Windows self-hosted agent

[maxricketts]

I had PSRule working with an Ubuntu Microsoft-hosted agent, and all was working well. We need to change to a self-hosted windows agent and now the bicep file will not expand from the private container registries. I have set the credential precedence to Environment only to see if that would make a difference, this is the yaml I am using.

It would be nice if we could use azureSubscription: ${{ parameters.serviceConnection }} like we do in AzureCLI@2 taks to tell it what we are using

If I am missing anything, please let me know.

Thanks in advance

Max

# yaml-language-server: $schema=./deploy.yml

stages: 
  - stage: PSRuleScanning
    displayName: PSRule Scanning
    jobs:
      - job: PSRule
        displayName: PS Rule Scanning
        steps:
          - checkout: Exg.DevOps.ImageBuilder
            # Analyze Azure resources using PSRule for Azure
          - task: ps-rule-assert@2
            displayName: Analyze Azure template files
            inputs:
              modules: 'PSRule.Rules.Azure'
              inputType: "repository"
              inputPath: newImage/bicep/
              outputFormat: Nunit3
              outputPath: rule-report.xml
            env:
              # Define environment variables within Azure Pipelines
              AZURE_CLIENT_ID: $(psrule-clientid)
              AZURE_CLIENT_SECRET: $(psrule-secret)
              AZURE_TENANT_ID: $(psrule-tenant)
          # PSRule results
          - task: PublishTestResults@2
            displayName: 'Publish PSRule results'
            inputs:
              testRunTitle: 'PSRule'
              testRunner: NUnit3
              testResultsFiles: 'rule-report.xml'
              mergeTestResults: true
              publishRunAttachments: true
            condition: succeededOrFailed()

[BernieWhite]

@maxricketts Is there are Bicep error returned? If so, are you able to provide the error message.

[maxricketts]

@BernieWhite - Thank you for the quick reply.

Below is the error. I have triple checked the App ID, App Secret, and tenant ID that is passed through from a variable group.

Odd, though as it was all working on ubuntu ms-hosted agent.

#[error]Bicep (0.11.1) compilation of 'C:\a\1\s\newImage\bicep\imagebuilder.bicep' failed with: C:\a\1\s\newImage\bicep\imagebuilder.bicep(253,11) : Error BCP192: Unable to restore the module with reference "br:exgprdukacr001.azurecr.io/bicep/modules/microsoft.resources.resourcegroups:0.4.1527": Unhandled exception: System.ArgumentException: Invalid tenant id provided. You can locate your tenant id by following the instructions listed here: https://docs.microsoft.com/partner-center/find-ids-and-domain-names (Parameter 'tenantId')

[BernieWhite]

You could try this to debug with this set:

Create PSRule convention within the .ps-rule/ directory in the root of your repo, such as .ps-rule/Debug.Rule.ps1.

Add the script block:

Export-PSRuleConvention 'DebugTenant' -Initialize {
    Write-Host "AZURE_TENANT_ID: $($Env:AZURE_TENANT_ID)";
}

Update your assert pipeline task to include the conventions property. For example:

# yaml-language-server: $schema=./deploy.yml

stages: 
  - stage: PSRuleScanning
    displayName: PSRule Scanning
    jobs:
      - job: PSRule
        displayName: PS Rule Scanning
        steps:
          - checkout: Exg.DevOps.ImageBuilder
            # Analyze Azure resources using PSRule for Azure
          - task: ps-rule-assert@2
            displayName: Analyze Azure template files
            inputs:
              modules: 'PSRule.Rules.Azure'
              inputType: "repository"
              inputPath: newImage/bicep/
              outputFormat: Nunit3
              outputPath: rule-report.xml
              conventions: DebugTenant
            env:
              # Define environment variables within Azure Pipelines
              AZURE_CLIENT_ID: $(psrule-clientid)
              AZURE_CLIENT_SECRET: $(psrule-secret)
              AZURE_TENANT_ID: $(psrule-tenant)
          # PSRule results
          - task: PublishTestResults@2
            displayName: 'Publish PSRule results'
            inputs:
              testRunTitle: 'PSRule'
              testRunner: NUnit3
              testResultsFiles: 'rule-report.xml'
              mergeTestResults: true
              publishRunAttachments: true
            condition: succeededOrFailed()

The tenant ID should be reported at the start of the PSRule run.

[maxricketts]

@BernieWhite - The output is
AZURE_TENANT_ID: $(psrule-tenant)

It also timed out. so just increased the expansion timeout

I have then gone and looked back, and in my main yaml file I have forgotten to copy over the variable group name!

So sorry to waste your time, but going through it got to the issue, so many thanks.

I have had a few weird time out issues, which seem random.

Many thanks

[BernieWhite]

@maxricketts Great. No worries.

The time Bicep restore / compile takes is dependent on quite a few things. Reducing module chains such as module -> module -> module -> module can speed up both the compile and restore process.

[BernieWhite]

@maxricketts I think we can close this question as answered, is that ok?

[maxricketts]

Yes