Fase 4 del pipeline azure-app-onboard: ejecuta la IaC validada contra Azure y verifica la salud de los recursos desplegados. No es invocable directamente.
en todo el repo
0–100, la ruta de este skill
último commit aquí
últimos 90 días
39 tok en reposo
84 KB
Funciona con cualquier agente que lea SKILL.md
npx -y skills add microsoft/azure-skills --skill deploy --agent claude-codeSe instala solo en este repositorio.
| Property | Value |
|---|---|
| Best for | Executing validated IaC against Azure, health-checking deployed resources |
| Inputs | prepare-plan.json + scaffold-manifest.json from .copilot-azure/sessions/{id}/ |
| Outputs | deploy-result.json written to session directory |
| Parent | azure-app-onboard |
Invoked by the azure-app-onboard orchestrator at Phase 4 when scaffold-manifest.json exists with files[] and validationResult. Not directly user-routable.
Return to orchestrator: When complete, return control to
azure-app-onboardfor handoff (Step 10). Do NOT start new phases.
| Scenario | Use Instead |
|---|---|
| Plan architecture, map services, estimate costs | prepare |
| Generate IaC files from a plan | azure-app-onboard Step 7 (scaffold) |
Run azd up or execute existing deployment templates |
azure-deploy |
| Debug a running app after deployment | azure-diagnostics |
| Optimize existing Azure spending | azure-cost |
⛔ Sub-agent delegation is MANDATORY for Step 0. Read
subagent-preflight.md, then dispatch as ataskwith the COMPLETE and UNMODIFIED template text between<<<TEMPLATE_START>>>/<<<TEMPLATE_END>>>delimiters. Do NOT summarize or rewrite the template — the sub-agent needs every "Read [file]" instruction to produce a correctdeploy-checklist.md. Append session artifact data AFTER the template block. If your next action after reading the template is anything other thantask, you are executing it inline instead of delegating.
⛔ Healing loop: ask user after 3 attempts, then every 5 (counter =
healingAttempts[].length).
⛔ Region lock: Before
az deploymentretry, compare--locationagainstprepare-plan.json.deploymentVariables.location. If changed → re-approval gate required. Update plan after approval.
⛔ After compaction or any
az deployment/az webapp deploy/az acr build/failed health check: re-readdeploy-checklist.md. If missing → fill fromdeploy-checklist-template.md. On significant context loss: also re-read this SKILL.md.
| # | Step | Action | Artifact | Reference |
|---|---|---|---|---|
| 0 | Dispatch preflight sub-agent | ⛔ You MUST dispatch subagent-preflight.md as a task. ⛔ agent_type: "task" — NEVER "general-purpose". Read the template, then your NEXT action MUST be task. If after reading the template your next action is powershell, view, or anything other than task, STOP — you are executing inline instead of delegating. Writes deploy-checklist.md. view it immediately after return. |
deploy-checklist.md |
⛔ You MUST read subagent-preflight.md |
| 1 | Read upstream artifacts | Load prepare-plan.json + scaffold-manifest.json. Check validationResult. Resolve subscription + deployment variables. |
— | — |
| 3 | Preflight checks | Auth, mandatory what-if preview, RBAC, RG per deploy-checklist.md § Preflight. |
— | ⛔ You MUST read deploy-checklist.md (re-read if compaction occurred) |
| 4 | Deploy approval gate | Present cost + resource summary per deploy-checklist.md § Deploy approval gate format. |
— | — |
| 5b | Write deploy-result.json skeleton | ⛔ Read deploy-schemas.ts, write skeleton (status: "in-progress"). Must exist BEFORE first az command. |
deploy-result.json |
⛔ You MUST read deploy-schemas.ts |
| 6 | Execute deployment | ⛔ BEFORE az deployment sub create: Generate portal link — $dn="{deploymentName}"; $r="/subscriptions/{subId}/providers/Microsoft.Resources/deployments/$dn"; $l="https://portal.azure.com/#view/Microsoft_Azure_Resources/DeploymentDetails.MenuView/~/overview/id/$($r.Replace('/','%2F'))"; Write-Output "LINK=$l". ⛔ Auto-open link in browser: Start-Process $l 2>$null. Print bare URL in chat (ctrl-clickable).Auto-generate ALL @secure() params (openssl rand -base64 32 | tr -d '/+='), NEVER ask_user for passwords; on retry reuse from deploy-secrets.env or Key Vault — NEVER regenerate (see deploy-safety.md § Deploy Checklist). THEN deploy IaC. |
— | ⛔ You MUST read deploy-checklist.md § Execute deployment |
| 6b | Deploy application code | ⛔ Deploy code for EVERY service in prepare-plan.json.services[]. Follow deploy-checklist.md § Code deploy. |
