让开源，少一点语言距离。
npm包中文文档

@4cloudguru/pipeline-task-ado

中文文档
0.11.1发布于 2026/09/09Apache-2.0TypeScriptESM + CJS构建来源已验证近 30 天下载 3760

Azure DevOps-specific task primitives shared by the Azure Pipelines task extensions.

原始使用文档
中文原文
文档目录5 节
  1. Why this exists separately from pipeline-task-core
  2. Peer dependencies, not dependencies
  3. Scope
  4. A warning to anyone moving a module here
  5. Development

@4cloudguru/pipeline-task-ado

Azure DevOps-specific task primitives shared by the Azure Pipelines task extensions (azure-pipelines-terraform, azure-pipelines-packer).

Why this exists separately from pipeline-task-core

@4cloudguru/pipeline-task-core is deliberately platform-agnostic: it imports neither azure-pipelines-task-lib nor undici, which is what lets it be audited and reused without dragging in an ADO runtime. That property is worth keeping.

But a real task needs code that is ADO-specific — reading inputs, registering secrets with the agent, routing HTTP through the agent's proxy, emitting localized messages. That code was being copy-pasted between tasks and between the two extension repos, byte-identical and enforced by each repo's scripts/check-shared-modules.js. This package is its home.

The split is the point:

pipeline-task-corepipeline-task-ado (this)
Depends on the ADO task libneveryes (as a peer)
ExampleassertEgressHostAllowed, redactUrl, VerificationFailuregetBoolInputDefaultTrue, the proxy-aware HTTP client
readUrlInput / readSecretInput / readEndpointUrl -- reads a task input or a service-connection URL WITHOUT task-lib's getInput()/getEndpointUrl() debug line, which prints the raw value at read time before any caller can mask it. readUrlInput registers every spelling of any URL userinfo in the value (whole, embedded, scheme-less) and the value of every credential-named key=value assignment in a free-form block; readSecretInput registers the whole value line-wise and logs name=***; readEndpointUrl does the URL treatment for ENDPOINT_URL_<id>.

Keeping them as two specifiers is also what preserves the extensions' test seams: a task can mock this package's HTTP surface while the security guards it asserts keep resolving from -core and stay real. Collapsing them into one module would let a single registerMock blank the guard a test exists to verify — green, and checking nothing.

Peer dependencies, not dependencies

azure-pipelines-task-lib is a peer. A task already vendors its own copy, and the agent configures that instance. Bundling a second one would ship in every .vsix and could answer differently about inputs and secrets. undici is an optional peer, needed only by the proxy-aware HTTP surface.

Scope

Modules move here one family at a time, smallest first, so the migration pattern is proven on something harmless before anything security-bearing moves:

  • getBoolInputDefaultTrue — fail-closed boolean input
  • http-client — proxy-aware, HTTPS-pinned client wiring over -core
  • registry-version-resolver
  • https-client
  • secure-temp — secret-bearing temp file writer (0600 + exclusive create). azure-pipelines-terraform's copy adds Windows ACL hardening and a scrub-before-unlink pass that azure-pipelines-packer's copy is missing; moving the terraform copy here fixes that drift for both extensions at once.
  • environment-variables — tracked env var + secret registration helper. azure-pipelines-terraform's copy adds registerSecret/ getTrackedSecretValues for exact-match secret redaction on build attachments that azure-pipelines-packer's copy is missing.
  • id-token-generator — OIDC token exchange for federated credentials. azure-pipelines-terraform's copy validates SYSTEM_OIDCREQUESTURI's hostname against an allowlist before sending the System.AccessToken bearer credential to it; azure-pipelines-packer's copy only checks the URL scheme is https: and is missing that allowlist check.

A warning to anyone moving a module here

Several consumer gates scan in-repo source — check-proxy-parity.js, check-artifact-trust.js, check-egress-authorization.js, and PreMaskingClassL0's source-level rows. When a module moves into this package, those gates stop finding it and keep exiting 0. That is not hypothetical: azure-pipelines-terraform#949 shipped a proxy gate reporting zero call sites and a green build.

So each migration must, in the same change:

  1. move the gate with the code into this repo's own suite;
  2. replace the consumer's shape-gate with a version floor — assert the task depends on @4cloudguru/pipeline-task-ado >= X (provenance, not shape);
  3. keep one behavioural test in the consumer proving the wiring still holds end to end, so the consumer proves something rather than trusting a version.

Development

npm ci
npm test            # vitest
npm run typecheck
npm run build       # tsup, dual CJS/ESM
npm run smoke       # packs the tarball and consumes it as a real task does

Commits follow Conventional Commits; releases are automated by release-please and published to npm with provenance.

版本与发布记录

@4cloudguru/pipeline-task-ado 共发布 21 个版本，首次发布于 2026/08/15；过去 12 个月发布了 21 个版本。最新版本附带 npm provenance 构建来源证明，可追溯到公开的 CI 构建记录。

版本发布日期距今
0.11.1latest2026/09/091 个月前
0.11.02026/09/081 个月前
0.10.02026/09/081 个月前
0.9.12026/09/072 个月前
0.9.02026/09/072 个月前
0.8.12026/09/042 个月前

关于 @4cloudguru/pipeline-task-ado 的常见问题

@4cloudguru/pipeline-task-ado 是什么？

Azure DevOps-specific task primitives shared by the Azure Pipelines task extensions.

如何安装 @4cloudguru/pipeline-task-ado？

在项目目录运行 npm install @4cloudguru/pipeline-task-ado，或使用 pnpm add / yarn add / bun add。它还需要宿主项目提供 peer 依赖：azure-pipelines-task-lib（>=4）。npm 7 及以上与 pnpm 8 及以上默认会自动安装必需的 peer 依赖，Yarn 需要手动安装。

@4cloudguru/pipeline-task-ado 支持 TypeScript 吗？

支持。包内自带 TypeScript 类型声明（package.json 声明了 types 入口），安装后即可获得类型提示，无需再安装 @types 包。

@4cloudguru/pipeline-task-ado 支持 ESM 还是 CommonJS？

同时提供 ES Module 与 CommonJS 入口，import 和 require() 都可以使用，打包工具会自动选择合适的版本。

@4cloudguru/pipeline-task-ado 需要什么版本的 Node.js？

package.json 的 engines 字段要求 Node.js >=20.0.0。版本不符时 npm 默认只给出警告，开启 engine-strict 后会拒绝安装。

@4cloudguru/pipeline-task-ado 可以商用吗？

@4cloudguru/pipeline-task-ado 使用 Apache-2.0 许可。宽松许可：允许商业使用、修改和再分发，并附带明确的专利授权；分发时需保留许可与 NOTICE 文件，修改过的文件要注明改动。以上为概括，不构成法律意见，请以许可原文为准。

@4cloudguru/pipeline-task-ado 的下载量有多少？

根据 npm 官方下载统计，@4cloudguru/pipeline-task-ado 在 2026/10/05 – 2026/11/03 这 30 天内被下载 3,760 次，日均约 125 次。下载量会把 CI 构建、镜像同步和作为其他包依赖的安装一并计入，适合横向比较热度，不能直接等同于使用人数。

@4cloudguru/pipeline-task-ado 还在维护吗？

最新版本 0.11.1 发布于 2026/09/09（1 个月前）；至今共发布 21 个版本，其中过去 12 个月发布了 21 个；首次发布于 2026/08/15。发布频率只是参考信号：功能稳定的工具可能很少需要更新，建议结合源码仓库的 issue 和提交记录判断。