[BUG] Extractor `az repos show` Permission Denied

Release version

v4.1.3

Describe the bug

When using a target repo (within the same project) for output of the extractor script, Create pull request of the Create template branch stage in the Extractor script fails with not found / permission denied when running the az repos show ... step.

This same pipeline succeeds when the target repo is the same as that containing the extractor YAML and pipeline.

Project pipeline settings are restrictive, i.e., “Limit job auth scope” and “Protect access to repos in YAML pipelines” are on org-wide. However, the external target repo has been configured to allow the Extractor pipeline explicitly via “Project Settings > Repositories > Security > Pipeline permissions”. Additionally, the necessary User permissions are configured as defined in the wiki (“Project Build Service (OrgName)” has Contributor role).

Am I missing additional configuration required to make this work?

---

Aside:

My target setup is to have the apiops repo have a branch for each target API in the APIM, then run the Extractor on the desired branch to extract the APIM data for the target API and push to that API’s repo. Hoping to avoid having separate pipelines for each API with the extractor YAML residing in the API repos themselves. Maybe there’s a better approach here?

Expected behavior

Expected output:

Cloning branch main in repository MyRepoTest...
Clone URL is https://[e-mail]/Company/Project/_git/MyRepoTest
Cloning into 'D:\a\_temp\artifacts-from-portal'...
Creating temporary branch artifacts-from-portal-build-286 from main...

Actual behavior

The failure logs on the az repos show ... step:

Cloning branch main in repository MyTestRepo...
ERROR: TF401019: The Git repository with name or identifier MyTestRepo does not exist or you do not have permissions for the operation you are attempting.
Clone URL is 
Cloning into 'artifacts-from-portal'...
fatal: 'D:\a\_temp\artifacts-from-portal' does not appear to be a git repository
fatal: Could not read from remote repository.

Please make sure you have the correct access rights
and the repository exists.
Cloning branch main in repository MyTestRepo failed.

Reproduction Steps

1. Create a repo apiops containing the pipeline YAML config.
2. Create an empty (or minimal) target repo MyTestRepo.
3. Configure apiops per wiki.
4. Configure pipeline permissions on MyTestRepo in Project Settings to allow Extractor YAML pipeline access.
5. Manually run pipeline, specifying:
   • Branch/tag: apiops repo branch
   • APIM repo for pull request: MyTestRepo
   • Target branch for PR: main
   • All other params are configured identical to working extraction scenario where extractor YAML repo and target repo are the same

[comc]

I can confirm simply adding a checkout as a step prior to creating the pull request is sufficient to resolve this issue. Thank you @aristosvo.

For others’ reference, if the repo is in the same project you can simply use:

- checkout: git://<project>/${{ parameters.APIM_REPOSITORY_NAME }}

That said, it would still be valuable to understand what may be breaking the permissions chain in ADO, but that’s not an issue in this repo so I’m closing this. I appreciate all the help.

[aristosvo]

I think this is a permissions issue introduced silently by Azure DevOps. We’ve raised some tickets within Microsoft, but we ended up adding an additional checkout in the pipeline:

- checkout: git://https://dev.azure.com/<organization>/<project>/${{ parameters.APIM_REPOSITORY_NAME }}

If there is something better than this, I’m happy to learn more!