# Secret pipeline variables are not exported to scripts automatically — the
# env: mapping below is required.
- script: |
    trap 'rm -f server.key' EXIT
    printf '%s\n' "$SFDX_JWT_SECRET_KEY" > server.key
    sf org login jwt --client-id "$SFDX_CONSUMER_KEY" --jwt-key-file server.key --username "$SFDX_USERNAME" --instance-url "${SFDX_INSTANCE_URL:-https://login.salesforce.com}" --alias {{org}} {{setDefaultFlag}}
  displayName: Authenticate to {{org}}
  env:
    SFDX_CONSUMER_KEY: $(SFDX_CONSUMER_KEY)
    SFDX_JWT_SECRET_KEY: $(SFDX_JWT_SECRET_KEY)
    SFDX_USERNAME: $(SFDX_USERNAME)
    SFDX_INSTANCE_URL: $(SFDX_INSTANCE_URL)