Azure Devops

---
name: azure-devops
description: "Covers Azure DevOps Services and Server: Azure Pipelines (YAML and classic), Azure Repos, Azure Boards, Azure Artifacts, service connections, variable groups, environments, and deployment gates. WHEN: \"Azure DevOps\", \"Azure Pipelines\", \"azure-pipelines.yml\", \"ADO\", \"Azure Boards\", \"Azure Repos\", \"Azure Artifacts\", \"service connection\", \"variable group\", \"YAML pipeline\", \"classic pipeline\"."
license: MIT
---

# Azure DevOps Expert

This skill covers Azure DevOps — both Azure DevOps Services (cloud) and Azure DevOps Server (on-premises). Azure DevOps is Microsoft's integrated DevOps platform providing Boards, Repos, Pipelines, Test Plans, and Artifacts. Configuration is primarily via `azure-pipelines.yml` for YAML pipelines.

## How to Approach Tasks

1. **Classify** the request:
   - **Troubleshooting** -- Load `references/diagnostics.md` for pipeline failures, agent issues, service connection errors
   - **Architecture** -- Load `references/architecture.md` for pipeline internals, agent pools, service connections, YAML schema
   - **Best practices** -- Load `references/best-practices.md` for pipeline design, security, templates, and multi-stage deployments

2. **Load context** -- Read the relevant reference file.

3. **Analyze** -- Apply Azure DevOps-specific reasoning. Consider YAML vs classic pipelines, agent pool type, service connection method.

4. **Recommend** -- Provide `azure-pipelines.yml` examples with explanations.

5. **Verify** -- Suggest validation steps (pipeline validation UI, test runs, deployment approvals).

## Core Concepts

### YAML Pipeline Structure

```yaml
# azure-pipelines.yml
trigger:
  branches:
    include:
      - main
  paths:
    exclude:
      - docs/**

pool:
  vmImage: 'ubuntu-latest'

variables:
  - group: production-vars    # Variable group
  - name: buildConfiguration
    value: 'Release'

stages:
  - stage: Build
    jobs:
      - job: BuildJob
        steps:
          - task: NodeTool@0
            inputs:
              versionSpec: '22.x'
          - script: |
              npm ci
              npm run build
            displayName: 'Build application'
          - publish: $(System.DefaultWorkingDirectory)/dist
            artifact: webapp

  - stage: Deploy
    dependsOn: Build
    condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
    jobs:
      - deployment: DeployProd
        environment: production
        strategy:
          runOnce:
            deploy:
              steps:
                - download: current
                  artifact: webapp
                - task: AzureWebApp@1
                  inputs:
                    appName: 'myapp'
                    package: '$(Pipeline.Workspace)/webapp'
```

### Key Concepts

| Concept | Description |
|---|---|
| **Trigger** | When the pipeline runs (push, PR, schedule, manual) |
| **Pool** | Where the pipeline runs (Microsoft-hosted or self-hosted agents) |
| **Stage** | Major division of the pipeline (Build, Test, Deploy) |
| **Job** | A unit of work that runs on a single agent |
| **Deployment Job** | Special job type with environment tracking and deployment strategies |
| **Step** | Individual task, script, or checkout |
| **Task** | Pre-built action from the Marketplace (e.g., `AzureWebApp@1`) |
| **Variable Group** | Shared variables across pipelines (linked to Azure Key Vault) |
| **Service Connection** | Authentication to external services (Azure, AWS, Docker, GitHub) |
| **Environment** | Deployment target with approvals, gates, and history |

### Agent Pools

| Pool Type | Description | Use Case |
|---|---|---|
| **Microsoft-hosted** | Managed VMs, fresh for each job | Default for most workloads |
| **Self-hosted** | Your infrastructure | Private network, custom tools, compliance |
| **VMSS agents** | Azure VM Scale Set auto-scaling | Cost-effective self-hosted at scale |
| **Container agents** | Docker or K8s-based | Lightweight, fast provisioning |

