All skills
microsoft avatar

/azure-deploy

@b3c238e
by microsoftmicrosoft/skills3.1k stars
351

Execute Azure deployments for ALREADY-PREPARED applications that have existing .azure/deployment-plan.md and infrastructure files. DO NOT use this skill when the user asks to CREATE a new application — use azure-prepare instead. This skill runs azd up, azd deploy, terraform apply, and az deployment commands with built-in error recovery. Requires .azure/deployment-plan.md from azure-prepare and validated status from azure-validate. WHEN: "run azd up", "run azd deploy", "execute deployment", "push to production", "push to cloud", "go live", "ship it", "bicep deploy", "terraform apply", "publish to Azure", "launch on Azure". DO NOT USE WHEN: "create and deploy", "build and deploy", "create a new app", "set up infrastructure", "create and deploy to Azure using Terraform" — use azure-prepare for these.

Use this Skill: https://skilld.dev/gh/microsoft/skills/azure-deploy

This session only. Nothing lands on disk.

referencesrecipesazdef-migrations.md

≈1.3k tokens on demand. Your agent reads this file only when SKILL.md points to it.

EF Core Migrations Deployment

Apply Entity Framework Core migrations to Azure SQL Database after deployment.

Detection

EF Core projects contain Migrations/ folder or Microsoft.EntityFrameworkCore package reference in .csproj.

find . -type d -name "Migrations" 2>/dev/null
find . -name "*.csproj" -exec grep -l "Microsoft.EntityFrameworkCore" {} \;

PowerShell:

Get-ChildItem -Recurse -Directory -Filter "Migrations" -ErrorAction SilentlyContinue
Get-ChildItem -Recurse -Filter "*.csproj" | Select-String -List "Microsoft.EntityFrameworkCore" | Select-Object -ExpandProperty Path

Deployment Methods

Method 1: azd Hook (Recommended)

Automate via postprovision hook in azure.yaml:

hooks:
  postprovision:
    posix:
      shell: sh
      run: ./scripts/apply-migrations.sh
    windows:
      shell: pwsh
      run: ./scripts/apply-migrations.ps1

Copy the pre-built scripts — Read scripts/apply-migrations.sh and scripts/apply-migrations.ps1 and write them verbatim to the project's scripts/ folder. Adjust APP_PROJECT_PATH / $AppProjectPath in the script to the location of the .csproj directory.

Key behaviours of the scripts:

  • Loads azd env get-values safely (no eval)
  • Installs dotnet-ef automatically when not present; no-op when already installed
  • Fails on genuine install errors (network failure, missing SDK)
  • Adds ~/.dotnet/tools to PATH so the tool is immediately available

💡 Make executable: chmod +x scripts/*.sh.

Method 2: SQL Script (Production)

Generate idempotent script for review before applying:

⚠️ Warning: az sql db query requires the rdbms-connect extension: az extension add --name rdbms-connect --yes

dotnet ef migrations script --idempotent --output migrations.sql
az sql db query --server "$SQL_SERVER" --database "$SQL_DATABASE" \
  --auth-mode ActiveDirectoryDefault --queries "$(cat migrations.sql)"

PowerShell:

dotnet ef migrations script --idempotent --output migrations.sql
$MigrationsSql = Get-Content migrations.sql -Raw
az sql db query --server $env:SQL_SERVER --database $env:SQL_DATABASE `
  --auth-mode ActiveDirectoryDefault --queries $MigrationsSql

Method 3: Application Startup (Dev Only)

⚠️ Development only — production should use explicit migration steps.

// Program.cs
if (app.Environment.IsDevelopment()) {
    using var scope = app.Services.CreateScope();
    scope.ServiceProvider.GetRequiredService<ApplicationDbContext>().Database.Migrate();
}

Combined Hook: SQL Access + Migrations

Combine both steps in a single postprovision hook using the pre-built combined scripts:

hooks:
  postprovision:
    posix:
      shell: sh
      run: ./scripts/grant-and-migrate.sh
    windows:
      shell: pwsh
      run: ./scripts/grant-and-migrate.ps1

Copy the pre-built scripts — Read scripts/grant-and-migrate.sh and scripts/grant-and-migrate.ps1 and write them verbatim to the project's scripts/ folder. Adjust APP_PROJECT_PATH / $AppProjectPath in the script to the location of the .csproj directory.

💡 Make executable: chmod +x scripts/*.sh

Prerequisites

Install EF Core tools:

dotnet tool install --global dotnet-ef
dotnet ef --version  # Verify installation

Connection String

Server=tcp:{server}.database.windows.net,1433;Database={database};Authentication=Active Directory Default;Encrypt=True;

Troubleshooting

Error Solution
Cannot open database Check firewall rules: az sql server firewall-rule list
Login failed Grant SQL access per sql-managed-identity.md
Unable to create DbContext Add IDesignTimeDbContextFactory implementation
Hook fails but deployment continues Remove `

DbContext Factory Example:

public class ApplicationDbContextFactory : IDesignTimeDbContextFactory<ApplicationDbContext> {
    public ApplicationDbContext CreateDbContext(string[] args) {
        var optionsBuilder = new DbContextOptionsBuilder<ApplicationDbContext>();
        var connectionString = Environment.GetEnvironmentVariable("CONNECTION_STRING") 
            ?? args.FirstOrDefault() ?? "Server=(localdb)\\mssqllocaldb;Database=MyDb;Trusted_Connection=True;";
        optionsBuilder.UseSqlServer(connectionString);
        return new ApplicationDbContext(optionsBuilder.Options);
    }
}

Best Practices

  • Use --idempotent flag for production scripts
  • Version control Migrations/ folder
  • Test locally before deploying
  • Backup production databases before applying
  • Keep migrations small and focused

References

Source: SKILL.md on GitHub

2 warnings15d4 checks · Risk SAFE
  • Gen Agent Trust Hub15d

    This skill provides a robust framework for executing Azure deployments using various infrastructure-as-code tools. It includes several security considerations such as remote script installation and command execution, which are essential for its deployment functionality and are managed through strict prerequisite checks and user confirmation rules.

  • Socket15d

    1 alert: gptAnomaly

  • Snyk15d

    Risk: LOW · No issues

  • Runlayer7mo

    30/31 files flagged

Signed by skilld at b3c238e. This ties the file your Agent reads to that commit on GitHub. It does not review the instructions.

Last checked against GitHub yesterday.

Activeupdated 2 months ago
metadata
{
  "author": "Microsoft",
  "version": "1.2.1"
}

README badge

README badge for microsoft/skills/azure-deploy