Accessing secret variables from release task

Hello,

We have built a VSTS extension that adds UI to the work item dialog, and a task to update some state in our application.

The rollout task reads a few inputs like release.releaseId and System.TeamProjectId. It also expects the user to set some variables so that the task can make authenticated calls to VSTS. One such call fetches the work items associated with a release via the Release API.

The authentication currently only works with alternate credentials or PAT. So the user needs to set username and password variables on the release. The task then reads them via getVariable. The code looks something like this:

var https = require('https');
var tl = require('vso-task-lib/vsotask');
var username = tl.getVariable('username', false);
var password = tl.getVariable('password', false);
var auth = username + ':' + password;

https.request({..., auth: auth}, function(res) {
  ...
});

The issue we’re running into is that the password variable is undefined if it is made secret in the UI, and authenticated VSTS calls fail.

Is there a separate method we can use to read secret variables?

Best,

Alexis

[ericsciple]

you can use getEndpointAuthorizationParameter(‘SystemVssConnection’, ‘AccessToken’) to access the job token

i believe a 2x agent (2.105.7 would be a good backstop - i.e. TFS 2017 RTM agent) is required in order access secret variables.

if using the job token is not good for your scenario, then i would suggest switching to an input instead of relying on user to set a specific variable. then the user can pass their secret variable into the input - e.g. $(myusername)

[bryanmacfarlane]

You need to set the bearer header

https://github.com/Microsoft/vsts-node-api/blob/master/api/handlers/bearertoken.ts

If you use node api, you can construct it with that auth handler.