← LeaderboardThe Skill Leaderboard

deploy

Skill file .github/plugins/azure-skills/skills/azure-app-onboard/deploy/SKILL.md in microsoft/skills. Read the publisher’s upstream source.

Description is absent from the checked source metadata.

Published by microsoft ↗microsoft/skills

Try your first task

deploy

Start a fresh conversation. Replace the highlighted placeholders.

Use deploy to draft a deploy-phase readiness checklist within azure-app-onboard from [sanitized prepare-plan and scaffold-manifest summaries]. This phase is not directly user-routable: require the parent, completed prior phases, a validated scaffold manifest and explicit deploy approval before execution. Keep mandatory preflight task delegation with the full unmodified template, checklist and schema reads, what-if preview, RBAC checks and the result-skeleton prerequisite before any deployment command. Preserve secret-safe handling, region/plan-change re-approval, bounded healing checkpoints, health evidence and SCM re-disable verification before final artifacts and handoff; do not infer these checks passed. This is paper readiness only, not an in-progress or successful deployment result. Return control to the parent and start no new phase or azure-deploy handoff. Wait for my explicit confirmation before tools, agents, commands, files, accounts, browsers or infrastructure actions.

Required inputs

  • [sanitized prepare-plan and scaffold-manifest summaries]

User-approved starter prompt based on a pinned source version; check current skill requirements before running. Task evidence ↗

SKILL.md

Deploy — IaC Execution & Health Verification

Quick Reference

PropertyValue
Best forExecuting validated IaC against Azure, health-checking deployed resources
Inputsprepare-plan.json + scaffold-manifest.json from .copilot-azure/sessions/{id}/
Outputsdeploy-result.json written to session directory
Parentazure-app-onboard

When to Use This Skill

Invoked by the azure-app-onboard orchestrator at Phase 4 when scaffold-manifest.json exists with files[] and validationResult. Not directly user-routable.

Return to orchestrator: When complete, return control to azure-app-onboard for handoff (Step 10). Do NOT start new phases.

When NOT to Use

ScenarioUse Instead
Plan architecture, map services, estimate costsprepare
Generate IaC files from a planazure-app-onboard Step 7 (scaffold)
Run azd up or execute existing deployment templatesazure-deploy
Debug a running app after deploymentazure-diagnostics
Optimize existing Azure spendingcost-optimization from the optional azure-cost plugin

If cost-optimization is unavailable, explain that it is provided by the optional azure-cost plugin and direct the user to their client's supported plugin installation flow; do not imply the handoff completed.

Workflow

⛔ Sub-agent delegation is MANDATORY for Step 0. Read subagent-preflight.md, then dispatch as a task with the COMPLETE and UNMODIFIED template text between <<<TEMPLATE_START>>> / <<<TEMPLATE_END>>> delimiters. Do NOT summarize or rewrite the template — the sub-agent needs every "Read [file]" instruction to produce a correct deploy-checklist.md. Append session artifact data AFTER the template block. If your next action after reading the template is anything other than task, you are executing it inline instead of delegating.

⛔ Healing loop: ask user after 3 attempts, then every 5 (counter = healingAttempts[].length).

⛔ Region lock: Before az deployment retry, compare --location against prepare-plan.json.deploymentVariables.location. If changed → re-approval gate required. Update plan after approval.

⛔ After compaction or any az deployment/az webapp deploy/az acr build/failed health check: re-read deploy-checklist.md. If missing → fill from deploy-checklist-template.md. On significant context loss: also re-read this SKILL.md.

