azure-devops-pipelines

When to activate

• Creating a new Azure DevOps pipeline from scratch
• Migrating a Classic (UI) pipeline to YAML
• "How do I speed up my pipeline?" in an Azure DevOps context
• Adding caching for NuGet packages, Composer vendor/, or node_modules
• Configuring secrets — any mention of Key Vault, service connections, or tokens in YAML
• Setting up multi-stage pipelines (build → test → deploy)
• Parallelizing tests with strategy matrix or test sharding
• Adding approval gates or branch policies before production deploy
• Any mention of DORA metrics, lead time, change failure rate in CI/CD context

Rules — Non-negotiable

1. Classic pipelines are legacy. Always use YAML. Every pipeline must be a versioned .yml file in the repository. No exceptions.

2. Secrets never go in YAML files. Use Azure Key Vault + Managed Identity or Variable Groups linked to Key Vault. Never hardcode tokens, passwords, or connection strings — not even as pipeline variables in plain text.

3. Stages must have explicit dependencies. Use dependsOn to enforce execution order. Deploy never runs without a passing Test stage.

4. Cache dependencies, always. A pipeline without caching is wasting 40–60% of its build time on redundant downloads.

5. Least privilege on service connections. A build pipeline must not have write access to production resources. Scope permissions per environment.

Pipeline Structure

Always enforce this multi-stage structure. Adapt stages to the project but never skip the dependency chain:

Trigger → Build → Test (parallel) → Security Scan → Deploy (gated)

Canonical YAML skeleton

trigger:
  branches:
    include:
      - main
      - develop

pr:
  branches:
    include:
      - main

variables:
  - group: kv-enterprise-secrets   # Linked to Azure Key Vault
  - name: buildConfiguration
    value: Release

stages:
  - stage: Build
    displayName: 'Build'
    jobs:
      - job: BuildJob
        pool:
          vmImage: ubuntu-latest
        steps:
          - task: Cache@2                    # Cache NuGet / Composer here
            ...
          - script: echo "Build steps here"

  - stage: Test
    displayName: 'Test'
    dependsOn: Build
    jobs:
      - job: UnitTests
        ...
      - job: IntegrationTests
        ...

  - stage: SecurityScan
    displayName: 'Security Scan'
    dependsOn: Build

  - stage: Deploy
    displayName: 'Deploy to Production'
    dependsOn:
      - Test
      - SecurityScan
    condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
    jobs:
      - deployment: DeployProd
        environment: production          # Environments enable approval gates
        ...