Does Azure DevOps have a way to replace files in a ZIP artifact during release pipe?

Presently we have an Azure DevOps project that builds a ZIP package and stores it as the artifact. We are then performing XML/JSON transformations (as part of a Release pipe, utilizing pipeline variables) prior to copying the ZIP artifact to an archival location. And all of this works fine, however...

This list of pipeline variables is increasing to an unmanageable level, as we build more packages for various environments for various clients. Is there any way to copy whole files from the secure file library into the ZIP in a similar fashion to how XML/JSON transformations are done?

So far I have not found a good way. The Download Secure File task doesn't have any options to specify the destination of said file, and the Copy Files To task doesn't work on the ZIP directly. It appears I will need to extract the artifact to a temporary location, download each library file one by one, copy the entire set of library files over from .secureFilePath to the temporary location of the unzipped artifact, then rezip the entire folder into an archive with the same name as the previous artifact, before then archiving it to the proper location (is there no better way?).

We want to keep with the notion of one build, multiple configurations. As our deployments are done behind client firewalls, and we normally provide them access to a secure FTP to download the packages (which they deploy themselves). So keeping them singular fully contained ZIPs is something we wish to continue to do.

Is there any way to copy whole files from the secure file library into the ZIP in a similar fashion to how XML/JSON transformations are done?

You can use a script task in your pipeline that uses the ZIP command-line 7z add. 7-Zip is pre-configured on Microsoft-hosted agents. This would allow you to add/replace files to an existing ZIP archive directly and you will not need to extract and rezip the files.

For example:

- script: |
    7z a $(Build.SourcesDirectory)/1.zip $(taskname.secureFilePath)/*.JSON
  displayName: 'Add JSON files to ZIP'

Test result: