git - 对 git 子模块使用相对 url 需要凭据

Question

Team Services 文档 ( https://www.visualstudio.com/en-us/docs/build/define/repository#what-kinds-of-submodules-can-i-check-out ) 指出我可以执行 $ git add submodule if

• 它是一个直接子模块
• 未经身份验证(不适用)
• 已通过身份验证
  • 包含在同一个团队项目中
  • 使用主存储库中的相对 url 添加

他们举了一个例子:

git submodule add /../../submodule.git mymodule

如果我在同一个项目中引用一个 git 仓库

git submodule add ./../other-repo mymodule

它解析了正确的 repo，但要我提供凭据。构建失败并显示以下消息:

Cloning into 'mymodule'...
fatal: could not read Username for 'https://xxx.visualstudio.com': Invalid argument

提供带有凭据的完整 URL ( https://user:password@xxx.visualstudio.com/.. .) 可行，但 IMO 是一个糟糕的解决方案。

文档建议这应该使用相对 url 且无需凭据。我错了吗？

编辑 1:

使用 system.debug 运行:true

Entering OnPrepareEnvironment
Primary repository: xxx
Calculating build folder hash key.
Loading tracking config if exists: C:\a\SourceRootMapping\07a8b96d-d805-4646-83d3-e7b2fbe394c2\18\SourceFolder.json
Creating new tracking config.
Loading top-level tracking config if exists: C:\a\SourceRootMapping\Mappings.json
Writing config to file: C:\a\SourceRootMapping\Mappings.json
Writing config to file: C:\a\SourceRootMapping\07a8b96d-d805-4646-83d3-e7b2fbe394c2\18\SourceFolder.json
Checking if artifacts directory exists: C:\a\1\a
Creating artifacts directory.
Checking if test results directory exists: C:\a\1\TestResults
Creating test results directory.
Creating binaries directory.
Setting local variables.
Create the initial timeline records for the tasks
Preparing repositories
repo clean = False
Found 3 endpoints to consider
Found 1 repositories to sync
Starting: Get sources
build.fetchtags=false
Entering GitSourceProvider.PrepareRepositoryAsync
Repository type=TfsGit
localPath=C:\a\1\s
clean=False
sourceBranch=refs/heads/r_080
sourceVersion=26d5a7a6e6ed47c8f12ee5dc5b376d6731b7863a
Syncing repository: xxx (Git)
repository url=https://xxx.visualstudio.com/_git/xxx
checkoutSubmodules=False
Starting clone
Checking out 26d5a7a6e6ed47c8f12ee5dc5b376d6731b7863a to C:\a\1\s
Checked out branch refs/heads/r_080 for repository xxx at commit 26d5a7a6e6ed47c8f12ee5dc5b376d6731b7863a
Leaving GitSourceProvider.PrepareRepositoryAsync
Leaving OnPrepareEnvironment
Running tasks
Starting task: Run git
##[warning]File name doesn't indicate a full path to a executable file.
Executing the following command-line. (workingFolder = C:\a\1\s)
git submodule add ./../other_repo mymodule
Error message highlight pattern: 
Warning message highlight pattern: 
C:\Windows\system32\cmd.exe /c "git submodule add ./../other_repo mymodule"
Cloning into 'mymodule'...
Fatal: InvalidOperationException encountered.
bash: /dev/tty: No such device or address
error: failed to execute prompt script (exit code 1)
fatal: could not read Username for 'https://xxx.visualstudio.com': Invalid argument
fatal: clone of 'https://xxx.visualstudio.com/_git/other_repo' into submodule path 'mymodule' failed
Finishing task: CmdLine
##[error]System.Exception: Task CmdLine failed. This caused the job to fail. Look at the logs for the task for more details.
##[error]   at Microsoft.TeamFoundation.DistributedTask.Worker.JobRunner.Run(IJobContext jobContext, IJobRequest job, IJobExtension jobExtension, CancellationTokenSource tokenSource)
Entering OnFinalizeJob
Leaving OnFinalizeJob

编辑 2:

我无法回答这个问题。文档是错误的/不清楚的，我选择了检查子模块的选项，就像@eddie-msft 所说的那样——但要注意:VSTS git build fails with git submodule

Answer 1

我从Submodules - Azure Repos了解到出现问题时:

• 子模块 repo 需要身份验证。
• 您已启用 Limit job authorization scope to referenced Azure DevOps repositories ，默认情况下启用。

If you restricted the job access token as explained in the section above, then you won't be able to do this.

我自己只尝试过 nr 1，它对我们有用。

解决方法 1:对于 DevOps 中的子模块 repo

• 在项目设置中禁用Limit job authorization scope to referenced Azure DevOps repositories，这会授予管道对所有 DevOps 存储库的访问权限。
• Use relative paths instead of https:// in the submodule URL ，例如 ../MySubmoduleRepo 或 ../../../OtherProject/_git/MySubmoduleRepo。

解决方法 2:如果需要不同的凭据

• Use a script to checkout with a personal access token (PAT)

解决方法 3:为子模块同步重用访问 token 的自定义脚本

https://stackoverflow.com/a/63593883/134761

steps:
- checkout: self
  submodules: false
  persistCredentials : true

- powershell: |
    $header = "AUTHORIZATION: bearer $(System.AccessToken)"
    git -c http.extraheader="$header" submodule sync
    git -c http.extraheader="$header" submodule update --init --force --depth=1