How to transform Web.Config using variables instead of XML transform at deployment?

Question

We currently have the following Web.Release.config file that transforms Web.config at deployment time.

<?xml version="1.0"?>
<configuration xmlns:xdt="http://schemas.microsoft.com/XML-Document-Transform">
  <system.web>
    <compilation xdt:Transform="RemoveAttributes(debug)" />
  </system.web>
  <elmah>
    <errorLog xdt:Transform="Remove" />
    <errorMail xdt:Transform="Remove" />
    <errorMail xdt:Transform="Insert" from="[email protected]" to="[email protected]" subject="Dashboard Error" async="true" smtpPort="587" smtpServer="smtp.sendgrid.net" userName="apikey" password="password123" />
  </elmah>
</configuration>

As you can see, the config file contains sensitive information like password.

The pipeline artifact contains Scripts, Content, Bundles, and most relevant to this question the Web.Debug.config, Web.Release.config and Web.config:

When the artifact is published, the release pipeline triggers the Azure App Service task deployment:

steps:
- task: AzureRmWebAppDeployment@4
  displayName: 'Deploy Azure App Service'
  inputs:
    azureSubscription: '$(Parameters.ConnectedServiceName)'
    appType: '$(Parameters.WebAppKind)'
    WebAppName: '$(Parameters.WebAppName)'
    enableCustomDeployment: true
    TakeAppOfflineFlag: false
    RenameFilesFlag: false
    enableXmlTransform: true

Instead of the XML transformation being the one to change the attributes like password, or even to email attribute, we would like to store those as variables, possibly in the release pipeline (maybe create an elmah group containing these attributes/values) and use that such variables to transform the Web.config file. Of course, we still would want other XML transform settings to occur, such as the <system.web>, but we want attributes like those in <elmah> to be transformed using variables instead of the XML file.

How can we accomplish this? I know how to create the variables, but I am not sure how or if its even possible to transform the Web.config file using variables instead of the Web.Debug.config or Web.Release.config

Is there a setting/task that can do this?

Answer 1

I am not sure how or if its even possible to transform the Web.config file using variables instead of the Web.Debug.config or Web.Release.config

We could install the extension Replace Tokens, add variable and set the variable to secret then add the task Replace Tokens to replace the web.configure variable and use it in the Azure DevOps pipeline.

Update1

Open .csproj file and add the field <CopyToOutputDirectory>Never</CopyToOutputDirectory>, it will not copy the Web.Release.config file.

<None Include="Web.Release.config">
      <DependentUpon>Web.Release.config</DependentUpon>
      <CopyToOutputDirectory>Never</CopyToOutputDirectory>
    </None>