Variable replacement not working in 'jobs' the same as 'deployment' jobs.

Required Information

Entering this information will route you directly to the right team and expedite traction.

Question, Bug, or Feature?
Type: bug

Enter Task Name: Docker@2

list here (V# not needed):
https://github.com/Microsoft/azure-pipelines-tasks/tree/master/Tasks

Environment

• Server - Azure Pipelines or TFS on-premises? Azure Pipelines

• Agent - Hosted or Private: Microsoft Hosted Agent

Issue Description

I have a simple task like this:

    - task: Docker@2
      displayName: Login to Docker Hub
      inputs:
        command: login
        containerRegistry: '$(dockerRegistry)'

If I define variable dockerRegistry within the pipeline file (inside variables block) then it works fine. However, if I import it from Pipeline Library like this:

variables:
  - group: 'Release'

then it does not work, the error message was "There was a resource authorization issue: “The pipeline is not valid. Job Build_and_Publish: Step Docker1 input containerRegistry references service connection $(dockerRegistry) which could not be found. The service connection does not exist or has not been authorized for use. For authorization details, refer to https://aka.ms/yamlauthz.”

I tried some simple echo and confirmed that echo $(containerRegistry) (and other variables in the same libary) works (i.e. the printed value is correct).

Task logs

[Enable debug logging and please provide the zip file containing all the logs for a speedy resolution]

Troubleshooting

Checkout how to troubleshoot failures and collect debug logs: https://docs.microsoft.com/en-us/vsts/build-release/actions/troubleshooting

Error logs

[Insert error from the logs here for a quick overview]

[alexandrebunn]

We had the same issue. And we solved using the workaround moving the variable group to the top level with a conditional as suggested by @Zachery2008

[Zachery2008]

I found a solution. You can save the acr connection as a variable in a variable group. And if you want to choose different variable groups depending on some conditions, you can do it at the top level. So the containerRegistry will treat it correctly. For example,

trigger:
- master

variables:
  # Agent VM image name
  - name: vmImageName
    value: ubuntu-latest
  - name: imageRepository
    value: xxx
  - name: dockerfilePath
    value: xxx
  - name: buildContextPath
    value: xxx
  - ${{ if eq(variables['Build.SourceBranch'], 'refs/heads/master') }}:
    - group: abc123
  - ${{ if eq(variables['Build.SourceBranch'], 'refs/heads/prod') }}:
    - group: xyz456