azure_devops — independently scanned and version-tracked by SaferSkills.
SaferSkills independently audited azure_devops (Agent Skill) and scored it 100/100 (green). The audit ran 55 deterministic rules across Security, Supply Chain, Maintenance, Transparency, and Community; it found 0 high-severity and 0 lower-severity findings. The full rule-by-rule trace and per-finding evidence are below. Free, methodology-open.
Findings & checks · 0 flagged
Every scanned point with the score it earned and what moved between them.
First recorded scan — no prior version to compare against.
The primary manifest — the file an agent reads to learn what this artifact does.
Build, test, and deploy applications using Azure Pipelines with YAML or classic editor.
Use this skill when:
These fragments require actual build outputs, deploy scripts, service connections and environment checks. Echoing “Deploying” is not a deployment. YAML PR triggers depend on repository provider; Azure Repos Git uses branch build-validation policy. Rolling deployment strategy applies to supported VM environment resources, not arbitrary web apps/Kubernetes. Pin supported runtime/agent versions and obtain the agent package from the current official download instructions with integrity verification; the archive URL below is historical. Keep untrusted PR code away from production credentials and persistent self-hosted agents.
Create azure-pipelines.yml in repository root:
trigger:
branches:
include:
- main
- develop
paths:
include:
- src/*
pool:
vmImage: 'ubuntu-latest'
variables:
buildConfiguration: 'Release'
nodeVersion: '22.x'
stages:
- stage: Build
jobs:
- job: BuildJob
steps:
- task: NodeTool@0
inputs:
versionSpec: $(nodeVersion)
- script: |
npm ci
npm run build
displayName: 'Build application'
# Adapt dist to the actual build output directory.
- publish: $(Build.SourcesDirectory)/dist
artifact: drop
- stage: Deploy
dependsOn: Build
condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
jobs:
- deployment: DeployWeb
environment: 'production'
strategy:
runOnce:
deploy:
steps:
- script: echo Deploying to productiontrigger:
branches:
include:
- main
- release/*
exclude:
- feature/*
tags:
include:
- v*pr:
branches:
include:
- main
paths:
include:
- src/*
exclude:
- docs/*schedules:
- cron: '0 2 * * *'
displayName: 'Nightly build'
branches:
include:
- main
always: truestages:
- stage: Test
jobs:
- job: UnitTests
pool:
vmImage: 'ubuntu-latest'
steps:
- script: npm run test:unit
- job: IntegrationTests
pool:
vmImage: 'ubuntu-latest'
steps:
- script: npm run test:integrationjobs:
- job: Build
strategy:
matrix:
linux:
vmImage: 'ubuntu-latest'
windows:
vmImage: 'windows-latest'
mac:
vmImage: 'macos-latest'
pool:
vmImage: $(vmImage)
steps:
- script: npm teststages:
- stage: Build
jobs:
- job: A
steps:
- script: echo Job A
- job: B
dependsOn: A
steps:
- script: echo Job Bvariables:
- group: 'production-secrets'
- name: buildConfiguration
value: 'Release'parameters:
- name: environment
displayName: 'Environment'
type: string
default: 'dev'
values:
- dev
- staging
- prod
stages:
- stage: Deploy
variables:
env: ${{ parameters.environment }}
jobs:
- job: Deploy
steps:
- script: echo "Deploying to $(env)"variables:
- name: mySecret
value: $(SECRET_FROM_PIPELINE) # Set in pipeline settings
steps:
- script: |
echo "Using secret"
./deploy.sh
env:
API_KEY: $(mySecret)# templates/build-job.yml
parameters:
- name: nodeVersion
default: '20'
jobs:
- job: Build
steps:
- task: NodeTool@0
inputs:
versionSpec: ${{ parameters.nodeVersion }}
- script: npm ci && npm run build# azure-pipelines.yml
stages:
- stage: Build
jobs:
- template: templates/build-job.yml
parameters:
nodeVersion: '20'# templates/deploy-stage.yml
parameters:
- name: environment
type: string
- name: serviceConnection
type: string
stages:
- stage: Deploy_${{ para~30 seconds. Free. No account. Every finding cites a rule and a line of evidence.