菜单
Automate creation of Azure DevOps workload identity federation service connections with deployment metadata from deploy.json. Use when users need to create or delete Azure service connections with workload identity federation for secure, passwordless authentication.
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
基于 SOC 职业分类
Master skill for the reflect->capture->distribute learning loop in any repository: its MAIN TASK is to reflect on a session/task and turn what it taught into durable, reusable knowledge, then distribute it. Reflect on what a session revealed, capture it by authoring/updating skills, agents, docs, and a lessons file, and distribute it both to the team (repo-local `.claude/skills/`, committed) and across projects (global `~/.claude/skills/`) via push learnings up, pull skills down, or reconcile, all through the bundled skill-sync leaf. Delegates each step to the correct leaf skill. Triggers on: "reflect", "review session", "what did we do", "session summary", "learnings", "capture lessons", "update lessons", "improve skills", "update docs", "analyze conversation", "learning loop", "create skill", "update skill", "new skill", "write a skill", "global skill", "promote skill", "sync skills", "reconcile skills", "pull global skill", "skills out of sync", "drift audit", "skill drift".
Audit and fix Markdown files for brand-voice quality in the "Agentic Software Engineering using GitHub Copilot" masterclass (audience: software engineers): em dashes, Mermaid label syntax, paragraph length, and topic-specific slash command tables. Trigger phrases: brand voice check, quality check, check writing quality, fix em dashes.
Master skill for regulatory compliance assessment of a product: routes to the matching leaf and covers both the AI-specific and the personal-data regulations. Leaf `eu-ai-act` handles EU AI Act risk-tier classification (prohibited / high-risk / limited-risk transparency / minimal), the Article 50 transparency-disclosure pattern for consent screens and Terms of Service, and stakeholder/owner checklists. Leaf `dsgvo` handles DSGVO / GDPR personal-data compliance: lawful basis, data-subject rights, privacy notice, processor (Art. 28) agreements, records of processing, DPIA, breach notification, third-country transfers, and the compliance-check checklist. Use when asked to "check compliance", "compliance checklist", "EU AI Act compliance", "is our AI high-risk", "Article 50 transparency", "DSGVO compliance", "GDPR compliance", "check for DSGVO", "are we GDPR compliant", "do we need a privacy notice / Datenschutzerklärung", "lawful basis", "data subject rights", "data processing agreement", "AVV", "DPIA", "data br
Author a single demo or lab guide for a hands-on class of any audience, in one of three styles chosen by audience: prompt-recipe (business/maker, the five-part step model), guided (initial project setup), or walkthrough (code, Microsoft-Learn style with run commands and expected output). Places the file at the module root as demo-NN-slug.md or lab-NN-slug.md, scaffolds any runnable project and companion assets, and updates the folder TOC. Peer skill the create-class master delegates to; also invocable directly. Trigger phrases: create a guide, write a demo, author a lab, demo guide, lab guide, prompt recipe, walkthrough guide, learn style guide, run-verified guide.
Turn a topic readme into presentation slides for a hands-on class, via one of two first-class paths chosen per class. Gamma path: analyse a topic readme and emit Gamma-ready slide spec files (frontmatter plus heading, bullets, optional Mermaid) into the module pptx/ folder, with a merge-slides sub-capability that combines multiple Gamma PPTX exports to beat Gamma's ~10-item-per-call cap. PPTX path: generate a local .pptx deck directly with python-pptx (via the pptx skill) for classes that do not use Gamma. The master create-class skill delegates here; also invocable on its own. Trigger phrases: create slides, topic to slides, gamma slides, pptx deck, slide spec, merge slides, generate deck, slides from readme, build a deck.
Enrich a module README with a use-case intro, a topic-specific slash-command table, and key documentation links, adapted to the module's audience (developer, low-code maker, or business user). Peer skill that the create-class master delegates to by name; also invocable directly. Trigger phrases: enrich module readme, module readme, use case intro, slash command table, key links, teaching content, enhance for business owner, business audience, adapt readme for business users, topic-specific slash commands.
| name | ado-create-wif |
| description | Automate creation of Azure DevOps workload identity federation service connections with deployment metadata from deploy.json. Use when users need to create or delete Azure service connections with workload identity federation for secure, passwordless authentication. |
| license | MIT |
This skill automates the creation and deletion of Azure DevOps service connections using workload identity federation (WIF) with managed identities. Scripts automatically read deployment configuration from deploy.json, enabling secure, passwordless authentication from Azure DevOps pipelines to Azure resources.
