All skills
microsoft avatar

/azure-deploy

@d0c21c0 official

Execute Azure deployments for ALREADY-PREPARED applications that have existing .azure/deployment-plan.md and infrastructure files. DO NOT use this skill when the user asks to CREATE a new application — use azure-prepare instead. This skill runs azd up, azd deploy, terraform apply, and az deployment commands with built-in error recovery. Requires .azure/deployment-plan.md from azure-prepare and validated status from azure-validate. WHEN: "run azd up", "run azd deploy", "execute deployment", "push to production", "push to cloud", "go live", "ship it", "bicep deploy", "terraform apply", "publish to Azure", "launch on Azure". DO NOT USE WHEN: "create and deploy", "build and deploy", "create a new app", "set up infrastructure", "create and deploy to Azure using Terraform" — use azure-prepare for these.

Use this Skill: https://skilld.dev/gh/microsoft/github-copilot-for-azure/azure-deploy

This session only. Nothing lands on disk.

referencesrecipesazdef-migrations.md

≈1.3k tokens on demand. Your agent reads this file only when SKILL.md points to it.

EF Core Migrations Deployment

Apply Entity Framework Core migrations to Azure SQL Database after deployment.

Detection

EF Core projects contain Migrations/ folder or Microsoft.EntityFrameworkCore package reference in .csproj.

find . -type d -name "Migrations" 2>/dev/null
find . -name "*.csproj" -exec grep -l "Microsoft.EntityFrameworkCore" {} \;

PowerShell:

Get-ChildItem -Recurse -Directory -Filter "Migrations" -ErrorAction SilentlyContinue
Get-ChildItem -Recurse -Filter "*.csproj" | Select-String -List "Microsoft.EntityFrameworkCore" | Select-Object -ExpandProperty Path

Deployment Methods

Method 1: azd Hook (Recommended)

Automate via postprovision hook in azure.yaml:

hooks:
  postprovision:
    posix:
      shell: sh
      run: ./scripts/apply-migrations.sh
    windows:
      shell: pwsh
      run: ./scripts/apply-migrations.ps1

Copy the pre-built scripts — Read scripts/apply-migrations.sh and scripts/apply-migrations.ps1 and write them verbatim to the project's scripts/ folder. Adjust APP_PROJECT_PATH / $AppProjectPath in the script to the location of the .csproj directory.

Key behaviours of the scripts:

  • Loads azd env get-values safely (no eval)
  • Installs dotnet-ef automatically when not present; no-op when already installed
  • Fails on genuine install errors (network failure, missing SDK)
  • Adds ~/.dotnet/tools to PATH so the tool is immediately available

💡 Make executable: chmod +x scripts/*.sh.

Method 2: SQL Script (Production)

Generate idempotent script for review before applying:

⚠️ Warning: az sql db query requires the rdbms-connect extension: az extension add --name rdbms-connect --yes

dotnet ef migrations script --idempotent --output migrations.sql
az sql db query --server "$SQL_SERVER" --database "$SQL_DATABASE" \
  --auth-mode ActiveDirectoryDefault --queries "$(cat migrations.sql)"

PowerShell:

dotnet ef migrations script --idempotent --output migrations.sql
$MigrationsSql = Get-Content migrations.sql -Raw
az sql db query --server $env:SQL_SERVER --database $env:SQL_DATABASE `
  --auth-mode ActiveDirectoryDefault --queries $MigrationsSql

Method 3: Application Startup (Dev Only)

⚠️ Development only — production should use explicit migration steps.

// Program.cs
if (app.Environment.IsDevelopment()) {
    using var scope = app.Services.CreateScope();
    scope.ServiceProvider.GetRequiredService<ApplicationDbContext>().Database.Migrate();
}

Combined Hook: SQL Access + Migrations

Combine both steps in a single postprovision hook using the pre-built combined scripts:

hooks:
  postprovision:
    posix:
      shell: sh
      run: ./scripts/grant-and-migrate.sh
    windows:
      shell: pwsh
      run: ./scripts/grant-and-migrate.ps1

Copy the pre-built scripts — Read scripts/grant-and-migrate.sh and scripts/grant-and-migrate.ps1 and write them verbatim to the project's scripts/ folder. Adjust APP_PROJECT_PATH / $AppProjectPath in the script to the location of the .csproj directory.