#StepActionArtifactReference
0Dispatch preflight sub-agent⛔ You MUST dispatch subagent-preflight.md as a task. ⛔ agent_type: "task" — NEVER "general-purpose". Read the template, then your NEXT action MUST be task. If after reading the template your next action is powershell, view, or anything other than task, STOP — you are executing inline instead of delegating. Writes deploy-checklist.md. view it immediately after return.deploy-checklist.md⛔ You MUST read subagent-preflight.md
1Read upstream artifactsLoad prepare-plan.json + scaffold-manifest.json. Check validationResult. Resolve subscription + deployment variables.——
3Preflight checksAuth, mandatory what-if preview, RBAC, RG per deploy-checklist.md § Preflight.—⛔ You MUST read deploy-checklist.md (re-read if compaction occurred)
4Deploy approval gatePresent cost + resource summary per deploy-checklist.md § Deploy approval gate format.——
5bWrite deploy-result.json skeleton⛔ Read deploy-schemas.ts, write skeleton (status: "in-progress"). Must exist BEFORE first az command.deploy-result.json⛔ You MUST read deploy-schemas.ts
6Execute deployment⛔ BEFORE az deployment sub create: Generate portal link — $dn="{deploymentName}"; $r="/subscriptions/{subId}/providers/Microsoft.Resources/deployments/$dn"; $l="https://portal.azure.com/#view/Microsoft_Azure_Resources/DeploymentDetails.MenuView/~/overview/id/$($r.Replace('/','%2F'))"; Write-Output "LINK=$l". ⛔ Auto-open link in browser: Start-Process $l 2>$null. Print bare URL in chat (ctrl-clickable).Auto-generate ALL @secure() params (openssl rand -base64 32 | tr -d '/+='), NEVER ask_user for passwords; on retry reuse from deploy-secrets.env or Key Vault — NEVER regenerate (see deploy-safety.md § Deploy Checklist). THEN deploy IaC.—⛔ You MUST read deploy-checklist.md § Execute deployment
6bDeploy application code⛔ Deploy code for EVERY service in prepare-plan.json.services[]. Follow deploy-checklist.md § Code deploy.—⛔ You MUST read deploy-checklist.md § Code deploy
7Health-check + SCM re-disableHTTP GET per endpoint (max 3 iterations). ⛔ Multi-service apps: Also inspect the response body for error patterns (connection refused, MODULE_NOT_FOUND, localhost, SET-IN-DEPLOY-PHASE) — HTTP 200 alone does not mean functional when the app depends on another service or KV secrets. Then ⛔ for EVERY App Service/Functions app run BOTH commands — no exceptions: az rest --method put --url "/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Web/sites/{app}/basicPublishingCredentialsPolicies/scm?api-version=2023-12-01" --headers "Content-Type=application/json" --body '{"properties":{"allow":false}}' then verify: az rest --method get --url "/subscriptions/{sub}/resourceGroups/{rg}/providers/Microsoft.Web/sites/{app}/basicPublishingCredentialsPolicies/scm?api-version=2023-12-01" --query properties.allow -o tsv (must return false).deploy-result.json full⛔ You MUST read deploy-checklist.md § Health check
8Finalize artifacts⛔ Read deploy-schemas.ts. ⛔ Re-read deploy-checklist.md § Artifact verification — follow ALL 5 checks. ⛔ No "live"/handoff message until you overwrite the skeleton deploy-result.json — flip status off "in-progress" (→ succeeded/failed) and fill healthStatus, endpoints, completedUtc, deploymentNames, healingAttempts. Write deployment-summary.md (status table + health + portal link(s) + cleanup commands — same content as your handoff message). Update context.json — add "deploy" to completedPhases, currentPhase: null, lastModifiedUtc. Read back to confirm status != "in-progress" and "deploy" ∈ completedPhases. ⛔ Then STOP — return to orchestrator. No further CLI commands.deploy-result.json final + deployment-summary.md + context.json update⛔ You MUST read deploy-schemas.ts + ⛔ Re-read deploy-checklist.md § Artifact verification
9Error handling + healing⛔ Only if Steps 6/6b/7 returned nonzero exit code or health check failed. Skip entirely on clean deploys. Classify errors, healing loop, PLAN_LEVEL_CHANGE re-approval per deploy-checklist.md § During healing. ⛔ Even on unrecoverable failure: write deploy-result.json with status: "failed" and errorDetails before returning to orchestrator — the artifact must always exist.—⛔ You MUST read error-classification.md