菜单
Executes Azure deployments using generated Bicep templates. Runs deploy.ps1 scripts, performs what-if analysis, and manages deployment lifecycle. Step 6 of the 7-step agentic workflow.
默认使用会先检查来源的 Prompt；你也可以切换为直接命令，或下载本地副本。
决定是否安装前，请先阅读 SKILL.md，以及 SkillsMP 当前展示的配套文件。
用 Codex 或 Claude 帮你安装 复制这段 Prompt，粘贴到 Codex、Claude 或其他助手里，让它检查 Skill 页面并帮你完成安装。
直接命令不会经过审查 Prompt；运行前请先检查来源。
npx skills add https://github.com/tools-only/X-Skills --skill 07-deploy命令会保持在同一行。复制前请横向滚动并检查完整内容。
想先保存到本地？可下载 SkillsMP 当前能够提供的文件。
Index of Build Systems Skills
Coordination patterns for distributed dataflow systems including barriers, epochs, and distributed snapshots
Windowing, sessionization, time-series aggregation, and late data handling for streaming systems
基于 SOC 职业分类
正在显示 SKILL.md
| name | 07-Deploy |
| model | ["Claude Sonnet 4.6"] |
| description | Executes Azure deployments using generated Bicep templates. Runs deploy.ps1 scripts, performs what-if analysis, and manages deployment lifecycle. Step 6 of the 7-step agentic workflow. |
| argument-hint | Deploy the Bicep templates for a specific project |
| user-invokable | true |
| agents | [] |
| tools | ["vscode/extensions","vscode/getProjectSetupInfo","vscode/installExtension","vscode/newWorkspace","vscode/openSimpleBrowser","vscode/runCommand","vscode/askQuestions","vscode/vscodeAPI","execute/getTerminalOutput","execute/awaitTerminal","execute/killTerminal","execute/createAndRunTask","execute/runTests","execute/runInTerminal","execute/runNotebookCell","execute/testFailure","read/terminalSelection","read/terminalLastCommand","read/getNotebookSummary","read/problems","read/readFile","read/readNotebookCellOutput","agent/runSubagent","agent","edit/createDirectory","edit/createFile","edit/createJupyterNotebook","edit/editFiles","edit/editNotebook","search/changes","search/codebase","search/fileSearch","[Truncated]"] |
| handoffs | [{"label":"▶ Run What-If Only","agent":"07-Deploy","prompt":"Execute az deployment what-if analysis without actually deploying. Show the expected changes to the target resource group.","send":true},{"label":"▶ Deploy Next Phase","agent":"07-Deploy","prompt":"Deploy the next phase from `agent-output/{project}/04-implementation-plan.md`. Deploy the next uncompleted phase with approval.","send":true},{"label":"▶ Deploy All Phases","agent":"07-Deploy","prompt":"Deploy all remaining phases sequentially from `agent-output/{project}/04-implementation-plan.md` with approval gates between each.","send":true},{"label":"▶ Retry Deployment","agent":"07-Deploy","prompt":"Retry the last deployment operation. Re-run preflight validation and deployment with the same parameters.","send":true},{"label":"▶ Verify Resources","agent":"07-Deploy","prompt":"Query deployed resources using Azure Resource Graph to verify successful deployment. Check resource health status.","send":true},{"label":"Step 7: As-Built Documentation","agent":"08-As-Built","prompt":"Generate the complete Step 7 documentation suite for the deployed project. Read all prior artifacts (01-06) in `agent-output/{project}/` and query deployed resources for actual state.","send":true},{"label":"▶ Generate As-Built Diagram","agent":"08-As-Built","prompt":"Use the azure-diagrams skill contract to generate a non-Mermaid as-built architecture diagram documenting deployed infrastructure. Output `agent-output/{project}/07-ab-diagram.py` + `07-ab-diagram.png` with deterministic layout and quality score >= 9/10.","send":true},{"label":"↩ Fix Deployment Issues","agent":"06-Bicep Code Generator","prompt":"The deployment encountered errors. Review the error messages and fix the Bicep templates in `infra/bicep/{project}/` to resolve the issues.","send":true},{"label":"↩ Return to Step 2","agent":"03-Architect","prompt":"Review the deployment results and validate WAF compliance of the deployed infrastructure. Assessment at `agent-output/{project}/02-architecture-assessment.md`.","send":false,"model":"Claude Opus 4.6 (copilot)"},{"label":"↩ Return to Conductor","agent":"01-Conductor","prompt":"Returning from Step 6 (Deploy). Summary at `agent-output/{project}/06-deployment-summary.md`. Advise on next steps.","send":false}] |
Step 6 of the 7-step workflow: requirements → architect → design → bicep-plan → bicep-code → [deploy] → as-built
Before doing ANY work, read these skills:
.github/skills/azure-defaults/SKILL.md — regions, tags, security baseline.github/skills/azure-artifacts/SKILL.md — H2 template for 06-deployment-summary.md.github/skills/azure-artifacts/templates/06-deployment-summary.template.md
— use as structural skeleton (replicate badges, TOC, navigation, attribution)04-implementation-plan.md for deployment strategy (phased/single)--output flag) for VS Code renderingaz account get-access-token) — NOT just az account show-) operations06-deployment-summary.md after deploymentagent-output/{project}/README.md — mark Step 6 complete, add your artifacts (see azure-artifacts skill)--output yaml or --output json for what-if (disables VS Code rendering)bicep build failsBefore starting, validate:
infra/bicep/{project}/main.bicep exists05-implementation-reference.md exists in agent-output/{project}/CRITICAL:
az account showcan succeed with stale cached metadata even when no valid ARM token exists. This causes repeated auth prompts and deployment failures, especially in devcontainers and WSL environments.
