Question

Your organization has a single self-hosted agent pool named 'Build' containing 12 agents. Four of these agents have the .NET 8 SDK and a licensed code-signing tool installed; the remaining eight only have the .NET 8 SDK. A YAML pipeline job must run only on the agents that can perform code signing, without creating a separate agent pool. What is the correct approach?

Accepted Answer

Add a user-defined capability (e.g., CodeSign=true) to the four signing agents, then specify a matching 'demands' entry in the job's pool definition.

Answer

Set the job's 'continueOnError' property to true so it retries on agents until it lands on one with the signing tool.

Answer

Add a 'condition' expression on the job that checks for the signing tool path using variables['Agent.OS'].

Answer

Use a matrix strategy with four legs so the job is guaranteed to run on all four signing-capable agents.