ERROR: 'annotate' is misspelled or not recognized by the system.

[escherstair]

I use a DockerCLI@2 task in my Azure DevOps pipeline (MS Hosted ubuntu-latest), with the following content

          - task: AzureCLI@2
            displayName: "Annotate image with dummy words"
            condition: succeeded()  # push ok
            inputs:
              azureSubscription: $(azureResourceManagerServiceConnection)  # Service Connection which uses Azure Resource Manager App with AcrDelete and AcrPull rights over ACR
              scriptType: bash
              scriptLocation: inlineScript
              inlineScript: |
                export ACR_EXPERIMENTAL_ANNOTATE=true
                az acr annotate \
                  --registry $(acrName) \
                  --filter "$(containerName):$(tag)" \
                  --annotation "vnd.myorganization.image.end-of-life=2026-12-31T00:00:00Z" 

but I get the error

ERROR: 'annotate' is misspelled or not recognized by the system.

Where is my mistake?

[balcsida]

I don't think the annotate command is exposed to the end user, but I might remember incorrectly

[escherstair]

Hi @balcsida
I found this PR #266 and this issue #336 and so I thought it was available to the end user.

Is this only for internal purposes?

[estebanreyl]

The command is a part of the acr cli and only meant for internal use. That said it should work. The problem in this case is that you are trying to use the script from the az cli which this command is not meant to run as a part of as far as I know. In order to get this to run you would use a task, the docker image directly or the binary directly so for example:

az acr task create
--registry "${REGISTRY_NAME}"
--name "${TASK_ANNOTATE_NAME}"
--cmd "-e ACR_EXPERIMENTAL_ANNOTATE=true mcr.microsoft.com/acr/acr-cli:0.19 annotate
--registry ${LOGIN_SERVER}
--filter '${REPO_NAME}:.*'
--artifact-type 'application/vnd.microsoft.artifact.lifecycle'
--annotations 'vnd.myorganization.image.end-of-life=2026-12-31T00:00:00Z'
--dry-run"
--context /dev/null
--assign-identity "${IDENTITY_RESOURCE_ID}"
--source-acr-auth-id "${IDENTITY_RESOURCE_ID}"
--output none