agentleFS
stevemarksavastevemarksava/superteam/skills/azure-devops/SKILL.md

azure-devops

Skill1 starsChanged 2 months agoMITView on GitHub

Azure DevOps end-to-end — repos, YAML pipelines, boards, artifact feeds, secure files, service connections, deployment gates.

12 other projects use a version of this.

Adopted by

Most recently taken up by

The file

We split this skill into the rules it gives an agent

5 rules. 0 are common, 3 are distinctive, and 2 are very specific to this project.

  • 0

    Common

    Most of the 12 edited versions we read keep these.

  • 3

    Distinctive

    This author's own choices. Worth a look.

  • 2

    Very specific

    Tied to their project's names, files or tools. Probably skip.

  • Common
  • Distinctive
  • Very specific
  1. Distinctive:

    Repo setup: Create the repo in the ADO project.

    line 18
  2. Very specific:

    Artifact feeds: Create a project-scoped feed for internal packages (npm, NuGet, Python, Universal).

    line 21
  3. Very specific:

    Deployment gates: Add environment approvals for deploy-test and deploy-prod.

    line 23
  4. Distinctive:

    Every service connection uses Workload Identity Federation when the target supports it — no long-lived secrets

    line 32
  5. Distinctive:

    Every prod deployment has at least one human approval gate — automated-only prod is forbidden

    line 33

“Common” is measured: kept by at least 6 in 10 of the 12 edited versions of this file we could read. “Very specific” is our guess from the words: it names a file, a command, a setting or the project itself.

Keep what fits and drop the rest. Your version, ready for your agents.
Files
SKILL.md

/azure-devops — Delivery Infrastructure on Azure DevOps

Azure DevOps is the delivery plumbing under most Avanade Fabric and Azure engagements. This skill stands up the repo, pipelines, boards, artifacts, and secure secrets story cleanly on day one, so nothing gets bolted on later.

When to invoke

  • New Fabric or Azure engagement kicking off with an ADO project
  • Orbit is designing CI/CD for a repo before code lands
  • Deployment gates or approvals need to be added to a promotion path
  • Service connections or secure files need to be provisioned or audited

Steps

  1. Repo setup. Create the repo in the ADO project. Set default branch to main, require pull requests, require linked work item on PR, require at least one reviewer, require build validation. Enable branch policies before first push.
  2. YAML pipelines. Author azure-pipelines.yml at repo root. Define stages: build → test → deploy-dev → deploy-test → deploy-prod. Use templates (extends: template:) to share stages across repos. Pin agent pool and image versions — never use windows-latest in production.
  3. Boards and work items. Choose the process (Agile / Scrum / Basic / CMMI). Configure area paths and iterations. Wire work-item auto-linking on PR completion. States must reflect the team's actual workflow — do not accept defaults blindly.
  4. Artifact feeds. Create a project-scoped feed for internal packages (npm, NuGet, Python, Universal). Set upstream sources for public registries. Consumer pipelines authenticate via the built-in System.AccessToken.
  5. Secure files and service connections. Store certificates and other sensitive files in Library → Secure files. Service connections (Azure RM, GitHub, ACR, Kubernetes) use Workload Identity Federation (OIDC) — verify current guidance at author time. Never use long-lived secrets when federation is available.
  6. Deployment gates. Add environment approvals for deploy-test and deploy-prod. Add automated gates (query Azure Monitor, invoke REST, Azure Function) where policy requires. Approvers are Entra groups, not individuals.

Deliverable format

  • azure-pipelines.yml — root pipeline plus shared templates under pipelines/templates/
  • docs/branch-policies.md — screenshot or note of enforced policies per branch
  • docs/service-connections.md — list of connections with scope and federation type
  • Environment approvals configured and screenshotted

Non-negotiables

  • Every service connection uses Workload Identity Federation when the target supports it — no long-lived secrets
  • Every prod deployment has at least one human approval gate — automated-only prod is forbidden
  • Pipelines pin agent image versions — no floating -latest tags in production
  • Branch policies enforce PR + build validation before merge — no direct pushes to main

References

Download now (ZIP)

Does it work?

Reviews from people and from AI agents that ran it: what they used it for, and whether it worked.

Reviews can't be read right now.

Your trail

Files you open will collect here, so you can find them again.

Open two or more, and you can remix the rules you like from each into one list. Kept in this browser only.

Now do this for your own.

Bring your CLAUDE.md, AGENTS.md or skills. agentleFS shows which of your rules are common, which are yours and which only fit one project, and keeps one version your agents read everywhere.