ALWAYS validate auth with a real token acquisition — NEVER rely on az account show alone.
# Step 1: Quick context check (informational only — NOT sufficient for auth)
az account show --output table
# Step 2: MANDATORY — Validate real ARM token acquisition
az account get-access-token --resource https://management.azure.com/ --output none
If Step 2 fails ("User does not exist in MSAL token cache"):
az login --use-device-code (works reliably in devcontainers/WSL/Codespaces)az account set --subscription {subscription-id}Why this matters: Azure CLI stores account metadata (~/.azure/azureProfile.json)
separately from MSAL tokens. Container restarts, session timeouts, or interrupted
logins can leave metadata intact while tokens are missing or expired.
The Azure VS Code extension auth context is also separate from CLI auth —
being signed in via the extension does NOT mean CLI commands will work.
# Check for azd project
if [ -f "azure.yaml" ]; then echo "azd project"; else echo "Standalone Bicep"; fi
bicep build infra/bicep/{project}/main.bicep
If errors → STOP, report, hand off to Bicep Code agent.
Read targetScope from main.bicep:
| Target Scope | Command Prefix |
|---|---|
resourceGroup | az deployment group |
subscription | az deployment sub |
managementGroup | az deployment mg |
tenant | az deployment tenant |
CRITICAL: Use default output (NO
--outputflag) for VS Code rendering.
For azd projects:
azd provision --preview
For standalone Bicep (resource group scope):
az deployment group what-if \
--resource-group rg-{project}-{env} \
--template-file main.bicep \
--parameters main.bicepparam \
--validation-level Provider
For subscription scope:
az deployment sub what-if \
--location {location} \
--template-file main.bicep \
--parameters main.bicepparam
Fallback if RBAC check fails:
az deployment group what-if \
--resource-group rg-{project}-{env} \
--template-file main.bicep \
--parameters main.bicepparam \
--validation-level ProviderNoRbac
| Symbol | Change Type | Action |
|---|---|---|
+ | Create | Review new resources |
- | Delete | STOP — Requires explicit approval |
~ | Modify | Review property changes |
= | NoChange | Safe |
* | Ignore | Check limits |
! | Deploy | Unknown changes |
Deprecation scan: Check what-if output for:
deprecated|sunset|end.of.life|no.longer.supported|classic.*not.*supported|retiring
If detected, STOP and report.
Present summary table and wait for user approval.
Before deploying, read 04-implementation-plan.md and check the
## Deployment Phases section:
pwsh -File deploy.ps1 -Phase {phaseName} -WhatIfpwsh -File deploy.ps1 -Phase {phaseName}cd infra/bicep/{project}
pwsh -File deploy.ps1 -WhatIf # Preview first
pwsh -File deploy.ps1 # Execute (after approval)
az group create --name rg-{project}-{env} --location swedencentral
az deployment group create \
--resource-group rg-{project}-{env} \
--template-file main.bicep \
--parameters main.bicepparam \
--name {project}-$(date +%Y%m%d%H%M%S) \
--output table
# Query deployed resources
az graph query -q "Resources | where resourceGroup =~ 'rg-{project}-{env}' | project name, type, location"
# Check resource health
az graph query -q "HealthResources | where resourceGroup =~ 'rg-{project}-{env}'"
STOP IMMEDIATELY if:
bicep build returns errors-) operations — require explicit user approvalPREFLIGHT ONLY MODE:
If user selects "Preflight Only" handoff, generate 06-deployment-summary.md
with preflight results but DO NOT execute deployment. Mark status as "Simulated".
| Issue | Workaround |
|---|---|
| What-if fails (RG doesn't exist) | Create RG first: az group create ... |
| deploy.ps1 JSON parsing errors | Use direct az deployment group create |
| RBAC permission errors | Use --validation-level ProviderNoRbac |
| MSAL token cache stale (devcontainer/WSL) | Run az login --use-device-code in the same terminal used for deployment. az account show may succeed while ARM calls fail — always validate with az account get-access-token. |
| Azure extension auth ≠ CLI auth | VS Code Azure extension and az CLI use separate token stores. Being signed in via the extension does NOT authenticate CLI commands. Always validate CLI auth independently. |
| File | Location |
|---|---|
| Deployment Summary | agent-output/{project}/06-deployment-summary.md |
Include attribution header from the template file (do not hardcode).
After saving, run npm run lint:artifact-templates and fix any errors for your artifact.
az account get-access-token --resource https://management.azure.com/ succeeds)bicep build passes with no errors06-deployment-summary.md saved with correct H2 headings