Azure Pipelines "checkout: self" - Auth Fails on git push-back
By default checkout: self does not leave the access token in the local git config. A later step that pushes back to the repo (tags, version bumps) then fails to authenticate - you must set persistCredentials: true or pass the token explicitly.
What this error means
Checkout succeeds and the build runs, but a git push step fails with an authentication error. The pipeline cannot push because the checkout step did not persist the credential for git to reuse.
remote: TF401019: The Git repository with name or identifier does not
exist or you do not have permissions.
fatal: Authentication failed for 'https://dev.azure.com/org/proj/_git/repo/'Common causes
Credentials not persisted by checkout
The default checkout clears the auth header from git config after cloning. A subsequent git push has no credential to use, so it fails.
Build service lacks Contribute on the repo
Even with credentials persisted, the Build Service identity needs Contribute (and "Bypass policies" if pushing to a protected branch) on the repo, or the push is rejected.
How to fix it
Persist credentials on checkout
Set persistCredentials: true so git reuses the pipeline token for push-back.
steps:
- checkout: self
persistCredentials: true
- script: |
git config user.email "ci@pipeline"
git tag v$(Build.BuildId)
git push origin v$(Build.BuildId)Or push with the access token explicitly
Map System.AccessToken and use it in the remote URL, and grant the Build Service Contribute.
steps:
- script: |
git push https://x:$(System.AccessToken)@dev.azure.com/org/proj/_git/repo HEAD:main
env:
SYSTEM_ACCESSTOKEN: $(System.AccessToken)How to prevent it
- Set
persistCredentials: truewhenever a pipeline pushes back. - Grant the Build Service least-privilege Contribute on the target repo.
- Avoid pushing to protected branches from CI unless explicitly intended.