Orchestrating azure deployments

Orchestrating Azure Deployments (Azure Lean Stack)

Thin router for Azure app deployments. Holds no domain knowledge of its own — every task is delegated to a single-purpose sub-skill or to Microsoft's azure-skills plugin.

Stack defaults: React 19 + TypeScript | Azure Functions v4 (Node 22) | Azure SQL Serverless | Bicep IaC | GitHub Actions OIDC | branch-per-environment

Last verified: May 2026

---

The deployment model — branch-per-environment

Before delegating anything else, internalise the deployment model. One branch in the repo = one isolated Azure resource group. main is never connected to Azure — it's for local dev only. test → test RG. production → prod RG. New branch + one OIDC credential = new isolated environment.

This model is non-negotiable. Every sub-skill assumes it. See references/architecture-decisions.md decision #0 for the full rationale (and the OIDC subject lockdown that makes it safe).

---

How to use this skill

Identify the user's task, then delegate. Never inline domain knowledge from a sub-skill — read the sub-skill's SKILL.md and follow it.

Routing table

User intent	Skill to invoke
"Scaffold a new Azure web app" / "set up a new project"	scaffolding-azure-bicep-infrastructure
"Set up OIDC" / "configure GitHub Actions for Azure" / "create service principals"	configuring-azure-oidc-for-github-actions
"Add a SQL migration" / "set up the migration system"	managing-azure-sql-migrations
"Deploy a React + Functions app" / "SWA" / "Static Web Apps"	deploying-azure-static-web-apps
"Add a timer trigger" / "queue trigger" / "AI workload" / "FC1" / "Flex Consumption"	deploying-fc1-flex-consumption-functions
"Docker on Azure" / "Container Apps" / "WebSocket/SSE" / "long-running server" / "background job"	deploying-azure-container-apps
"Blob storage cost" / "lifecycle rules" / "tier to cool/cold" / "delete old blobs"	optimizing-azure-blob-storage-cost
"Transactional email" / "ACS email" / "send email from Azure"	adding-azure-communication-services-email
"Add observability" / "App Insights" / "metric alerts" / "5xx alerts"	instrumenting-azure-app-insights
"Multi-tenant" / "one RG per customer" / "per-tenant isolation"	scaffolding-multi-tenant-azure-apps
"Recurring trigger" / "schedule" / "Logic App" / "Power-Automate-like flow" / "ping every N minutes"	scheduling-with-azure-logic-apps-consumption
"Run locally" / "offline" / "docker" / "local SQL" / "Azurite" / "seed local data" / "set up dev environment"	developing-azure-apps-locally
"Reduce cost" / "audit SKUs" / "stay on free tier" / "consumption-only"	applying-azure-cost-guardrails
"Deploy failed" / "diagnose this error" / "AADSTS70021" / "BCP258" / "LocationNotAvailable"	diagnosing-azure-deployment-failures
"I learned something" / "promote a learning to gotchas" / "capture this lesson"	curating-azure-deployment-learnings

When to delegate to Microsoft's azure-skills

This skill is complementary to Microsoft's azure-skills plugin. See references/composition-with-azure-skills.md for the full decision tree. Quick rules:

Task	Use Microsoft skill
Live Azure resource lookup ("what's running in my subscription?")	azure-resource-lookup + Azure MCP
Cost analysis of a running deployment	azure-cost
App Insights diagnostics on a live app	azure-diagnostics + appinsights-instrumentation
RBAC verification / role assignments	azure-rbac
Entra app registration mechanics	entra-app-registration
Enterprise infra planning	azure-enterprise-infra-planner
Quota / region availability checks	azure-quotas

This skill owns: the opinionated low-cost scaffold, the gotcha catalogue, end-to-end CI/CD workflows, and the learnings-feedback loop.

---

Architecture decisions (non-negotiable)

Detailed in references/architecture-decisions.md. Summary:

1. SWA managed functions by default — api/ deploys with SWA. Free tier. HTTP only.
2. SQL Serverless — GP_S_Gen5_1, auto-pauses after 15 min, 0.5 vCores min, 1 GB max.
3. OIDC auth — no client secrets to rotate. Branch-scoped SPs.
4. JSON parameter files — .parameters.json not .bicepparam.
5. SWA location — eastasia (not australiaeast). All other resources use australiaeast by default.

For the canonical stack versions (React, Vite, Node, mssql, Bicep), see references/stack-versions.md.

---

Workflow for a new project

When a user wants a complete new Azure app:

1. Read scaffolding-azure-bicep-infrastructure/SKILL.md and generate files.
2. Read configuring-azure-oidc-for-github-actions/SKILL.md and run setup scripts.
3. Read managing-azure-sql-migrations/SKILL.md for the migration system.
4. Read deploying-azure-static-web-apps/SKILL.md for SWA specifics.
5. Read applying-azure-cost-guardrails/SKILL.md to verify defaults are consumption-priced.
6. Optionally read instrumenting-azure-app-insights/SKILL.md for observability.

If a deploy then fails, route to diagnosing-azure-deployment-failures/SKILL.md.

---

Deploy workflow

Deployment is merge + push — always. main never deploys anywhere.

# Deploy to test
git checkout test && git merge main -m "Promote to test: <summary>" && git push origin test

# Deploy to production
git checkout production && git merge test -m "Release to prod: <summary>" && git push origin production

# Return to main (local dev only — no Azure environment attached)
git checkout main

Watch progress: gh run list --limit 4 then gh run watch <run-id>.

Need a new isolated environment? (Customer demo, UAT, feature branch with its own Azure stack.) Create the branch, run configuring-azure-oidc-for-github-actions with the new branch name, push. Ten minutes end to end.