azure-deploy
對已準備好並驗證過的 app 執行 Azure 部署，內建錯誤復原
中文翻譯
--- name: azure-deploy description: "對「已經準備好」、且有現成 .azure/deployment-plan.md 和基礎設施檔案的應用程式執行 Azure 部署。使用者要求「建立」新應用程式時不要用這個 skill，改用 azure-prepare。這個 skill 會執行 azd up、azd deploy、terraform apply 和 az deployment 指令，並內建錯誤復原。需要 azure-prepare 產生的 .azure/deployment-plan.md，以及 azure-validate 驗證過的狀態。WHEN: \"run azd up\", \"run azd deploy\", \"execute deployment\", \"push to production\", \"push to cloud\", \"go live\", \"ship it\", \"bicep deploy\", \"terraform apply\", \"publish to Azure\", \"launch on Azure\". DO NOT USE WHEN: \"create and deploy\", \"build and deploy\", \"create a new app\", \"set up infrastructure\", \"create and deploy to Azure using Terraform\"，這些情況改用 azure-prepare。" license: MIT metadata: author: Microsoft version: "1.2.2" --- # Azure Deploy > **權威指引：必須遵守** > > **前置條件**：執行這個 skill 之前，**必須**已經呼叫 **azure-validate** skill，並且完成、狀態為 `Validated`。 > **⛔ 停：必須先檢查前置條件** > 繼續之前，確認兩個前置條件都滿足： > > 1. **azure-prepare** 已呼叫並完成 → `.azure/deployment-plan.md` 存在 > 2. **azure-validate** 已呼叫並通過 → plan 狀態 = `Validated` > > 只要缺任何一個，**立刻停下來**： > - 沒有 plan？ → 先呼叫 **azure-prepare** skill > - 狀態不是 `Validated`？ → 先呼叫 **azure-validate** skill > > **⛔ 不准手動更新 plan 狀態** > > **禁止**你自己把 plan 狀態改成 `Validated`。只有 **azure-validate** skill 在跑過實際的驗證檢查之後，才有權設定這個狀態。沒跑驗證就改狀態，部署一定會失敗。 > > **不准假設**app 已經準備好。**不准跳過**驗證來省時間。跳步驟會造成部署失敗。完整流程才能確保成功： > > `azure-prepare` → `azure-validate` → `azure-deploy` ## 觸發條件 使用者想做下面這些事時啟用這個 skill： - 對已經準備好的應用程式執行部署（azure.yaml 和 infra/ 都已存在） - 把更新推到現有的 Azure 部署 - 在已準備好的專案上執行 `azd up`、`azd deploy` 或 `az deployment` - 把已經建置好的程式碼上線到正式環境 - 部署一個已包含 API Management (APIM) gateway 基礎設施的應用程式 > **範圍**：這個 skill 負責執行部署，不負責建立應用程式、產生基礎設施程式碼或建立專案骨架。這些事請用 **azure-prepare**。 > **APIM / AI Gateway**：這個 skill 用來部署那些 APIM/AI gateway 基礎設施已在 **azure-prepare** 階段建好的應用程式。要建立或修改 APIM 資源，請看 [APIM 部署指南](https://learn.microsoft.com/azure/api-management/get-started-create-service-instance)。AI 治理 policy 的部分，呼叫 **azure-aigateway** skill。 ## 規則 1. 在 azure-prepare 和 azure-validate 之後執行 2. `.azure/deployment-plan.md` 必須存在，且狀態為 `Validated` 3. **必須做部署前檢查清單**：[Pre-Deploy Checklist](references/pre-deploy-checklist.md) 4. ⛔ **破壞性動作必須先 `ask_user`**：[global-rules](references/global-rules.md) 5. **範圍：只負責執行部署**：這個 skill 擁有 `azd up`、`azd deploy`、`terraform apply` 和 `az deployment` 指令的執行權。這些指令都要經過這個 skill 的錯誤復原和驗證流程。 --- ## 步驟 | # | 動作 | 參考 | |---|--------|-----------| | 1 | **檢查 Plan**：讀 `.azure/deployment-plan.md`，確認狀態 = `Validated` 而且 **Validation Proof** 區段有內容 | `.azure/deployment-plan.md` | | 2 | **部署前檢查清單**：每一步都必須完成 | [Pre-Deploy Checklist](references/pre-deploy-checklist.md) | | 3 | **載入 Recipe**：依 `.azure/deployment-plan.md` 裡的 `recipe.type` 決定 | [recipes/README.md](references/recipes/README.md) | | 4 | **RBAC 健康檢查**：對使用 managed identity 的 Container Apps + ACR，先跑 `azd provision --no-prompt`，再確認 `AcrPull` 角色已經生效，才能繼續（見檢查清單） | [Pre-Deploy Checklist — Container Apps RBAC](references/pre-deploy-checklist.md#container-apps--acr--pre-deploy-rbac-health-check) | | 5 | **執行部署**：照 recipe 的步驟做 | Recipe README | | 6 | **部署後**：設定 SQL managed identity，適用的話再套用 EF migration | [Post-Deployment](references/recipes/azd/post-deployment.md) | | 7 | **處理錯誤**：看 recipe 的 `errors.md` | — | | 8 | **確認成功**：確認部署完成，endpoint 也連得到 | [Verification](references/recipes/azd/verify.md) | | 9 | **即時角色驗證**：查詢 Azure，確認佈建出來的 RBAC 角色正確而且夠用 | [live-role-verification.md](references/live-role-verification.md) | | 10 | **回報結果**：把部署好的 endpoint URL 用完整的 `https://` 連結呈現給使用者 | [Verification](references/recipes/azd/verify.md) | > **⛔ URL 格式規則** > > 呈現 endpoint URL 給使用者時，**一定要**用帶 `https://` scheme 的完整 URL（例如 `https://myapp.azurewebsites.net`，不是 `myapp.azurewebsites.net`）。