Azure DevOps Pipelines

Shared Workflow Routing

• Use the shared workflow spec for deterministic multi-plugin routing: `workflows/multi-plugin-workflows.md`.

Overview

Azure Pipelines provides CI/CD for any language, platform, and cloud. YAML pipelines are the recommended approach — version-controlled, code-reviewed, and template-extensible. Classic release pipelines remain supported for existing deployments but should be migrated to YAML multi-stage pipelines for new projects.

Key concepts: stages group jobs, jobs run on agents, steps execute tasks/scripts. Deployment environments provide approval gates, audit history, and resource targeting. Service connections authenticate to external services using Workload Identity Federation (WIF), managed identity, or service principals.

REST API — Pipelines

REST API — Builds (Classic)

REST API — Releases (Classic)

Note: Release API uses vsrm.dev.azure.com base URL.

REST API — Environments

REST API — Agent Pools

YAML Pipeline Structure

trigger:
  branches:
    include: [main]
  paths:
    include: [src/**]

pool:
  vmImage: 'ubuntu-latest'

stages:
  - stage: Build
    jobs:
      - job: BuildJob
        steps:
          - script: npm ci && npm test
  - stage: Deploy
    dependsOn: Build
    condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
    jobs:
      - deployment: DeployProd
        environment: 'production'
        strategy:
          runOnce:
            deploy:
              steps:
                - script: echo "Deploying"

Key Concepts

• Triggers: CI (branch), PR, scheduled (cron), pipeline completion, manual.
• Templates: extends for mandatory org standards, template for reusable steps/jobs/stages.
• Environments: Named targets with approval gates, exclusive locks, and deployment history.
• Service connections: Authenticated endpoints (Azure, Docker, K8s) — prefer WIF over SP+secret.
• Variable groups: Shared variables linked to Key Vault; authorize per-pipeline.
• Deployment strategies: runOnce, rolling, canary with lifecycle hooks.
• Agent pools: Microsoft-hosted (ubuntu/windows/macos-latest) or self-hosted with custom capabilities.

Best Practices

• Use YAML pipelines over Classic for version control, code review, and template reuse.
• Use extends templates to enforce organization-wide security and compliance.
• Store secrets in variable groups linked to Azure Key Vault — never in YAML.
• Use Workload Identity Federation for service connections — eliminates secret rotation.
• Configure environments with approval checks for production deployments.
• Use path-based triggers to avoid unnecessary pipeline runs.
• Pin task versions (@2 not @latest) to avoid breaking changes.
• Use condition: to skip stages/jobs based on branch, variables, or previous results.

Progressive Disclosure — Reference Files