I would like to share with you my last struggle with TFS. I received a call from a colleague about some problem with the ‘new’ TFS build. Initially I tough it is only a miss-configuration and that the solution will be trivial, but as you can imagine, it wasn’t.
The problem lied in the fact that build agent couldn’t retrieve the sources and the error message was not treated as such. You could only see logged a (workspace version -1) inside the Get Sources step, after stating that syncing the repository was done.
As a first thing, I tough about agent not having sufficient rights to retrieve the source code. After a quick check and making sure that the agent service user has sufficient rights to retrieve the code, I run my build again and I got the same result. Didn’t helped.
Next thing I checked all sort of settings, running the build on a different build agent on different server, running the agent under different account, making sure that permissions for the _work folder are setup correctly, all sort of things. I ended up realizing that if I moved the code from that Team project to another team project, suddenly my build agent was able to retrieve the code again. There where two things, or the project was corrupted or there where some security issues. Thanks to the Microsoft support assistance, I managed to get to the right solution. And guess what? It was a security issue.
For an unknown reason the permission inheritance was disabled on the folder that contained all of the interested branches.
By enabling this setting, I saw that there is a small change in the way build agents are authenticated against TFVC. XAML build agent identifies itself with the user that agent runs under. 2015 build agent in the other hand, uses a Project Collection Build Service group to do so. It is added automatically to the source code permissions tree, and in order to propagate it needs to have the permission inheritance switched on or you need to manually set rights for that user group.
Same goes for the owner of the local workspace created by the agent.
You can change those settings by editing the security for a give item in the source control.
Once this is done, you should see your build agent syncing the sources correctly.
Thanks Mario. This blog post helped me out with a client today. Appreciate you sharing what you found.
We have researched this a bit and found the Project Collection Build Service “user account” was not included in the security permissions of the branch we are trying to build. Once we added this user to the security permissions. We were able to get latest without the -1 message.
I am still researching why this user needs to be apart of the security permissions.
Hi Adam, that’s exactly what I do mention in the post. Also in yesterdays post on MSDN ALM Blog (http://blogs.msdn.com/b/visualstudioalm/archive/2016/01/07/receive-an-error-when-resolving-a-bug-created-by-your-build.aspx) they do mention the same: new build system uses a service account. That service account should be automatically inherited, and in case the inheritance is set to off, it doesn’t happen. You can have inheritance set to off and still make it work by manually adding the above mentioned account and granting the necessary rights.
Adam, did you ever find an answer on why this user needs permission to source control folders? Can we replace this account with our own service account?
Hi Mario,
Thanks for sharing this. I ran into the same problem when migrating code and builds from one TFS project to another.
Saves me from bothering you at work 🙂
Cheers,
Geert-Jan
Google rules! (as a similar thing was also on SharePoint) 🙂
How do I change the Project Collection Build Service account to our own in-house service account?
Thanks a lot Mario. You really saved my day
Thanks Mario. Saved a lot of time.
[…] some time searching in the web I found a blog post where author faced the problem with TFS 2015 build […]