0

Description/Question: I have an Azure DevOps Classic Release pipeline where I need to use variables from either pipeline variables or variable groups in my PowerShell scripts.

Expected Behavior:

Variables defined in the pipeline or variable groups should be available to my scripts, whether I am using an inline PowerShell task or referencing a .ps1 script file from source control.

Actual Behavior:

When I use an inline PowerShell task (script entered directly in the task UI), I can access pipeline and variable group variables using the $(VariableName) syntax, and it works as expected (even for secrets, which are masked in logs). When I use a PowerShell script file (.ps1) from source control, the same variables are not available—even when I try to access them as $env:VariableName or ${env:variable-with-dash}. Dumping the environment variables at runtime (Get-ChildItem env:) confirms the variables are missing. Only a small subset of built-in and agent variables are present.

Sample Repro Steps:

Create a variable in the pipeline or variable group, e.g., MySecretVar. In an inline PowerShell task This works as expected.

Write-Host "Value is: $(MySecretVar)"

In a .ps1 script file PowerShell this outputs nothing i.e. the variable is not available.

Write-Host "Value is: $env:MySecretVar"

Question:

Is this the expected behavior in Azure DevOps? Is there a documented way to make pipeline or variable group variables reliably available to .ps1 script files?

If not, what is the recommended approach for sharing variables between pipeline and script files?

Has anyone found a workaround for this limitation?

What I’ve Tried: Using both $env:VariableName and ${env:variable-with-dash} syntax in script files. Declaring variables at pipeline, stage, and job level. Using classic and YAML pipelines. Dumping all environment variables to confirm their absence. Environment: Azure DevOps Services (cloud) PowerShell 5.1 and 7.x

Improve this question
0

1 Answer 1

Reset to default
1

If the variable you want to call is a secret variable, this is a correct behavior.

When using the script task (such as PowerShell task, Bash task, Command Line task, etc..) to execute some command lines in pipelines on Azure DevOps:

  • If using 'inline' type script, before executing the script, the tasks will pre-parse all the macro syntax ($(VarName)) in the script and replace them with the actual values, then wrap the script as a script file and save the script file into the working directory of the agent. After that, the wrapped script file will be executed on the agent.
  • If using 'filePath' type script, since the script has been wrapped as a script file, normally the tasks would just copy the script file into the working directory of the agent. And then directly execute the script file on the agent. It will not pre-parse the macro syntax ($(VarName)) in the script file.

So, in the 'filePath' type script, you need to reference the corresponding environment variables of the pipeline variables.

Normally, the general pipeline variables (not secret variables) would be automatically mapped as the environment variables on the agent machine, so you can directly call the corresponding environment variables of these variables.

However, for secret variables, as mentioned in this documentation, secret variables are not automatically decrypted into environment variables for scripts. You need to explicitly map them to environment variables on the script tasks.

enter image description here

enter image description here

Improve this answer
Sign up to request clarification or add additional context in comments.

1 Comment

thanks fot taking the time to provide a well explained solution to this problem.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Start asking to get answers

Find the answer to your question by asking.

Ask question

Explore related questions

See similar questions with these tags.