$npx -y skills add microsoft/azure-skills --skill azure-validate--- name: azure-validate description: "Pre-deployment validation for Azure readiness. Run deep checks on configuration, infrastructure (Bicep or Terraform), RBAC role assignments, managed identity permissions, and prerequisites before deploying. WHEN: validate my app, check dep
| 1 | # Azure Validate |
| 2 | |
| 3 | > **AUTHORITATIVE GUIDANCE** — Follow these instructions exactly unless they contradict security policies given to you. |
| 4 | |
| 5 | > **⛔ STOP — PREREQUISITE CHECK REQUIRED** |
| 6 | > |
| 7 | > Before proceeding, verify this prerequisite is met: |
| 8 | > |
| 9 | > **azure-prepare** was invoked and completed → `.azure/deployment-plan.md` exists with status `Approved` or later |
| 10 | > |
| 11 | > If the plan is missing, **STOP IMMEDIATELY** and invoke **azure-prepare** first. |
| 12 | > |
| 13 | > The complete workflow ensures success: |
| 14 | > |
| 15 | > `azure-prepare` → `azure-validate` → `azure-deploy` |
| 16 | |
| 17 | ## Triggers |
| 18 | |
| 19 | - Check if app is ready to deploy |
| 20 | - Validate azure.yaml or Bicep |
| 21 | - Run preflight checks |
| 22 | - Troubleshoot deployment errors |
| 23 | |
| 24 | ## Rules |
| 25 | |
| 26 | 1. Run after azure-prepare, before azure-deploy |
| 27 | 2. All checks must pass—do not deploy with failures |
| 28 | 3. ⛔ **Destructive actions require `ask_user`** — [global-rules](references/global-rules.md) |
| 29 | |
| 30 | ## Steps |
| 31 | |
| 32 | | # | Action | Reference | |
| 33 | |---|--------|-----------| |
| 34 | | 1 | **Load Plan** — Read `.azure/deployment-plan.md` for recipe and configuration. If missing → run azure-prepare first | `.azure/deployment-plan.md` | |
| 35 | | 2 | **Add Validation Steps** — Copy recipe "Validation Steps" to `.azure/deployment-plan.md` as children of "All validation checks pass" | [recipes/README.md](references/recipes/README.md), `.azure/deployment-plan.md` | |
| 36 | | 3 | **Run Validation** — Execute recipe-specific validation commands | [recipes/README.md](references/recipes/README.md) | |
| 37 | | 4 | **Build Verification** — Build the project and fix any errors before proceeding | See recipe | |
| 38 | | 5 | **Static Role Verification** — Review Bicep/Terraform for correct RBAC role assignments in code | [role-verification.md](references/role-verification.md) | |
| 39 | | 6 | **Record Proof** — Populate **Section 7: Validation Proof** with commands run and results | `.azure/deployment-plan.md` | |
| 40 | | 7 | **Resolve Errors** — Fix failures before proceeding | See recipe's `errors.md` | |
| 41 | | 8 | **Update Status** — Only after ALL checks pass, set status to `Validated` | `.azure/deployment-plan.md` | |
| 42 | | 9 | **Deploy** — Invoke **azure-deploy** skill | — | |
| 43 | > **⛔ VALIDATION AUTHORITY** |
| 44 | > |
| 45 | > This skill is the officially verified way to set plan status to `Validated`. You MUST follow these steps to make sure every prerequisite is fulfilled before setting status to `Validated`: |
| 46 | > 1. Run actual validation commands (azd provision --preview, bicep build, terraform validate, etc.) |
| 47 | > 2. Populate **Section 7: Validation Proof** with the commands you ran and their results |
| 48 | > 3. Only then set status to `Validated` |
| 49 | > |
| 50 | > Do NOT set status to `Validated` without running checks and recording proof. |
| 51 | |
| 52 | --- |
| 53 | |
| 54 | > **⚠️ MANDATORY NEXT STEP — DO NOT SKIP** |
| 55 | > |
| 56 | > After ALL validations pass, you **MUST** invoke **azure-deploy** to execute the deployment. Do NOT attempt to run `azd up`, `azd deploy`, or any deployment commands directly. Let azure-deploy handle execution. |
| 57 | > |
| 58 | > If any validation failed, fix the issues and re-run azure-validate before proceeding. |