azure-pipelines-tasks: Pipeline Cache Permissions Error with PR builds of forks

Error using CacheBeta:

Access Denied: Microsoft.TeamFoundation.ServiceIdentity;35644cd7-0bb6-49d4-9b34-a44080e11677:Build:a73f0a6a-a507-4857-93f8-daef87db809b needs the following permission(s) on the resource $ to perform this action: Read pipeline cache entries

I’m having trouble finding reference to this permission in the documentation. It appears to be because the task is being added in a pull request and isn’t in the master version of the pipeline, but if you can’t add it in a pull request it would be a challenge to use it.

What is the right way to solve it?

  steps:
  - task: CacheBeta@0
    inputs:
      key: |
        c7n-tox
        $(python.version)
        $(Agent.OS)
      path: $(PIP_DOWNLOAD_CACHE)

Same result on Windows and Linux.

See build here: https://dev.azure.com/cloud-custodian/cloud-custodian/_build/results?buildId=3409

PR here: https://github.com/cloud-custodian/cloud-custodian/pull/4451

About this issue

Original URL
State: closed
Created 5 years ago
Comments: 20 (4 by maintainers)

Most upvoted comments

I am getting “##[error]Access Denied: Project Collection Build Service (xxxxx) needs the following permission(s) on the resource $ to perform this action: Read pipeline cache entries”. It’s a master branch in Azure DevOps project, a release pipeline. The issue still exists.

zhankezk on Apr 24, 2020

If that doesn’t work with PR, it’s useless for CI.

pvizeli on Jul 30, 2019

Also having this problem, getting this in a Release pipeline just as @aodj Thanks @owenhuynMSFT

andyhammar on Nov 20, 2020

@fadnavistanmay - We are still facing this issue. Getting that exact same error as above. Could you please help us?

/cc: @MrMatt57

blueelvis on Mar 11, 2020