Workload identity federation (WIF) is a secure authentication method that uses OpenID Connect (OIDC) to establish trust between Azure DevOps and Azure managed identities. Instead of managing secrets, this approach uses federated credentials to allow Azure DevOps to authenticate to Azure resources.
azure-devops extension installedScripts automatically read deployment configuration from deploy.json. Scripts are located in the demos folder:
Script Location: demos/03-release-strategy/01-release-pipelines/01-service-connections/
Required deploy.json Fields:
cd demos/03-release-strategy/01-release-pipelines/01-service-connections
.\create-workload-identity.ps1
cd demos/03-release-strategy/01-release-pipelines/01-service-connections
bash create-workload-identity.sh
Scripts read from deploy.json which should be in the repository root. Edit deploy.json to customize:
Load Configuration from deploy.json
Create Resource Group
Create Managed Identity
Wait for Service Principal Propagation
Assign Contributor Role
Create Azure DevOps Service Connection
Detect Auto-Generated Issuer and Subject
Create Federated Credential
Share Service Connection
Issuer and Subject Handling: The scripts use a two-step process:
This ensures the federated credential always matches what Azure DevOps expects, even if the service generates different values than anticipated.
Project Reference: The service connection payload requires both project ID and name in the serviceEndpointProjectReferences array. Scripts automatically look up the project ID.
When you need to clean up resources, use the delete scripts. They handle the correct deletion order to avoid dependency errors.
Delete scripts are located in the demos folder:
Script Location: demos/03-release-strategy/01-release-pipelines/01-service-connections/
cd demos/03-release-strategy/01-release-pipelines/01-service-connections
bash delete-workload-identity.sh
cd demos/03-release-strategy/01-release-pipelines/01-service-connections
.\delete-workload-identity.ps1
The scripts follow this critical order to avoid dependency blocks:
Delete Federated Credential (from managed identity)
Delete Azure DevOps Service Connection
Delete Role Assignments
Delete Managed Identity
Optionally Delete Resource Group (interactive)
wi-az400-test, wi-az400-prodError: "Following fields in the service connection are not expected: workloadIdentityFederationAudience"
Cause: Attempting to set custom issuer/subject values that Azure DevOps doesn't support
Solution: The scripts don't set custom values; they query and sync auto-generated ones. Verify script execution completed all steps.
Error: "Cannot delete this service connection while federated credentials for app {...} exist in Entra tenant"
Cause: Federated credential exists but deletion script was interrupted or only partially executed
Solution: Run the delete script again; it will delete the federated credential first, then the service connection.
Warning: "Waiting for service principal propagation... (10/10)"
Cause: Azure service principal hasn't replicated across regions yet (eventual consistency)
Solution: Scripts include retry logic with 10-second wait times; usually resolves automatically. If persists, wait 5 minutes and retry script execution.
Warning: "Retrying role assignment... (5/5)"
Cause: Role assignment propagation delay or permission issue
Solution: Verify your Azure account has sufficient permissions to assign roles at the subscription level. Scripts retry 5 times with 5-second intervals.
Scripts automatically read metadata from .github/deploy.json in the repository root. This eliminates the need to hardcode values and ensures consistency across the project.
Required Fields in deploy.json:
{
"ResourceGroup": "your-resource-group-name",
"WIF": "your-managed-identity-name-prefix",
"ADOOrg": "https://dev.azure.com/your-org",
"ADOProject": "your-project-name"
}
Example Configuration:
{
"ResourceGroup": "rg-agentic-sw-engineering",
"WIF": "wi-agentic-sw",
"ADOOrg": "https://dev.azure.com/integrationsonline",
"ADOProject": "agentic-sw-engineering"
}
To customize for a different environment, edit .github/deploy.json before running the scripts. The scripts will automatically apply these values during execution.