Access to private feed from Azure Devops pipeline

Question

I want to create access to my private feed from pipeline (Project A), but everytime when i try run dotnet restore to restore .net project with nugets from private feed (project scoped feed in Project B) i got

error NU1301: Unable to load the service index for source <<url_to_my_feed>>

My pipeline.yml looks like:

[previous jobs]

- task: NuGetAuthenticate@0

- task: Docker@2
  displayName: Build image
  inputs:
    command: build
    containerRegistry: $(dockerRegistryServiceConnection)
    repository: $(contentHostRepositoryName)
    Dockerfile: "$(Build.SourcesDirectory)/src/modules/content/src/Dockerfile"
    arguments: '--build-arg PAT=$(VSS_NUGET_ACCESSTOKEN)'
    tags: |
       $(tag)

[next jobs]

My dockerfile looks like:

...
ARG PAT
RUN dotnet nuget add source <<url_to_my_feed>> --name <<name>> --username <<username>> --password $PAT --store-password-in-clear-text
...

When i replace '--build-arg PAT=$(VSS_NUGET_ACCESSTOKEN)' to '--build-arg PAT=<<pat_token>>' where <<pat_token>> is token, who i generate manualty to my personal account in Azure Devops - everythink work fine.

What i try:

using $(System.AccessToken) instead $(VSS_NUGET_ACCESSTOKEN)
in feed set contribution permission to Project A Build Service
in project B disable Limit job authorization scope to current project for non-release pipelines and Limit job authorization scope to current project for release pipelines
use NuGetAuthenticate@0 and NuGetAuthenticate@1
into Pipelines Security in Project A allow Project Build Service for everythink
before using $(System.AccessToken) main into varaible

It is supposed to be FEED_ACCESSTOKEN i.e. arguments: '--build-arg FEED_ACCESSTOKEN=$(VSS_NUGET_ACCESSTOKEN)' — amit_g, Sep 09 '22 at 22:29
What does it matter if i call arg PAT or FEED_ACCESSTOKEN? I supposed that I might as well call it a TEST_TOKEN token, it's important to refer to the correct name in the docercompose file. — Adam Wróbel, Sep 09 '22 at 22:42
What more, i replace $(VSS_NUGET_ACCESSTOKEN) manuał create PAT token and everythink work fine — Adam Wróbel, Sep 09 '22 at 22:54
You are right. The dockerfile also has the same name as ARG so it won't matter. — amit_g, Sep 09 '22 at 22:59
What is the username when it is access token? Try "vsts" as username when access token is used. — amit_g, Sep 09 '22 at 23:14
Hi Adam, any update on this issue, have you checked my answer? does it answer your question? — Bowman Zhu-MSFT, Sep 21 '22 at 09:46
@AdamWróbel Did you ever get this working using the agent PAT? — Rafe, Feb 27 '23 at 16:43

score 2 · Answer 1 · answered Sep 12 '22 at 08:04

Add the Project Collection Build Service (Organization) and let it has related permission.

Since you use yml file pipeline, and you disable Limit job authorization scope to current project for non-release pipelines, so project build service account will change to project collection build service account.

And please use $(System.AccessToken) to auth.

Access to private feed from Azure Devops pipeline

1 Answers1