Azure DevOps pipeline : How to pass variables to azure.yaml to pass as docker buildArgs when doing azd deploy

[DeBiese]

I'm trying to use azd deploy in a pipeline in Azure Devops.
My project uses some of our own nuget packages from our private feed.
A docker build step in the pipeline (using Docker@2 with arguments '--build-arg NUGET_PAT=$(myVariableName)' works to build my code.
However, I'm struggling to use my variable from my yml file, through the azure.yaml to Docker when using azd deploy.

I have an azure.yaml file that looks like this:

name: MySolutionName
metadata:
template: azd-init@1.9.3
services:
api:
project: MyProject.API
host: containerapp
language: dotnet
docker:
path: ./Dockerfile
context: ../
buildArgs:
- NUGET_PAT= [ACTUAL PAT]

In my docker file I do the following:
...

ARG NUGET_PAT
ENV VSS_NUGET_EXTERNAL_FEED_ENDPOINTS
"{"endpointCredentials": [{"endpoint":"https://somesuch.pkgs.visualstudio.com/_packaging/myNamed_feed/nuget/v3/index.json", "username":"docker", "password":"${NUGET_PAT}"}]}"

RUN curl -L https://raw.githubusercontent.com/Microsoft/artifacts-credprovider/master/helpers/installcredprovider.sh | bash

RUN echo $NUGET_PAT
RUN echo $VSS_NUGET_EXTERNAL_FEED_ENDPOINTS

COPY ["MyProject.API/MyProject.API.csproj", "MyProject.API/"]
COPY NuGet.Config ./

RUN dotnet restore "./MyProject.API/MyProject.API.csproj"
...

When I change my azure.yaml to have the actual value of the PAT instead of [ACTUAL PAT], the build works.
I would however like to use a variable here so that my PAT isn't in the yaml file.

I have tried doing this in my pipeline:

• task: AzureCLI@2
  displayName: Build and Deploy Applications
  inputs:
  azureSubscription: $(DEVOPS_SERVICE_CONNECTION)
  scriptType: bash
  scriptLocation: inlineScript
  inlineScript: |
  azd env set NUGET_PAT=$(myVariableName)
  azd deploy --no-prompt

With (azure.yaml):
buildArgs:
- NUGET_PAT=$(NUGET_PAT)

But that doesn't work.

The value of the ARG in docker is now "$(NUGET_PAT)" instead of its value, so the restore fails to connect to the private feed.

How would I do this?

[DeBiese]

I did some more digging and at the time of writing, the buildArgs property does not support environment variable substitution.

Source: Microsoft Learn

Input Parameter Substitution

azure.yaml schema

[vhvb1989]

@DeBiese , there is a way to make what you need to work. You will need to use the daily build until azd version 1.9.4 is released (probably during this week).

For 1.9.4, we added a feature that allows you to reference values from azd-environment config within docker->buildArgs (#4008). This feature is mainly required and used by .Net Aspire projects, but it can be used directly by your project, if you want it.

Here's how you can make it work:

• Reference a key-path in your docker-buildArg like:

buildArgs:
- NUGET_PAT={buildArgs.nugetPat}

• Open your azd-env config manually (there's currently no azd commands to manage this config file) from .azure/<env-name>/config.json. Make sure to open the one from the env you are currently using. You can run azd env list to know what's the name of the current default environment.
• Manually add the key and value you are referencing, like:

{
  "buildArgs": {
      "nugetPath": "xxxx-xxx-xxx-xx"
   }
}

Note how each node in the key-path becomes a new level in the azd-env config.

• Now when you run azd, the buildArg NUGET_PAT={buildArgs.nugetPat} will be resolved as NUGET_PAT=xxxxx-xxxx...

• Finally, to make this work on CI/CD, you need to run azd pipeline config, which will automatically save the config.json as a secret in your CI/CD provider (gh or ado). Then just make sure to reference AZD_INITIAL_ENVIRONMENT_CONFIG: ${{ secrets.AZD_INITIAL_ENVIRONMENT_CONFIG }} in your CI/CD pipeline. You can see more about this here: https://learn.microsoft.com/azure/developer/azure-developer-cli/configure-devops-pipeline?tabs=GitHub#create-a-pipeline-definition

[rajeshkamal5050]

@DeBiese did the above work? are you using aspire?

@wbreza is this related to this issue - #4062?

[wbreza]

Correct - right now docker build args does not support environment variable substitutions. Once this is resolved we can support this request.