XamarinAndroid@1 replaces target project with wildcards when using secret variables.

Question, Bug, or Feature?
Bug

Enter Task Name: XamarinAndroid@1

list here (V# not needed):
https://github.com/microsoft/azure-pipelines-tasks/tree/master/Tasks/XamarinAndroidV1

Environment

• Server - Azure Pipelines

Issue Description

Linking a Variable Group that contains Secret variables to a Pipeline causes the XamarinAndroid@1 task to replace the project specified on the MSBuild.exe command line with wildcards. So "d:\a\1\s\Hylink\Hylink.Android\Hylink.Android.csproj" becomes "D:\a\1\s\Hylink\***\***.csproj.

1. Construct a classic pipeline using the prepackaged Xamarin.Android template to build a Xamarin.Forms project.
2. Create a new variable group
3. Add (in our case we have 2 variables) secret variables and values, such as keystore.password and keystore.alias.
4. Link that variable group to the pipeline. The variables need not be used by the pipeline.
5. Save and Run the build.

If the pipeline is executed without the linked variables the output from the XamarinAndroid@1 task will be as follows: 2020-07-22T22:38:45.2820750Z ##[command]"C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\MSBuild\Current\Bin\msbuild.exe" "d:\a\1\s\Hylink\Hylink.Android\Hylink.Android.csproj" /nologo /nr:false /t:"Clean" /dl:CentralLogger,

If you link the variable group previously created to the pipeline the project path and name is replaced with a set of wildcards: 2020-07-22T22:48:32.3241088Z ##[command]"C:\Program Files (x86)\Microsoft Visual Studio\2019\Enterprise\MSBuild\Current\Bin\msbuild.exe" "D:\a\1\s\Hylink\***\***.csproj" /nologo /nr:false /t:"Clean" /dl:CentralLogger,

In our situation both builds complete with output that seems to be correct and similar. Assuming that it is actually using wildcards (and building all .csproj files) our build would probably fail if not for the fact that some projects are disabled in the configuration manager.

Task logs

BuildwithSecretVariables_logs_749.zip BuildwithoutSecretVariables_logs_750.zip

[bakerhillpins]

@leantk Your description was a bit unclear to me and I had to read it several times to understand. However, I understand now… The values of secret variables are scrubbed from the log output using a simple string search algo.

Thus all pipeline output is subject to a search and replace operation, where any linked secret variable’s value is replaced with “***” in the output.

In this case a secret variable used had it’s value set to the name of a project, “Hylink.Android”, and thus anytime that string exists in the output it was scrubbed.

Thanks for clarifying this. Might be worth an update to the documentation.

[leantk]

Yep that’s a good suggestion on the docs. I’ll take note of making an update. I’m going to close this out then but if you have more questions, please feel free to comment