push https://$(System.AccessToken)@dev.azure.com/<organisation>/GitSubtreeProofOfConcept/_git/git-subtree-child.

---

Even if I go this way, I still have ANOTHER error

/usr/bin/bash --noprofile --norc /home/vsts/work/_temp/58591c72-da26-4758-9d24-6270bbc6a1e5.sh
release/AzurePipeline
1/1 (0) [0]
Created branch 'extract-child-subtree'
98b98c18804a186ffa5033c9caa39eaef14fbb6d
remote: TF401019: The Git repository with name or identifier git-subtree-child does not exist or you do not have permissions for the operation you are attempting.
fatal: repository 'https://dev.azure.com/<organisation>/GitSubtreeProofOfConcept/_git/git-subtree-child/' not found
Deleted branch extract-child-subtree (was 98b98c1).

But as you can see, the repository is present and has the branch I'm trying to push to (release/AzurePipeline, printed by the job itself).

The Limit job authorization scope to current project for (non-)release pipelines flags have been unchecked as advised here

Thanks in advance for your help!

Answer 1

From your description, there are two obvious problems.

1, Permission assignment error.

From your screenshot:

So in this situation, the 'Auth' identity is collection level(Organization level), but you are trying to assign permission to project level:

You should assign permission to this service account:

2，Repositories already been prevent from YAML pipelines' access.

You have disable the access from YAML pipeline to repositories:

But you were using YAML pipeline. In this situation, your pipeline will be unable to change the repo.

I notice the color of this setting is grey, you need to go to organization settings to change this.