メニュー
Executes Azure deployments using generated Bicep templates. Runs deploy.ps1 scripts, performs what-if analysis, and manages deployment lifecycle. Step 6 of the 7-step agentic workflow.
デフォルトでは、最初にソースを確認する Prompt が選択されています。直接コマンドに切り替えるか、ローカルコピーをダウンロードすることもできます。
インストールを決める前に、SKILL.md と SkillsMP に表示されている付属ファイルをお読みください。
SOC 職業分類に基づく
Codex または Claude でインストール この Prompt をコピーして Codex、Claude、または他のアシスタントに貼り付けると、Skill ページを確認してインストールできます。
直接コマンドでは確認用 Prompt が省略されます。実行前にソースを確認してください。
npx skills add https://github.com/tools-only/X-Skills --skill 07-deployコマンドは1行のまま表示されます。コピー前に横へスクロールして全体を確認してください。
ローカルで確認しますか？SkillsMP が現在取得できるファイルをダウンロードできます。
SKILL.md を表示中
Index of Build Systems Skills
Coordination patterns for distributed dataflow systems including barriers, epochs, and distributed snapshots
Windowing, sessionization, time-series aggregation, and late data handling for streaming systems
| name | 07-Deploy |
| model | ["Claude Sonnet 4.6"] |
| description | Executes Azure deployments using generated Bicep templates. Runs deploy.ps1 scripts, performs what-if analysis, and manages deployment lifecycle. Step 6 of the 7-step agentic workflow. |
| argument-hint | Deploy the Bicep templates for a specific project |
| user-invokable | true |
| agents | [] |
| tools | ["vscode/extensions","vscode/getProjectSetupInfo","vscode/installExtension","vscode/newWorkspace","vscode/openSimpleBrowser","vscode/runCommand","vscode/askQuestions","vscode/vscodeAPI","execute/getTerminalOutput","execute/awaitTerminal","execute/killTerminal","execute/createAndRunTask","execute/runTests","execute/runInTerminal","execute/runNotebookCell","execute/testFailure","read/terminalSelection","read/terminalLastCommand","read/getNotebookSummary","read/problems","read/readFile","read/readNotebookCellOutput","agent/runSubagent","agent","edit/createDirectory","edit/createFile","edit/createJupyterNotebook","edit/editFiles","edit/editNotebook","search/changes","search/codebase","search/fileSearch","[Truncated]"] |
| handoffs | [{"label":"▶ Run What-If Only","agent":"07-Deploy","prompt":"Execute az deployment what-if analysis without actually deploying. Show the expected changes to the target resource group.","send":true},{"label":"▶ Deploy Next Phase","agent":"07-Deploy","prompt":"Deploy the next phase from `agent-output/{project}/04-implementation-plan.md`. Deploy the next uncompleted phase with approval.","send":true},{"label":"▶ Deploy All Phases","agent":"07-Deploy","prompt":"Deploy all remaining phases sequentially from `agent-output/{project}/04-implementation-plan.md` with approval gates between each.","send":true},{"label":"▶ Retry Deployment","agent":"07-Deploy","prompt":"Retry the last deployment operation. Re-run preflight validation and deployment with the same parameters.","send":true},{"label":"▶ Verify Resources","agent":"07-Deploy","prompt":"Query deployed resources using Azure Resource Graph to verify successful deployment. Check resource health status.","send":true},{"label":"Step 7: As-Built Documentation","agent":"08-As-Built","prompt":"Generate the complete Step 7 documentation suite for the deployed project. Read all prior artifacts (01-06) in `agent-output/{project}/` and query deployed resources for actual state.","send":true},{"label":"▶ Generate As-Built Diagram","agent":"08-As-Built","prompt":"Use the azure-diagrams skill contract to generate a non-Mermaid as-built architecture diagram documenting deployed infrastructure. Output `agent-output/{project}/07-ab-diagram.py` + `07-ab-diagram.png` with deterministic layout and quality score >= 9/10.","send":true},{"label":"↩ Fix Deployment Issues","agent":"06-Bicep Code Generator","prompt":"The deployment encountered errors. Review the error messages and fix the Bicep templates in `infra/bicep/{project}/` to resolve the issues.","send":true},{"label":"↩ Return to Step 2","agent":"03-Architect","prompt":"Review the deployment results and validate WAF compliance of the deployed infrastructure. Assessment at `agent-output/{project}/02-architecture-assessment.md`.","send":false,"model":"Claude Opus 4.6 (copilot)"},{"label":"↩ Return to Conductor","agent":"01-Conductor","prompt":"Returning from Step 6 (Deploy). Summary at `agent-output/{project}/06-deployment-summary.md`. Advise on next steps.","send":false}] |
Step 6 of the 7-step workflow: requirements → architect → design → bicep-plan → bicep-code → [deploy] → as-built
Before doing ANY work, read these skills:
.github/skills/azure-defaults/SKILL.md — regions, tags, security baseline.github/skills/azure-artifacts/SKILL.md — H2 template for 06-deployment-summary.md.github/skills/azure-artifacts/templates/06-deployment-summary.template.md
— use as structural skeleton (replicate badges, TOC, navigation, attribution)04-implementation-plan.md for deployment strategy (phased/single)--output flag) for VS Code renderingaz account get-access-token) — NOT just az account show-) operations06-deployment-summary.md after deploymentagent-output/{project}/README.md — mark Step 6 complete, add your artifacts (see azure-artifacts skill)--output yaml or --output json for what-if (disables VS Code rendering)bicep build failsBefore starting, validate:
infra/bicep/{project}/main.bicep exists05-implementation-reference.md exists in agent-output/{project}/CRITICAL:
az account showcan succeed with stale cached metadata even when no valid ARM token exists. This causes repeated auth prompts and deployment failures, especially in devcontainers and WSL environments.
