Variables, variable groups, secrets and expressions — Azure DevOps & CI/CD

5. Variables, variable groups, secrets and expressions

Intermediate★ Must knowLesson 5 of 10

yaml

variables:
- group: shop-prod-secrets            # variable group, optionally linked to Azure Key Vault
- name: imageTag
  value: $(Build.BuildId)
- ${{ if eq(variables['Build.SourceBranchName'], 'main') }}:
  - name: env
    value: prod

Syntax	Evaluated	Example
`${{ variables.x }}`	Compile time (template expansion)	conditions in templates, parameters
`$[ variables.x ]`	Runtime, before a job/stage	`condition`, variables based on dependencies
`$(x)`	Macro, just before a task runs	task inputs, scripts

Secret variables are masked in logs and not passed to scripts automatically — map them via env:.
Predefined variables: Build.BuildId, Build.SourceBranch, Build.Reason, System.DefaultWorkingDirectory, Pipeline.Workspace, Agent.OS.
Set variables from scripts: echo "##vso[task.setvariable variable=ver;isOutput=true]1.2.3"; output variables are used across jobs via dependencies.Job.outputs['step.ver'].
Runtime parameters (parameters: at top) let users pick values when running manually (typed: string, boolean, number, object).