### Triggers

```yaml
# CI trigger (push)
trigger:
  branches:
    include: [main, release/*]
    exclude: [feature/experimental]
  paths:
    include: [src/**]
  tags:
    include: [v*]

# PR trigger
pr:
  branches:
    include: [main]
  paths:
    include: [src/**]

# Scheduled trigger
schedules:
  - cron: '0 2 * * *'
    displayName: 'Nightly build'
    branches:
      include: [main]
    always: false    # Only if code changed

# Manual trigger (no trigger section or use pipeline UI)
trigger: none
```

## Templates and Reuse

### Template Types

```yaml
# templates/build-template.yml
parameters:
  - name: nodeVersion
    type: string
    default: '22'
  - name: buildCommand
    type: string
    default: 'npm run build'

steps:
  - task: NodeTool@0
    inputs:
      versionSpec: '${{ parameters.nodeVersion }}'
  - script: npm ci
    displayName: 'Install dependencies'
  - script: ${{ parameters.buildCommand }}
    displayName: 'Build'
```

```yaml
# azure-pipelines.yml (consuming the template)
stages:
  - stage: Build
    jobs:
      - job: Build
        steps:
          - template: templates/build-template.yml
            parameters:
              nodeVersion: '22'
              buildCommand: 'npm run build:prod'
```

### Template Levels

| Level | What It Templates | Example |
|---|---|---|
| **Step** | Individual steps within a job | Build steps, test steps |
| **Job** | Entire job definition | Build job, test matrix |
| **Stage** | Entire stage with multiple jobs | Deploy stage with approvals |
| **Pipeline** | Full pipeline (extends keyword) | Organization-standard pipeline |

```yaml
# Extend from a template (full pipeline)
resources:
  repositories:
    - repository: templates
      type: git
      name: MyOrg/pipeline-templates

extends:
  template: standard-pipeline.yml@templates
  parameters:
    buildSteps:
      - script: npm run build
```

## Deployment Strategies

```yaml
# Rolling deployment
strategy:
  rolling:
    maxParallel: 2
    deploy:
      steps:
        - script: deploy.sh

# Canary deployment
strategy:
  canary:
    increments: [10, 20, 50]
    deploy:
      steps:
        - script: deploy.sh
    on:
      success:
        steps:
          - script: verify.sh
      failure:
        steps:
          - script: rollback.sh

# RunOnce (simple)
strategy:
  runOnce:
    deploy:
      steps:
        - script: deploy.sh
```

## Environments and Approvals

```yaml
# Pipeline references the environment
- deployment: DeployProd
  environment: production    # Must be configured in Azure DevOps

# Approvals and checks configured in Azure DevOps UI:
# - Manual approval (required reviewers)
# - Business hours gate
# - Azure Monitor alerts gate
# - REST API check
# - Required template
# - Branch control
```

## Service Connections

| Type | Auth Method | Use Case |
|---|---|---|
| **Azure Resource Manager** | Service principal, managed identity, workload identity federation | Deploy to Azure |
| **Docker Registry** | Username/password, service principal | Push/pull container images |
| **GitHub** | PAT, OAuth, GitHub App | Access GitHub repos |
| **Kubernetes** | Kubeconfig, service account | Deploy to K8s |
| **SSH** | Private key | Deploy to Linux servers |
| **Generic** | Username/password, token | Custom integrations |

**Best practice**: Use workload identity federation (OIDC) for Azure service connections — no secrets to manage.

## Reference Files

- `references/architecture.md` — Pipeline processing, agent architecture, YAML schema details, variable scoping, resource management
- `references/best-practices.md` — Template design, security hardening, multi-stage patterns, variable management, migration from classic to YAML
- `references/diagnostics.md` — Pipeline debugging, agent connectivity, service connection errors, template resolution issues, permission problems