很多 Azure CLI 指令只回傳沒有 scheme 的 hostname，呈現之前一律先補上 `https://`。 > **⛔ 驗證證明檢查** > > 檢查 plan 時，確認 **Validation Proof** 區段（第 7 節）裡有實際的驗證結果，包含執行過的指令和時間戳記。如果這個區段是空的，代表驗證被跳過了，要先呼叫 **azure-validate** skill。 ## SDK 快速參考 - **Azure Developer CLI**：[azd](references/sdk/azd-deployment.md) - **Azure Identity**：[Python](references/sdk/azure-identity-py.md) | [.NET](references/sdk/azure-identity-dotnet.md) | [TypeScript](references/sdk/azure-identity-ts.md) | [Java](references/sdk/azure-identity-java.md) ## MCP 工具 | 工具 | 用途 | |------|---------| | `mcp_azure_mcp_subscription_list` | 列出可用的訂閱 | | `mcp_azure_mcp_group_list` | 列出訂閱中的資源群組 | | `mcp_azure_mcp_azd` | 執行 AZD 指令 | | `azure__role` | 列出角色指派，用於即時 RBAC 驗證（步驟 9） | ## 參考 - [Troubleshooting](references/troubleshooting.md)：常見問題和解法 - [Post-Deployment Steps](references/recipes/azd/post-deployment.md)：SQL + EF Core 設定
英文原文
--- name: azure-deploy description: "Execute Azure deployments for ALREADY-PREPARED applications that have existing .azure/deployment-plan.md and infrastructure files. DO NOT use this skill when the user asks to CREATE a new application — use azure-prepare instead. This skill runs azd up, azd deploy, terraform apply, and az deployment commands with built-in error recovery. Requires .azure/deployment-plan.md from azure-prepare and validated status from azure-validate. WHEN: \"run azd up\", \"run azd deploy\", \"execute deployment\", \"push to production\", \"push to cloud\", \"go live\", \"ship it\", \"bicep deploy\", \"terraform apply\", \"publish to Azure\", \"launch on Azure\". DO NOT USE WHEN: \"create and deploy\", \"build and deploy\", \"create a new app\", \"set up infrastructure\", \"create and deploy to Azure using Terraform\" — use azure-prepare for these." license: MIT metadata: author: Microsoft version: "1.2.2" --- # Azure Deploy > **AUTHORITATIVE GUIDANCE — MANDATORY COMPLIANCE** > > **PREREQUISITE**: The **azure-validate** skill **MUST** be invoked and completed with status `Validated` BEFORE executing this skill. > **⛔ STOP — PREREQUISITE CHECK REQUIRED** > Before proceeding, verify BOTH prerequisites are met: > > 1. **azure-prepare** was invoked and completed → `.azure/deployment-plan.md` exists > 2. **azure-validate** was invoked and passed → plan status = `Validated` > > If EITHER is missing, **STOP IMMEDIATELY**: > - No plan? → Invoke **azure-prepare** skill first > - Status not `Validated`? → Invoke **azure-validate** skill first > > **⛔ DO NOT MANUALLY UPDATE THE PLAN STATUS** > > You are **FORBIDDEN** from changing the plan status to `Validated` yourself. Only the **azure-validate** skill is authorized to set this status after running actual validation checks. If you update the status without running validation, deployments will fail. > > **DO NOT ASSUME** the app is ready. **DO NOT SKIP** validation to save time. Skipping steps causes deployment failures. The complete workflow ensures success: > > `azure-prepare` → `azure-validate` → `azure-deploy` ## Triggers Activate this skill when user wants to: - Execute deployment of an already-prepared application (azure.yaml and infra/ exist) - Push updates to an existing Azure deployment - Run `azd up`, `azd deploy`, or `az deployment` on a prepared project - Ship already-built code to production - Deploy an application that already includes API Management (APIM) gateway infrastructure > **Scope**: This skill executes deployments. It does not create applications, generate infrastructure code, or scaffold projects. For those tasks, use **azure-prepare**. > **APIM / AI Gateway**: Use this skill to deploy applications whose APIM/AI gateway infrastructure was already created during **azure-prepare**. For creating or changing