Reusable pipeline elements
Create reusable pipeline elements
The objective lists templates, task groups, variables and variable groups. One of those four is a trap.
Task groups are classic-only
Task groups are not supported in YAML pipelines. Use templates instead.
If a scenario says "YAML" and an option says "task group", that option is wrong. Task groups remain valid in classic build and release pipelines, which is why they still appear in the objective at all.
Templates: compose or constrain
# Compose — insert content into my pipeline
steps:
- template: templates/build-steps.yml
parameters: { vmImage: ubuntu-latest }
# Constrain — the template governs what I may do
extends:
template: templates/secure.yml
parameters:
buildSteps: [ { script: npm ci } ]Typed parameters (string, object, stepList, jobList, stageList) are
what make extends an enforceable control rather than a convention.
Variables and variable groups
| Scope | Where |
|---|---|
| Pipeline / stage / job variable | variables: in the YAML |
| Shared across pipelines | Variable group in the Library |
| Backed by a vault | Variable group linked to Azure Key Vault |
The security detail worth knowing:
Secret variables in a variable group are protected resources — you can attach approvals, checks and pipeline permissions to them. Access to non-secret variables is not limited by approvals, checks or pipeline permissions.
So "we put the connection string in a variable group and added an approval" only constrains anything if that variable is marked secret.
Primary sources