在任务中添加一个步骤，使用AWS CLI以编程方式启用标签不可变性。下面是一个示例任务：

- task: ECRPushImage@1
  displayName: 'Push image to ECR'
  inputs:
    imageName: 'my-image'
    awsCredentials: 'my-aws-creds'
    awsRegion: 'us-west-2'
    createRepository: true
    tags: |
      latest
    additionalImageTags: '$(Build.SourceVersion)-$(Build.BuildNumber)'
  env:
    AWS_REGION: 'us-west-2'
  condition: succeeded()

要启用标签不可变性，请添加另一个步骤，使用AWS CLI调用以下命令：

aws ecr put-image-tag-mutability --repository-name my-repo --image-tag-mutability IMMUTABLE

请确保替换上面的示例中的my-repo以匹配您的ECR存储库名称。此任务的完整示例代码如下：

- task: ECRPushImage@1
  displayName: 'Push image to ECR'
  inputs:
    imageName: 'my-image'
    awsCredentials: 'my-aws-creds'
    awsRegion: 'us-west-2'
    createRepository: true
    tags: |
      latest
    additionalImageTags: '$(Build.SourceVersion)-$(Build.BuildNumber)'
  env:
    AWS_REGION: 'us-west-2'
  condition: succeeded()

- script: |
    aws ecr put-image-tag-mutability --repository-name my-repo --image-tag-mutability IMMUTABLE
  displayName: 'Enable tag immutability'
  env:
    AWS_REGION: 'us-west-2'
  condition: always()

此任务将图像推送到ECR并在完成时将标签设置为不可变性。