Design and implement pipelines

mkdir myagent && cd myagent
tar zxvf ~/Downloads/vsts-agent-linux-x64-*.tar.gz

# Configure. Prefer a service principal / managed identity over a PAT where supported.
./config.sh --unattended \
  --url https://dev.azure.com/MyOrg \
  --auth pat --token "$AZP_TOKEN" \
  --pool MyLinuxPool \
  --agent "$(hostname)" \
  --acceptTeeEula

sudo ./svc.sh install && sudo ./svc.sh start   # run as a service

pool:
  name: MyLinuxPool          # self-hosted pool
  demands:
    - Agent.OS -equals Linux
    - HasDocker               # custom capability set on the agent
    - java -equals 21

pr:
  branches:
    include: [main, 'release/*']
  paths:
    exclude: ['docs/*', '**/*.md']
  drafts: false          # don't burn agent minutes on draft PRs

name: $(Date:yyyyMMdd)$(Rev:.r)

trigger:
  branches: { include: [main] }

variables:
  - name: buildConfiguration
    value: Release
  - group: 'Shared-Settings'          # variable group from Library
  - template: vars/common.yml         # variables from a template file

stages:
  - stage: Build
    displayName: Build and test
    jobs:
      - job: BuildJob
        pool: { vmImage: ubuntu-latest }
        steps:
          - checkout: self
            fetchDepth: 0             # full history: needed by GitVersion / SonarQube

          - template: templates/build-steps.yml
            parameters:
              buildConfiguration: $(buildConfiguration)

          - task: PublishPipelineArtifact@1
            inputs:
              targetPath: '$(Build.ArtifactStagingDirectory)'
              artifact: drop

  - stage: DeployStaging
    dependsOn: Build
    condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
    jobs:
      - deployment: DeployStaging     # a DEPLOYMENT job, not a plain job
        environment: staging
        strategy:
          runOnce:
            deploy:
              steps:
                - download: current
                  artifact: drop
                - script: ./deploy.sh $(Pipeline.Workspace)/drop

  - stage: DeployProd
    dependsOn: DeployStaging
    jobs:
      - deployment: DeployProd
        environment: production        # approvals/checks configured on the environment
        strategy:
          runOnce:
            deploy:
              steps:
                - script: ./deploy.sh

jobs:
  - job: Setup
    steps:
      - script: echo "##vso[task.setvariable variable=version;isOutput=true]1.4.2"
        name: setVar                 # the step NAME is required to reference the output

  - job: Use
    dependsOn: Setup
    variables:
      ver: $[ dependencies.Setup.outputs['setVar.version'] ]
    steps:
      - script: echo "Building $(ver)"

jobs:
  setup:
    runs-on: ubuntu-latest
    outputs:
      version: ${{ steps.v.outputs.value }}
    steps:
      - id: v
        run: echo "value=1.4.2" >> "$GITHUB_OUTPUT"

  use:
    needs: setup
    runs-on: ubuntu-latest
    steps:
      - run: echo "Building ${{ needs.setup.outputs.version }}"

variables:
  - group: 'Prod-KeyVault-Linked'     # Library → Variable group → Link secrets from Key Vault
  - name: region
    value: uksouth

steps:
  - script: ./deploy.sh
    env:
      DB_PASSWORD: $(SqlAdminPassword)   # resolved from Key Vault at runtime

- stage: Production
  jobs:
    - deployment: DeployProd
      displayName: Deploy to production
      environment:
        name: production
        resourceType: Kubernetes      # or VirtualMachine
        resourceName: prod-cluster
      strategy:
        runOnce:
          preDeploy:
            steps: [ { script: ./precheck.sh } ]
          deploy:
            steps: [ { script: ./deploy.sh } ]
          routeTraffic:
            steps: [ { script: ./route.sh } ]
          postRouteTraffic:
            steps: [ { script: ./smoke-test.sh } ]
          on:
            failure:
              steps: [ { script: ./rollback.sh } ]
            success:
              steps: [ { script: ./cleanup.sh } ]