title: Using Repository Checks in conjunction with Azure Pipelines to ensure that a pipeline within the repository extends a template in a different repo?
body: <p>Let's say I have two repositories defined:</p>
  <ul>
  <li><code>code</code></li>
  <li><code>templates</code></li>
  </ul>
  <p>In <code>code</code>, I have my application source code and an Azure Pipelines YAML file, <code>pipeline.yml</code>.</p>
  <p>In <code>templates</code>, I have an Azure Pipelines YAML file, <code>template.yml</code>.</p>
  <p>I want to set up a check at the <code>code</code> repository level to ensure that <strong>all</strong> pipelines within this repository extend <code>template.yml@templates</code>.</p>
  <p>This feature <em>theoretically</em> exists.
  I have it configured as follows:</p>
  <p><code>pipeline.yml</code> in <code>code</code> repo:</p>
  <pre><code>resources:
      repositories:
          - repository: templates
            name: templates
            type: git
  
  extends:
      template: pipeline-template.yml@templates  
  
       
  </code></pre>
  <p><code>pipeline-template.yml</code> in <code>templates</code> repo:</p>
  <pre><code>trigger: none
  
  stages:
  - stage: Build
    jobs:
    - job: Build
      steps:
      - checkout: self
      - script: echo Hello World
  </code></pre>
  <p>On the <code>code</code> repository, I have the template extension check configured as follows:
  <a href="https://i.stack.imgur.com/bsFLW.png" rel="nofollow noreferrer"><img src="https://i.stack.imgur.com/bsFLW.png" alt="template check" /></a></p>
  <p>My expectation, given this setup, is that when I run the pipeline, it fails because the pipeline does not extend an imaginary template named <code>xxxxxxx.yml</code>. However, the pipeline happily ignores the check and runs.</p>
  <p>If I add an explicit <code>repository</code> resource for <code>code</code> to the template and explicitly check it out, the repository check fires as expected. However, this is <strong>completely useless</strong>, because it requires me to extend the template for the template check to function -- if I remove the <code>extends</code>, my pipeline runs, which defeats the purpose of having a required template.</p>
  <p>It seems like there are two pre-requisites for this feature to work:</p>
  <ol>
  <li>The pipeline must define a <code>resource</code> definition for the protected repository</li>
  <li>The pipeline must explicitly have a <code>checkout</code> step for that repository.</li>
  </ol>
  <p>I can't understand how this is correct behavior. If I have a repository protected, and a pipeline runs within that repository, shouldn't the repository check apply to the pipeline?</p>
  <ol>
  <li>Am I somehow misconfiguring this feature, and if so, how to configure it to enable the scenario I described?</li>
  <li>Am I wildly misunderstanding the purpose of this feature?</li>
  <li>Is this feature is poorly implemented and/or has a known issue of which I am unaware?</li>
  </ol>