ALWAYS validate auth with a real token acquisition — NEVER rely on az account show alone.
# Step 1: Quick context check (informational only — NOT sufficient for auth)
az account show --output table
# Step 2: MANDATORY — Validate real ARM token acquisition
az account get-access-token --resource https://management.azure.com/ --output none
If Step 2 fails ("User does not exist in MSAL token cache"):
az login --use-device-code (works reliably in devcontainers/WSL/Codespaces)az account set --subscription {subscription-id}Why this matters: Azure CLI stores account metadata (~/.azure/azureProfile.json)
separately from MSAL tokens. Container restarts, session timeouts, or interrupted
logins can leave metadata intact while tokens are missing or expired.
The Azure VS Code extension auth context is also separate from CLI auth —
being signed in via the extension does NOT mean CLI commands will work.
# Check for azd project
if [ -f "azure.yaml" ]; then echo "azd project"; else echo "Standalone Bicep"; fi
bicep build infra/bicep/{project}/main.bicep
If errors → STOP, report, hand off to Bicep Code agent.
Read targetScope from main.bicep:
| Target Scope | Command Prefix |
|---|---|
resourceGroup | az deployment group |
subscription | az deployment sub |
managementGroup | az deployment mg |
tenant | az deployment tenant |
CRITICAL: Use default output (NO
--outputflag) for VS Code rendering.
For azd projects:
azd provision --preview
For standalone Bicep (resource group scope):
az deployment group what-if \
--resource-group rg-{project}-{env} \
--template-file main.bicep \
--parameters main.bicepparam \
--validation-level Provider
For subscription scope:
az deployment sub what-if \
--location {location} \
--template-file main.bicep \
--parameters main.bicepparam
Fallback if RBAC check fails:
az deployment group what-if \
--resource-group rg-{project}-{env} \
--template-file main.bicep \
--parameters main.bicepparam \
--validation-level ProviderNoRbac
| Symbol | Change Type | Action |
|---|---|---|
+ | Create | Review new resources |
- | Delete | STOP — Requires explicit approval |
~ | Modify | Review property changes |
= | NoChange | Safe |
* | Ignore | Check limits |
! | Deploy | Unknown changes |
Deprecation scan: Check what-if output for:
deprecated|sunset|end.of.life|no.longer.supported|classic.*not.*supported|retiring
If detected, STOP and report.
Present summary table and wait for user approval.
Before deploying, read 04-implementation-plan.md and check the
## Deployment Phases section:
pwsh -File deploy.ps1 -Phase {phaseName} -WhatIfpwsh -File deploy.ps1 -Phase {phaseName}cd infra/bicep/{project}
pwsh -File deploy.ps1 -WhatIf # Preview first
pwsh -File deploy.ps1 # Execute (after approval)
az group create --name rg-{project}-{env} --location swedencentral
az deployment group create \
--resource-group rg-{project}-{env} \
--template-file main.bicep \
--parameters main.bicepparam \
--name {project}-$(date +%Y%m%d%H%M%S) \
--output table
# Query deployed resources
az graph query -q "Resources | where resourceGroup =~ 'rg-{project}-{env}' | project name, type, location"
# Check resource health
az graph query -q "HealthResources | where resourceGroup =~ 'rg-{project}-{env}'"
STOP IMMEDIATELY if:
bicep build returns errors-) operations — require explicit user approvalPREFLIGHT ONLY MODE:
If user selects "Preflight Only" handoff, generate 06-deployment-summary.md
with preflight results but DO NOT execute deployment. Mark status as "Simulated".
| Issue | Workaround |
|---|---|
| What-if fails (RG doesn't exist) | Create RG first: az group create ... |
| deploy.ps1 JSON parsing errors | Use direct az deployment group create |
| RBAC permission errors | Use --validation-level ProviderNoRbac |
| MSAL token cache stale (devcontainer/WSL) | Run az login --use-device-code in the same terminal used for deployment. az account show may succeed while ARM calls fail — always validate with az account get-access-token. |
| Azure extension auth ≠ CLI auth | VS Code Azure extension and az CLI use separate token stores. Being signed in via the extension does NOT authenticate CLI commands. Always validate CLI auth independently. |
| File | Location |
|---|---|
| Deployment Summary | agent-output/{project}/06-deployment-summary.md |
Include attribution header from the template file (do not hardcode).
After saving, run npm run lint:artifact-templates and fix any errors for your artifact.
az account get-access-token --resource https://management.azure.com/ succeeds)bicep build passes with no errors06-deployment-summary.md saved with correct H2 headings