Build fails after automatic ubuntu-latest image update in Azure DevOps pipeline

Answer

Adopt a strict pinning policy for the Ubuntu image, but update the pinned version on a regular cadence (every 2–4 weeks) after validating that the newer ubuntu‑latest image does not break the build. This gives you reproducibility while still receiving security patches in a controlled way.

Likely explanation vs. confirmed facts

• Likely explanation: The ubuntu‑latest alias resolves to the newest Microsoft‑hosted image at queue time, which can introduce newer runtimes, removed tools, or changed default settings that cause a previously passing build to fail.
• Confirmed fact: Pinning to an explicit version such as ubuntu‑22.04 guarantees the same agent image for every run, eliminating unexpected breakage due to image updates.

Steps to implement

1. Pin the image in your pipeline: replace vmImage: 'ubuntu‑latest' with a specific version, e.g., vmImage: 'ubuntu‑22.04'.
2. Create a side‑by‑side validation pipeline:

   # azure-pipelines.yml snippet for validation
   trigger: none
   schedules:
     - cron: "0 2 * * 0"   # every Sunday at 02:00 UTC
       displayName: Weekly ubuntu‑latest check
       branches:
         include:
           - main
   pool:
     vmImage: 'ubuntu‑latest'
   steps:
     - checkout: self
     - script: |
         echo "Building on ubuntu‑latest..."
         # your build steps here
         # e.g., dotnet build, npm install, etc.
       displayName: Build on ubuntu‑latest
     - script: |
         echo "Capturing artifacts..."
         # produce a checksum or test result file
         sha256sum $(Build.ArtifactStagingDirectory)/**/* > checksum‑latest.txt
       displayName: Capture checksum
     - publish: checksum‑latest.txt
       artifact: checksum‑latest
   

3. Compare results: Run the same build on your pinned image (in your regular CI) and compare the artifact checksums or test outcomes. If they match, the newer ubuntu‑latest is safe to adopt.
4. Update the pinned version: After a successful validation, update the vmImage value in your main pipeline to the newly validated version (e.g., move from ubuntu‑22.04 to ubuntu‑24.04 when it becomes the current ubuntu‑latest). Commit the change and let the regular pipeline pick it up.
5. Automated drift detection (optional): Use a lightweight script that queries the Azure DevOps agent image API to fetch the current ubuntu‑latest tag and logs it alongside your pinned version. Add this script as a scheduled step to raise an alert when the tags diverge.

Missing diagnostic detail

To tailor the validation step, we need to know which specific tool, runtime version, or library caused the failure (e.g., a particular Node.js version, .NET SDK, or removed package). If you can share that detail, we can add a targeted check (like verifying the version of that tool) to the validation pipeline.