Azure-pipelines-tasks: Azure Pipeline public build throws TF400813: The user is not authorized to access this resource error when the Publish Build Artifacts task is executed

[MarkIannucci]

Environment

• Server - Azure Pipelines
  Azure Pipelines details: MarkIannucciGitHub Organization, Chrome Userweb Search Extension Project, MarkIannucci.ChromeUserWebSearchExtension Build definition

• Agent - Hosted VS 2017

Issue Description

If a first time contributor (possibly happens in other scenarios also) creates a Pull Request for an open source repo on GitHub and you have a public Azure Pipelines build configured to run on PRs for your repo, the build runs but the Publish Build Artifacts task fails with the following error:

TF400813: The user is not authorized to access this resource

Is this by design? I don't think it should be, if a user has configured a public repo, they may want the build output to be published, even if the reason for the build was because of an anonymous contribution.

Error logs

2018-10-29T20:34:06.7394680Z Uploading 1 files
2018-10-29T20:34:11.7738805Z Total file: 1 ---- Processed file: 0 (0%)
2018-10-29T20:34:21.8987911Z Fail to upload 'D:\a\1\a\EpicUserWebSearch.zip' due to 'TF400813: The user 'c8f7a705-27dd-4fcd-a55a-e6a992635c96' is not authorized to access this resource.'.
2018-10-29T20:34:21.8988345Z Microsoft.VisualStudio.Services.Common.VssUnauthorizedException: TF400813: The user 'c8f7a705-27dd-4fcd-a55a-e6a992635c96' is not authorized to access this resource.
   at Microsoft.VisualStudio.Services.Common.VssHttpMessageHandler.SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at Microsoft.VisualStudio.Services.Common.VssHttpRetryMessageHandler.SendAsync(HttpRequestMessage request, CancellationToken cancellationToken)
   at System.Net.Http.HttpClient.FinishSendAsyncBuffered(Task`1 sendTask, HttpRequestMessage request, CancellationTokenSource cts, Boolean disposeCts)
   at Microsoft.VisualStudio.Services.WebApi.VssHttpClientBase.SendAsync(HttpRequestMessage message, HttpCompletionOption completionOption, Object userState, CancellationToken cancellationToken)
   at Microsoft.VisualStudio.Services.FileContainer.Client.FileContainerHttpClient.UploadFileAsync(Int64 containerId, String itemPath, Stream fileStream, Byte[] contentId, Int64 fileLength, Boolean isGzipped, Guid scopeIdentifier, CancellationToken cancellationToken, Int32 chunkSize, Int32 chunkRetryTimes, Boolean uploadFirstChunk, Object userState)
   at Microsoft.VisualStudio.Services.FileContainer.Client.FileContainerHttpClient.UploadFileAsync(Int64 containerId, String itemPath, Stream fileStream, Guid scopeIdentifier, CancellationToken cancellationToken, Int32 chunkSize, Boolean uploadFirstChunk, Object userState, Boolean compressStream)
   at Microsoft.VisualStudio.Services.Agent.Worker.Build.FileContainerServer.UploadAsync(IAsyncCommandContext context, Int32 uploaderId, CancellationToken token)
2018-10-29T20:34:21.8989160Z Detail upload trace for file that fail to upload: drop/EpicUserWebSearch.zip
2018-10-29T20:34:21.8989246Z File 'drop/EpicUserWebSearch.zip' will be uploaded in one chunk.

[davidstaheli]

This capability has been added. I'm hopeful it will be available in all of production by the end of next week (November 9).

[yansklyarenko]

@DavidStaheli Apparently, this is not the case. I've run into the same problem trying to build a PR yesterday (November, 11th).

Is there any way to track when the capability arrives to prod? Does it always happen in scope of some sprint? Thanks!

[davidstaheli]

This is now fully available in production. Thank you for your patience as we worked through some bugs and security considerations!