💡 Make executable: chmod +x scripts/*.sh

Prerequisites

Install EF Core tools:

dotnet tool install --global dotnet-ef
dotnet ef --version  # Verify installation

Connection String

Server=tcp:{server}.database.windows.net,1433;Database={database};Authentication=Active Directory Default;Encrypt=True;

Troubleshooting

Error Solution
Cannot open database Check firewall rules: az sql server firewall-rule list
Login failed Grant SQL access per sql-managed-identity.md
Unable to create DbContext Add IDesignTimeDbContextFactory implementation
Hook fails but deployment continues Remove `

DbContext Factory Example:

public class ApplicationDbContextFactory : IDesignTimeDbContextFactory<ApplicationDbContext> {
    public ApplicationDbContext CreateDbContext(string[] args) {
        var optionsBuilder = new DbContextOptionsBuilder<ApplicationDbContext>();
        var connectionString = Environment.GetEnvironmentVariable("CONNECTION_STRING") 
            ?? args.FirstOrDefault() ?? "Server=(localdb)\\mssqllocaldb;Database=MyDb;Trusted_Connection=True;";
        optionsBuilder.UseSqlServer(connectionString);
        return new ApplicationDbContext(optionsBuilder.Options);
    }
}

Best Practices

  • Use --idempotent flag for production scripts
  • Version control Migrations/ folder
  • Test locally before deploying
  • Backup production databases before applying
  • Keep migrations small and focused

References

Source: SKILL.md on GitHub

1 alert16d4 checks · Risk SAFE
  • Gen Agent Trust Hub16d

    This skill provides comprehensive instructions and scripts for executing Azure deployments using various tools like the Azure Developer CLI (azd), Terraform, and Bicep. It includes several security considerations, such as the execution of deployment commands and the use of external scripts for database migrations. These operations are essential to the skill's intended purpose and are accompanied by extensive safety guidance, including the implementation of managed identities and mandatory user confirmation for destructive actions.

  • Socket16d

    1 alert: gptAnomaly

  • Snyk16d

    Risk: LOW · No issues

  • Runlayer6mo

    21/36 files flagged

Signed by skilld at d0c21c0. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub yesterday.

Activeupdated 5 months ago
metadata
{
  "author": "Microsoft",
  "version": "0.0.0-placeholder"
}

README badge

README badge for microsoft/github-copilot-for-azure/azure-deploy

Executes Azure deployments for applications with prepared infrastructure and validated deployment plans, running azd up, azd deploy, terraform apply, and az deployment commands with error recovery. Use this skill only after azure-prepare and azure-validate have completed — it does not create applications or infrastructure, only deploys them.

Generated from the current SKILL.md.

What prerequisites must be met before using this skill?
The azure-prepare skill must have completed (creating .azure/deployment-plan.md and infrastructure files) and the azure-validate skill must have run and confirmed status as 'Validated'. If either is missing, invoke those skills first.
Can I use this skill to create a new application?
No. This skill executes deployments for already-prepared applications only. Use the azure-prepare skill to create new applications or set up infrastructure.
What deployment methods does this skill support?
The skill runs azd up, azd deploy, terraform apply, and az deployment commands with built-in error recovery.
What happens if validation status is not 'Validated'?
The skill will not proceed. You must invoke azure-validate first and ensure the Validation Proof section in .azure/deployment-plan.md is populated with actual validation results.
Does this skill handle post-deployment configuration?
Yes. It configures SQL managed identity and applies Entity Framework migrations if applicable, following the post-deployment steps for the selected recipe.

Generated from the current SKILL.md. These answers refresh after source changes.