new-pipeline

Create New Infrastructure Pipeline

Scaffold a CI/CD pipeline for Azure IaC deployments with validate → what-if → deploy → verify stages.

Required Information

Before generating, ask for:

1. Pipeline provider — GitHub Actions or Azure DevOps?
2. IaC tool — Bicep, Terraform, or azd?
3. Environments — which environments exist? (dev, staging, prod)
4. Trigger — push to main? PR? Manual dispatch?

GitHub Actions — Bicep

# .github/workflows/infra-deploy.yml
name: Infrastructure Deploy
on:
  push:
    branches: [main]
    paths: ['infra/**']
  pull_request:
    branches: [main]
    paths: ['infra/**']
  workflow_dispatch:
    inputs:
      environment:
        description: 'Target environment'
        required: true
        default: 'dev'
        type: choice
        options: [dev, staging, prod]

permissions:
  id-token: write
  contents: read

jobs:
  validate:
    name: Validate
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
      - uses: azure/login@v3
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
      - run: az bicep install
      - run: az bicep lint --file infra/main.bicep
      - run: |
          az deployment group what-if \
            --resource-group ${{ vars.RESOURCE_GROUP }} \
            --template-file infra/main.bicep \
            --parameters infra/main.parameters.json \
            --no-pretty-print

  deploy-dev:
    name: Deploy Dev
    needs: validate
    runs-on: ubuntu-latest
    environment: dev
    if: github.event_name != 'pull_request'
    steps:
      - uses: actions/checkout@v7
      - uses: azure/login@v3
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
      - uses: azure/arm-deploy@v2
        with:
          resourceGroupName: ${{ vars.DEV_RESOURCE_GROUP }}
          template: infra/main.bicep
          parameters: infra/main.parameters.json environmentName=dev
          failOnStdErr: true
      - name: Smoke Test
        shell: pwsh
        run: Invoke-Pester -Path ./tests/integration -Output Detailed

  deploy-prod:
    name: Deploy Production
    needs: deploy-dev
    runs-on: ubuntu-latest
    environment: prod  # requires manual approval gate in GitHub environments
    steps:
      - uses: actions/checkout@v7
      - uses: azure/login@v3
        with:
          client-id: ${{ secrets.AZURE_CLIENT_ID }}
          tenant-id: ${{ secrets.AZURE_TENANT_ID }}
          subscription-id: ${{ secrets.AZURE_SUBSCRIPTION_ID }}
      - uses: azure/arm-deploy@v2
        with:
          resourceGroupName: ${{ vars.PROD_RESOURCE_GROUP }}
          template: infra/main.bicep
          parameters: infra/main.parameters.json environmentName=prod
          failOnStdErr: true
      - name: Smoke Test
        shell: pwsh
        run: Invoke-Pester -Path ./tests/integration -Output Detailed