Orchestrating azure deployments

Skill alexpizarro/azure-lean-stack-skills/skills/orchestrating-azure-deployments

Azure apps that cost nothing when nobody's using them. A Claude Code skill pack — 14 composable skills, 37+ documented gotchas, branch-per-env CI/CD.

Install

npx -y skills add alexpizarro/azure-lean-stack-skills --skill orchestrating-azure-deployments

Assembled from the repository path, not quoted from the project. Check it against their README if it does not work.

One thing to look at

1 stars1 stars. Stars are a popularity signal and not a quality one, but at this level it is likely that nobody has read this closely except its author, and you would be relying on your own review.

What its author says it does

Copied from the file, not written here

Routes Azure web app work (scaffold, deploy, troubleshoot, evolve) to the right Azure Lean Stack sub-skill. Built around branch-per-environment CI/CD where each git branch maps to one isolated Azure resource group via OIDC. Use when building or deploying a new Azure app, setting up GitHub Actions for Azure, troubleshooting a failed deploy, or adding FC1 / Container Apps / Logic Apps / multi-tenant patterns.

SKILL.md

7.6 KB, as published. Nobody here has run it

Orchestrating Azure Deployments (Azure Lean Stack)

Thin router for Azure app deployments. Holds no domain knowledge of its own — every task is delegated to a single-purpose sub-skill or to Microsoft's azure-skills plugin.

Last verified: May 2026

The deployment model — branch-per-environment

Before delegating anything else, internalise the deployment model. One branch in the repo = one isolated Azure resource group. main is never connected to Azure — it's for local dev only. test → test RG. production → prod RG. New branch + one OIDC credential = new isolated environment.

This model is non-negotiable. Every sub-skill assumes it. See references/architecture-decisions.md decision #0 for the full rationale (and the OIDC subject lockdown that makes it safe).

How to use this skill

Identify the user's task, then delegate. Never inline domain knowledge from a sub-skill — read the sub-skill's SKILL.md and follow it.

Routing table

User intent	Skill to invoke
"Scaffold a new Azure web app" / "set up a new project"	scaffolding-azure-bicep-infrastructure
"Set up OIDC" / "configure GitHub Actions for Azure" / "create service principals"	configuring-azure-oidc-for-github-actions
"Add a SQL migration" / "set up the migration system"	managing-azure-sql-migrations
"Deploy a React + Functions app" / "SWA" / "Static Web Apps"	deploying-azure-static-web-apps
"Add a timer trigger" / "queue trigger" / "AI workload" / "FC1" / "Flex Consumption"	deploying-fc1-flex-consumption-functions
"Docker on Azure" / "Container Apps" / "WebSocket/SSE" / "long-running server" / "background job"	deploying-azure-container-apps
"Blob storage cost" / "lifecycle rules" / "tier to cool/cold" / "delete old blobs"	optimizing-azure-blob-storage-cost
"Transactional email" / "ACS email" / "send email from Azure"	adding-azure-communication-services-email
"Add observability" / "App Insights" / "metric alerts" / "5xx alerts"	instrumenting-azure-app-insights
"Multi-tenant" / "one RG per customer" / "per-tenant isolation"	scaffolding-multi-tenant-azure-apps
"Recurring trigger" / "schedule" / "Logic App" / "Power-Automate-like flow" / "ping every N minutes"	scheduling-with-azure-logic-apps-consumption
"Run locally" / "offline" / "docker" / "local SQL" / "Azurite" / "seed local data" / "set up dev environment"	developing-azure-apps-locally
"Reduce cost" / "audit SKUs" / "stay on free tier" / "consumption-only"	applying-azure-cost-guardrails
"Deploy failed" / "diagnose this error" / "AADSTS70021" / "BCP258" / "LocationNotAvailable"	diagnosing-azure-deployment-failures
"I learned something" / "promote a learning to gotchas" / "capture this lesson"	curating-azure-deployment-learnings

When to delegate to Microsoft's azure-skills

This skill is complementary to Microsoft's azure-skills plugin. See references/composition-with-azure-skills.md for the full decision tree. Quick rules:

Task	Use Microsoft skill
Live Azure resource lookup ("what's running in my subscription?")	`azure-resource-lookup` + Azure MCP
Cost analysis of a running deployment	`azure-cost`
App Insights diagnostics on a live app	`azure-diagnostics` + `appinsights-instrumentation`
RBAC verification / role assignments	`azure-rbac`
Entra app registration mechanics	`entra-app-registration`
Enterprise infra planning	`azure-enterprise-infra-planner`
Quota / region availability checks	`azure-quotas`

This skill owns: the opinionated low-cost scaffold, the gotcha catalogue, end-to-end CI/CD workflows, and the learnings-feedback loop.

Architecture decisions (non-negotiable)

Detailed in references/architecture-decisions.md. Summary:

SWA managed functions by default — api/ deploys with SWA. Free tier. HTTP only.
SQL Serverless — GP_S_Gen5_1, auto-pauses after 15 min, 0.5 vCores min, 1 GB max.
OIDC auth — no client secrets to rotate. Branch-scoped SPs.
JSON parameter files — .parameters.json not .bicepparam.
SWA location — eastasia (not australiaeast). All other resources use australiaeast by default.

For the canonical stack versions (React, Vite, Node, mssql, Bicep), see references/stack-versions.md.

Workflow for a new project

When a user wants a complete new Azure app:

Read scaffolding-azure-bicep-infrastructure/SKILL.md and generate files.
Read configuring-azure-oidc-for-github-actions/SKILL.md and run setup scripts.
Read managing-azure-sql-migrations/SKILL.md for the migration system.
Read deploying-azure-static-web-apps/SKILL.md for SWA specifics.
Read applying-azure-cost-guardrails/SKILL.md to verify defaults are consumption-priced.
Optionally read instrumenting-azure-app-insights/SKILL.md for observability.

If a deploy then fails, route to diagnosing-azure-deployment-failures/SKILL.md.

Deploy workflow

Deployment is merge + push — always. main never deploys anywhere.

# Deploy to test
git checkout test && git merge main -m "Promote to test: <summary>" && git push origin test

# Deploy to production
git checkout production && git merge test -m "Release to prod: <summary>" && git push origin production

# Return to main (local dev only — no Azure environment attached)
git checkout main

Watch progress: gh run list --limit 4 then gh run watch <run-id>.

Need a new isolated environment? (Customer demo, UAT, feature branch with its own Azure stack.) Create the branch, run configuring-azure-oidc-for-github-actions with the new branch name, push. Ten minutes end to end.