— | ⛔ You MUST read deploy-checklist.md § Code deploy |
| 7 | Health-check + SCM re-disable | HTTP GET per endpoint (max 3 iterations). ⛔ Multi-service apps: Also inspect the response body for error patterns (connection refused, MODULE_NOT_FOUND, localhost, SET-IN-DEPLOY-PHASE) — HTTP 200 alone does not mean functional when the app depends on another service or KV secrets. Then ⛔ for EVERY App Service/Functions app run BOTH commands — no exceptions: az rest --method put --url "/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Web/sites/{app}/basicPublishingCredentialsPolicies/scm?api-version=2023-12-01" --headers "Content-Type=application/json" --body '{"properties":{"allow":false}}' then verify: az rest --method get --url "/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Web/sites/{app}/basicPublishingCredentialsPolicies/scm?api-version=2023-12-01" --query properties.allow -o tsv (must return false). |
deploy-result.json full |
⛔ You MUST read deploy-checklist.md § Health check |
| 8 | Finalize artifacts | ⛔ Read deploy-schemas.ts. ⛔ Re-read deploy-checklist.md § Artifact verification — follow ALL 5 checks. ⛔ No "live"/handoff message until you overwrite the skeleton deploy-result.json — flip status off "in-progress" (→ succeeded/failed) and fill healthStatus, endpoints, completedUtc, deploymentNames, healingAttempts. Write deployment-summary.md (status table + health + portal link(s) + cleanup commands — same content as your handoff message). Update context.json — add "deploy" to completedPhases, currentPhase: null, lastModifiedUtc. Read back to confirm status != "in-progress" and "deploy" ∈ completedPhases. ⛔ Then STOP — return to orchestrator. No further CLI commands. |
deploy-result.json final + deployment-summary.md + context.json update |
⛔ You MUST read deploy-schemas.ts + ⛔ Re-read deploy-checklist.md § Artifact verification |
| 9 | Error handling + healing | ⛔ Only if Steps 6/6b/7 returned nonzero exit code or health check failed. Skip entirely on clean deploys. Classify errors, healing loop, PLAN_LEVEL_CHANGE re-approval per deploy-checklist.md § During healing. ⛔ Even on unrecoverable failure: write deploy-result.json with status: "failed" and errorDetails before returning to orchestrator — the artifact must always exist. |
— | ⛔ You MUST read error-classification.md |
Reproducido de microsoft/azure-skills bajo licencia MIT. Leer esta página en markdown.
16 archivos en el paquete. Solo se lee SKILL.md al activarse — las referencias se cargan si el skill decide que las necesita.
Requiere `prepare-plan.json` y `scaffold-manifest.json` en el directorio de sesión. No tiene frontmatter propio: es un sub-skill del pipeline.
Este repo incluye 41 skills. Si instalas uno, normalmente ya tienes los demás.
Despliega, evalúa, ajusta y gestiona agentes de Foundry de punta a punta con azd: agentes hospedados, evaluación por lotes y continua, optimizador de prompts y fine-tuning (SFT/DPO/RFT).
Prepara proyectos Azure basados en azd para desplegar: genera azure.yaml, la infraestructura (Bicep o Terraform) y los Dockerfiles del flujo del Azure Developer CLI.
Depura incidencias de producción en Azure con AppLens, Azure Monitor, resource health y triaje seguro. Cubre App Service, Container Apps, Functions, AKS, VMs y mensajería.
Validación previa al despliegue en Azure. Comprueba en profundidad la configuración, la infraestructura (Bicep o Terraform), los roles RBAC, los permisos de identidad administrada y los prerrequisitos.
Skill unificado de despliegue de modelos de Azure OpenAI con enrutado por intención: despliegues rápidos con preset, despliegues personalizados y descubrimiento de capacidad entre regiones y proyectos.
Orquestador de punta a punta: de una idea o una app existente hasta un despliegue en Azure, con estimación de costes y aprobación previa. Analiza tu app y detecta los servicios adecuados.
Fase 2 del pipeline azure-app-onboard: mapea los componentes de la app a servicios de Azure con estimación de costes y validación de cuota. No es invocable directamente.
Despliega una app web o API existente en un clúster AKS ya en marcha: detecta el framework, genera Dockerfile y manifiestos, valida contra los Deployment Safeguards y despliega con verificación.
Fase 3 del pipeline azure-app-onboard: genera IaC lista para desplegar desde el plan de arquitectura y la verifica con auto-revisión adversarial, sin desplegar. No es invocable directamente.