APIM resources, see [APIM deployment guide](https://learn.microsoft.com/azure/api-management/get-started-create-service-instance). For AI governance policies, invoke **azure-aigateway** skill. ## Rules 1. Run after azure-prepare and azure-validate 2. `.azure/deployment-plan.md` must exist with status `Validated` 3. **Pre-deploy checklist required** — [Pre-Deploy Checklist](references/pre-deploy-checklist.md) 4. ⛔ **Destructive actions require `ask_user`** — [global-rules](references/global-rules.md) 5. **Scope: deployment execution only** — This skill owns execution of `azd up`, `azd deploy`, `terraform apply`, and `az deployment` commands. These commands are run through this skill's error recovery and verification pipeline. --- ## Steps | # | Action | Reference | |---|--------|-----------| | 1 | **Check Plan** — Read `.azure/deployment-plan.md`, verify status = `Validated` AND **Validation Proof** section is populated | `.azure/deployment-plan.md` | | 2 | **Pre-Deploy Checklist** — MUST complete ALL steps | [Pre-Deploy Checklist](references/pre-deploy-checklist.md) | | 3 | **Load Recipe** — Based on `recipe.type` in `.azure/deployment-plan.md` | [recipes/README.md](references/recipes/README.md) | | 4 | **RBAC Health Check** — For Container Apps + ACR with managed identity: run `azd provision --no-prompt`, then verify `AcrPull` role has propagated before proceeding (see checklist) | [Pre-Deploy Checklist — Container Apps RBAC](references/pre-deploy-checklist.md#container-apps--acr--pre-deploy-rbac-health-check) | | 5 | **Execute Deploy** — Follow recipe steps | Recipe README | | 6 | **Post-Deploy** — Configure SQL managed identity and apply EF migrations if applicable | [Post-Deployment](references/recipes/azd/post-deployment.md) | | 7 | **Handle Errors** — See recipe's `errors.md` | — | | 8 | **Verify Success** — Confirm deployment completed and endpoints are accessible | [Verification](references/recipes/azd/verify.md) | | 9 | **Live Role Verification** — Query Azure to confirm provisioned RBAC roles are correct and sufficient | [live-role-verification.md](references/live-role-verification.md) | | 10 | **Report Results** — Present deployed endpoint URLs to the user as fully-qualified `https://` links | [Verification](references/recipes/azd/verify.md) | > **⛔ URL FORMAT RULE** > > When presenting endpoint URLs to the user, you **MUST** always use fully-qualified URLs with the `https://` scheme (e.g. `https://myapp.azurewebsites.net`, not `myapp.azurewebsites.net`). Many Azure CLI commands return bare hostnames without a scheme — always prepend `https://` before presenting them. > **⛔ VALIDATION PROOF CHECK** > > When checking the plan, verify the **Validation Proof** section (Section 7) contains actual validation results with commands run and timestamps. If this section is empty, validation was bypassed — invoke **azure-validate** skill first. ## SDK Quick References - **Azure Developer CLI**: [azd](references/sdk/azd-deployment.md) - **Azure Identity**: [Python](references/sdk/azure-identity-py.md) | [.NET](references/sdk/azure-identity-dotnet.md) | [TypeScript](references/sdk/azure-identity-ts.md) | [Java](references/sdk/azure-identity-java.md) ## MCP Tools | Tool | Purpose | |------|---------| | `mcp_azure_mcp_subscription_list` | List available subscriptions | | `mcp_azure_mcp_group_list` | List resource groups in subscription | | `mcp_azure_mcp_azd` | Execute AZD commands | | `azure__role` | List role assignments for live RBAC verification (step 9) | ## References - [Troubleshooting](references/troubleshooting.md) - Common issues and solutions - [Post-Deployment Steps](references/recipes/azd/post-deployment.md) - SQL + EF Core setup