Unable to install tfx-cli using yaml task in Azure Devops Pipeline - TfxInstaller@4

[v-gpriyanshu]

Whenever we try to install tfx-cli using TfxInstaller@4 task, error persists : "Unable to find Tfx version". We tried we every other version, it's not working. Here is the task :-

• task: TfxInstaller@4
  inputs:
  version: 'v0.x'

[ivanduplenskikh]

@v-gpriyanshu, I noticed that your screenshot shows the extension v3, yet in your message, you referred to TfxInstaller@4. Could you kindly clarify which version is currently in use?

I've successfully installed tfx-cli@0.17.0 using TfxInstaller@4 on my test organization.

[ivanduplenskikh]

I'm closing this issue. Feel free to reopen if you have any additional questions.

[Porges]

@ivanduplenskikh I can confirm the same behaviour with v4 and v5. Neither of these can install any of v0.17.x, 0.17.x, 0.17 or v0.17. Something seems to be not working properly and I can't see any logs indicating what the problem is.

[Porges]

I think what's going on here is that the MS Build Network Isolation policies are currently being rolled out on ADO pipelines. This means that TfxInstaller cannot contact npmjs.org, and installation is failing. However, does not provide a way to override which registry it is reading from (and does not produce log output when this happens).

At the moment I'm trialling a workaround by installing tfx-cli myself and then setting the secret __tfxpath variable manually to convince the extension publishing task to run. (Edit: confirmed that this works – __tfxpath should point to the parent directory containing the npm-installed script.)

Edit 2: actually a better thing to do would be npm config --global set registry=REGISTRY before the TfxInstaller task, but for some reason that doesn't seem to take effect.

[Porges]

I think what's going on here is that the MS Build Network Isolation policies are currently being rolled out on ADO pipelines. This means that TfxInstaller cannot contact npmjs.org, and installation is failing. However, does not provide a way to override which registry it is reading from (and does not produce log output when this happens).

At the moment I'm trialling a workaround by installing tfx-cli myself and then setting the secret __tfxpath variable manually to convince the extension publishing task to run. (Edit: confirmed that this works – __tfxpath should point to the parent directory containing the npm-installed script.)

Edit 2: actually a better thing to do would be npm config --global set registry=REGISTRY before the TfxInstaller task, but for some reason that doesn't seem to take effect.

I'll note that a much cleaner way to do this is simply to install tfx-cli manually and then invoke it manually instead of using PublishAzureDevOpsExtension which requires __tfxPath to be set.

Thus (for anyone else in a similar situation) a configuration which doesn't trigger any compliance warnings (currently) is to install from your custom NPM registry and then run TFX with your WIF authentication instead of a saved PAT:

- task: Npm@1
  displayName: "Install tfx-cli ${{variables.TFX_VERSION}}"
  inputs:
    command: custom
    customCommand: "install -g tfx-cli@${{variables.TFX_VERSION}} --registry=$(NPM_REGISTRY)"
- task: AzureCLI@2
  displayName: "Publish Extension"
  inputs:
    azureSubscription: "WIF Auth"
    scriptType: pscore
    scriptLocation: inlineScript
    inlineScript: |
      # get an access token for ADO using azureSubscription
      $ado_scope = '499b84ac-1321-427f-aa17-267ca6975798'
      $accessToken = az account get-access-token --resource $ado_scope --query "accessToken" --output tsv
      Write-Host "##vso[task.setsecret]$accessToken" # protect it

      tfx extension publish --json --no-color `
        --auth-type pat --token $accessToken `
        --vsix $vsixFile

(See notes about setting up the WIF auth here.)

[marcopelegrini]

@Porges solution won't work in my org due to restrictions on use of AzCLI, so here's my solution for anyone facing the same issue:

              - task: PowerShell@2
                displayName: 'Create .npmrc file'
                inputs:
                  targetType: inline
                  script: |
                    Set-Content -Path "$(Agent.TempDirectory)/.npmrc" -Value "registry=<YOUR PRIVATE REGISTRY>"
                    Add-Content -Path "$(Agent.TempDirectory)/.npmrc" -Value "always-auth=true"

              - task: PowerShell@2
                displayName: '📦 Set NPM_CONFIG_USERCONFIG'
                inputs:
                  targetType: inline
                  script: |
                    Write-Output "Setting NPM_CONFIG_USERCONFIG environment variable:"
                    Write-Output "##vso[task.setvariable variable=NPM_CONFIG_USERCONFIG]$(Agent.TempDirectory)/.npmrc"

              - task: npmAuthenticate@0
                displayName: '📦 NPM Authenticate'
                inputs:
                  workingFile: '$(NPM_CONFIG_USERCONFIG)'

              - task: TfxInstaller@5
                displayName: '📦 Install TFX CLI'
                inputs:
                  checkLatest: true

This will allow TfxInstaller which uses npm to work as it will end up using the USERCONFIG .npmrc which was created and authenticated in the previous steps