How to automatically 'git tag -a' after a pull request has completed on Azure Devops?

Question

How do we add custom annotated tags on master once the pull requests (PR) is complete, automatically?

More background:

• Using azure-pipelines.yml
• Branch policies on master to force PR to be used
• We have a repository that holds Azure Devops Pipeline Templates ("devops templates repo")
• Other repos have a root pipeline file that references the "devops template" repo
• We use SEMVER for tagging our products, including the devops template repo
• In root pipelines we wish to pin to a SEMVER release of the devops template repo
• We currently tag manually with each of the following to point to the merge commit that occurred after the PR completed
  • "vMAJOR.MINOR.PATCH"
  • "vMAJOR.MINOR"
  • "vMAJOR"

Pin on MAJOR only example:

resources:
  repositories:
    - repository: templates
      type: git
      name: template_devops_pipelines
      ref: "refs/tags/v1"

Answer 1

A sample tagging pipeline that I use:

trigger:
  - main

variables:
  user.email: "[email protected]" 
  user.name: "DevOps"
  defaultBranch: "main"
  major: 1
  minor: 0
  patch: $[counter(variables['patch'], 2)]

name: $(major).$(minor).$(patch)

steps:
  - checkout: self
    persistCredentials: true
  - script: |
      git config user.email ${{variables['user.email']}}
      git config user.name ${{variables['user.name']}}
    displayName: 'configure git credentials'
  - script: | 
      git tag "$(Build.BuildNumber)"
      git push origin "$(Build.BuildNumber)"
    displayName: 'git tag'
    condition: eq(variables['Build.SourceBranchName'], variables['defaultBranch'])

You basically need three things:

1. checkout with persistCredentials - so your pipeline can tag and push later
2. configure git user.email and user.password
3. tag & push

For the last step, you will need to assign "Contribute" permissions to pipeline build service account. Go to: Project Settings -> Repositiories -> {your repo} -> Security, find user {your organization} Build Service and set Contribute to Allow.