Securing Build Definitions When Multiple Teams Work on a Single Team Project

Securing a build definition is quite straight forward when an organization uses multiple team projects in VSTS/TFS to handle different applications they develop. Each team project build administration can be assigned to different individuals easily. There are organizations using a single team project to manage all of their applications, dividing them into teams inside a single team project. Let's look at possibilities of securing each application teams' builds in single team project for organization scenario.

TFS DB Restore–DB Set to Suspect

When you have configured backups with TFS admin console and restore them in case of a need, you are expecting, your TFS databases to restore without any issues. But you might run into this situation if you just, missed simple thing to check. For example the target server SQL version, should exactly match to the source or your production TFS, SQL version. Let’s have a look at learning experience I went through due to a slight mistake, which taught me how much vigilant you need to be when you are doing the, administrative work with TFS.

Setup yo team

yo team is a great NPM package by Donovan Brown, to automate creation of build and release pipelines. You can use it to generate app with CI/CD in Team Foundation Server 2017 or Visual Studio Team Services. In this post let’s look at how to get it installed, for you to use it to generate CI/CD pipelines

The first requirement is to install node.js and npm latest. You can download it from https://nodejs.org/en/download/. Instruction on installing on windows is here. You can verify the installed version of node and npm by running below commands.

Experiment on Limit AssignedTo field of WIT to Team Members

A question in MSDN Forum lead me to do some experiments on restricting AssignedTo field of a work item to Team Members.

Here are some notes

1. I created team project CustomizeTest
2. This created default team "CustomizeTest"
3. I tried modifying Bug WIT template AssignedTo field

<ALLOWEDVALUES expanditems="true" filteritems="excludegroups">
    <LISTITEM value="[project]\CustomizeTest" />
  </ALLOWEDVALUES>

TFS template was not imported. Error
Error importing work item type definition:
TF26204: The account you entered is not recognized. Contact your Team Foundation Server administrator to add your account.
4. Created a new team "Team1" and tried with

<ALLOWEDVALUES expanditems="true" filteritems="excludegroups">
    <LISTITEM value="[project]\Team1" />
  </ALLOWEDVALUES>

Wow it works fine.
5. So where did I go wrong.... Got it... The default team of team project "CustomizeTest" is created as "CustomizeTest Team"

<ALLOWEDVALUES expanditems="true" filteritems="excludegroups">
    <LISTITEM value="[project]\CustomizeTest Team" />
  </ALLOWEDVALUES>

Works fine.
OK That is that and it works...BUT

Another experiment notes

1. I assigned one member to my Team1
2. Customized Bug WIT AssignedTo field to have

<ALLOWEDVALUES expanditems="true" filteritems="excludegroups">
    <LISTITEM value="[project]\Team1" />
  </ALLOWEDVALUES>

3. Went into Team project CustomizeTest\Team1 and tried creating Bug. Assigned To field drop down have only one member. yeah I am happy.
4. Went into root team project CutomizeTest (CustomizeTest Team) Create Bug. AssignedTo field only has that one member in Team1. Ok it should be since I have made it to work like that.  (my CutomizeTest Team has 3 Members but I can assign a bug in this team only to one member of the Team1, looks like I made some bad customization)
5. I created another Team "Team2" with 2 members.  and modified my Bug WIT AssignedTo field to have

<ALLOWEDVALUES expanditems="true" filteritems="excludegroups">
    <LISTITEM value="[project]\Team2" />
  </ALLOWEDVALUES>

Now when I go into "CustomizeTest Team", "Team1" and "Team2". Create a bug I can assign it to only to the two members of the "Team2".
6. I changed my Bug WIT AssignedTo field to

<ALLOWEDVALUES expanditems="true" filteritems="excludegroups">
    <LISTITEM value="[project]\Contributors" />
  </ALLOWEDVALUES>

and I added teams "CustomizeTest Team", "Team1" and "Team2" as members of [project]\Contributors.
This lists all members from the three teams in my AssignedTo field regardless of the team I am in.
Think all above my experiments will help someone in some way.

If there is  a way to say <LISTITEM value="[project]\<TheCurrentTeam>" /> which would be wonderful to have I think.