ado-pipeline-generation

ado-pipeline-generation

Produces a complete azure-pipelines.yml for the resolved application language. Invoked standalone when the user explicitly requests a pipeline, or automatically as part of the devops-coding-agent flow.

Output File

Always write to azure-pipelines.yml in the project root. If the file already exists, confirm before overwriting.

Triggers

trigger:
  branches:
    include:
      - main
      - develop
pr:
  branches:
    include:
      - main

Agent Pool

Use the self-hosted org pool by default. Fall back to a Microsoft-hosted pool only when pool.hosted: true is set in .devops-agent.json.

# Self-hosted (default)
pool:
  name: 'OrgLinuxPool'

# Microsoft-hosted (opt-in)
pool:
  vmImage: 'ubuntu-latest'

Pipeline Structure

All pipelines use the ADO stages: → stage: → jobs: → job: → steps: hierarchy. Stages run sequentially unless dependsOn creates a dependency graph, allowing parallel execution of independent stages.

stages:
  Build            ← always first
  UnitTest         ← dependsOn: Build
  SonarScan        ← dependsOn: Build (parallel with UnitTest/SnykScan)
  SnykScan         ← dependsOn: Build (parallel with UnitTest/SonarScan)
  WizScan          ← dependsOn: Build (parallel, if enabled)
  DockerBuildPush  ← dependsOn: [UnitTest, SonarScan, SnykScan, WizScan]

Scanning stages are optional; include only when stages.<stageName>.enabled: true in .devops-agent.json.

Build Stage Per Language

.NET

steps:
  - task: UseDotNet@2
    inputs:
      version: '8.0.x'
  - script: dotnet restore
    displayName: 'Restore dependencies'
  - script: dotnet build --no-restore --configuration Release
    displayName: 'Build'

Node.js

steps:
  - task: NodeTool@0
    inputs:
      versionSpec: '20.x'
  - script: npm ci
    displayName: 'Install dependencies'
  - script: npm run build
    displayName: 'Build'

Java (Maven)

steps:
  - task: JavaToolInstaller@0
    inputs:
      versionSpec: '21'
      jdkArchitectureOption: 'x64'
      jdkSourceOption: 'PreInstalled'
  - script: mvn package -DskipTests --batch-mode
    displayName: 'Build'

Go

steps:
  - task: GoTool@0
    inputs:
      version: '1.22'
  - script: go build ./...
    displayName: 'Build'

Python

steps:
  - task: UsePythonVersion@0
    inputs:
      versionSpec: '3.12'
  - script: pip install -r requirements.txt
    displayName: 'Install dependencies'

Test Result Publishing

Use PublishTestResults@2 after every test step to surface results in the ADO test tab:

- task: PublishTestResults@2
  inputs:
    testResultsFormat: 'VSTest'       # or JUnit, NUnit, XUnit, CTest
    testResultsFiles: '**/*.trx'      # adapt glob per framework
  condition: succeededOrFailed()

Language	Format	Glob
.NET (xUnit/NUnit/MSTest)	VSTest	**/*.trx
Node.js (Jest)	JUnit	**/junit.xml
Java (Maven Surefire)	JUnit	**/TEST-*.xml
Go	JUnit (via gotestsum)	**/junit.xml
Python (pytest-junit)	JUnit	**/junit.xml

Variables Section

Declare shared pipeline variables at the top level. Reference Azure Key Vault secrets via variable groups.

variables:
  registry: 'yourorg.azurecr.io'
  imageName: '$(Build.Repository.Name)'
  tag: '$(Build.BuildId)'

For secrets, use a variable group linked to Key Vault rather than inlining values:

variables:
  - group: 'org-secrets-kv'        # variable group referencing Key Vault
  - name: registry
    value: 'yourorg.azurecr.io'
  - name: imageName
    value: '$(Build.Repository.Name)'
  - name: tag
    value: '$(Build.BuildId)'

Service Connections

Pipeline tasks reference named service connections defined in the ADO project. The following service connection names are expected by default (configurable in .devops-agent.json):

Purpose	Connection Name
Azure Container Registry	ACRServiceConnection
SonarQube	SonarQubeServiceConnection
Snyk	SnykServiceConnection
AWS (for ECR)	AWSServiceConnection

Complete Example Pipeline (.NET with ACR)

trigger:
  branches:
    include:
      - main
      - develop
pr:
  branches:
    include:
      - main
variables:
  registry: 'yourorg.azurecr.io'
  imageName: '$(Build.Repository.Name)'
  tag: '$(Build.BuildId)'
stages:
  - stage: Build
    displayName: 'Build Application'
    jobs:
      - job: Build
        pool:
          name: 'OrgLinuxPool'
        steps:
          - task: UseDotNet@2
            inputs:
              version: '8.0.x'
          - script: dotnet restore
            displayName: 'Restore dependencies'
          - script: dotnet build --no-restore --configuration Release
            displayName: 'Build'
  - stage: UnitTest
    displayName: 'Unit Tests'
    dependsOn: Build
    jobs:
      - job: Test
        pool:
          name: 'OrgLinuxPool'
        steps:
          - task: UseDotNet@2
            inputs:
              version: '8.0.x'
          - script: dotnet test --configuration Release --logger trx
            displayName: 'Run unit tests'
          - task: PublishTestResults@2
            inputs:
              testResultsFormat: 'VSTest'
              testResultsFiles: '**/*.trx'
  - stage: SonarScan
    displayName: 'SonarQube Analysis'
    dependsOn: Build
    jobs:
      - job: Scan
        pool:
          name: 'OrgLinuxPool'
        steps:
          - task: SonarQubePrepare@6
            inputs:
              SonarQube: 'SonarQubeServiceConnection'
              scannerMode: 'dotnet'
              projectKey: '$(Build.Repository.Name)'
          - script: dotnet build
            displayName: 'Build for analysis'
          - task: SonarQubeAnalyze@6
          - task: SonarQubePublish@6
            inputs:
              pollingTimeoutSec: '300'
  - stage: SnykScan
    displayName: 'Snyk Security Scan'
    dependsOn: Build
    jobs:
      - job: Scan
        pool:
          name: 'OrgLinuxPool'
        steps:
          - task: SnykSecurityScan@1
            inputs:
              serviceConnectionEndpoint: 'SnykServiceConnection'
              testType: 'app'
              severityThreshold: 'high'
  - stage: DockerBuildPush
    displayName: 'Docker Build & Push'
    dependsOn:
      - UnitTest
      - SonarScan
      - SnykScan
    jobs:
      - job: Docker
        pool:
          name: 'OrgLinuxPool'
        steps:
          - task: Docker@2
            displayName: 'Build and push'
            inputs:
              containerRegistry: 'ACRServiceConnection'
              repository: '$(imageName)'
              command: 'buildAndPush'
              Dockerfile: '**/Dockerfile'
              tags: |
                $(tag)
                latest

Config Reference

The following .devops-agent.json fields influence pipeline generation:

Field	Effect
platform	azure-devops selects this skill
language	Selects per-language build steps
languages.<lang>.version	Overrides tool installer version
pool.name	Overrides agent pool name
pool.hosted	true switches to vmImage: ubuntu-latest
registry.type	acr or ecr — selects registry push task
registry.serviceConnection	Overrides the default service connection name
stages.sonar.enabled	Includes SonarQube stage when true
stages.snyk.enabled	Includes Snyk stage when true
stages.wiz.enabled	Includes Wiz stage when true
stages.snyk.severityThreshold	low, medium, high, critical