I couldn't find an article that explained this, and Microsoft's docs weren't the clearest (perhaps I should open a PR!) so I thought it a good idea to write a quick post on it.
Consider the following pipeline:
variables: - group: myGroupFromKeyVault steps: - task: InstallSSHKey@0 inputs: - hostName: $(secret-one) - publicKey: $(secret-two) - passphrase: $(secret-three) # ... other inputs
Sadly, the InstallSSHKey task fails. Why? Because the values of the secrets aren't downloaded before the pre-job runs.