Applying Azure Cost Guardrails
Applies Azure cost guardrails to a deployment — verifies consumption-priced SKUs, scale-to-zero on Container Apps, SQL Serverless auto-pause, Log Analytics dailyQuotaGb cap, Storage lifecycle rules, and the free tiers (SWA Free, ACS 100 emails/day, App Insights 5GB/mo). Audits an existing project's Bicep for accidentally provisioned fixed-cost resources and recommends fixes. Use when designing in…
Instrumenting Azure App Insights
Provisions workspace-based Azure Application Insights with a dailyQuotaGb cost cap and optional metric alerts (5xx spikes, server exceptions) on an Action Group. Outputs the connection string for app settings wiring (APPLICATIONINSIGHTS_CONNECTION_STRING). Use when adding observability to a project, replacing classic non-workspace App Insights (which is retiring), or setting up failure alerts tha…
Orchestrating Azure Deployments
Routes Azure web app work (scaffold, deploy, troubleshoot, evolve) to the right Azure Lean Stack sub-skill. Built around branch-per-environment CI/CD where each git branch maps to one isolated Azure resource group via OIDC. Use when building or deploying a new Azure app, setting up GitHub Actions for Azure, troubleshooting a failed deploy, or adding FC1 / Container Apps / Logic Apps / multi-tenan…
Curating Azure Deployment Learnings
Captures Azure deployment learnings from real projects in a structured format and promotes recurring ones into the diagnosing-azure-deployment-failures gotcha catalogue. Provides scripts to capture a new learning (with project, severity, frontmatter), diff against existing gotchas, and propose promotions with commit-ready text. Use when a deployment problem was solved and the fix should be captur…
Configuring Azure Oidc For Github Actions
Sets up branch-scoped Azure OIDC for GitHub Actions — creates service principals, federated credentials bound to each branch's refs/heads/{branch}, generates SQL passwords, and sets GitHub secrets. Use when bootstrapping CI/CD, onboarding a new environment branch, or fixing AADSTS70021 subject mismatches.
Optimizing Azure Blob Storage Cost
Configures Azure Blob Storage with lifecycle rules that auto-delete stale temp blobs and tier production data through Hot → Cool → Cold without rehydration latency. Provides CORS rules tuned for SPA + SAS uploads/Range reads, public-read branding container alongside private app containers, and SKU/redundancy guidance to keep cost minimal. Use when adding blob storage for uploads, designing storag…
Deploying Fc1 Flex Consumption Functions
Deploys standalone Azure Function Apps on Flex Consumption (FC1) for workloads SWA managed functions can't handle — timer triggers, queue triggers, AI workloads, long-running operations. Provisions via ARM REST API or Bicep because az CLI flags silently fall back to deprecated Y1/Dynamic. Includes the forbidden-app-settings list, the ESM-vs-CommonJS module setting, and managed-identity storage au…
Deploying Azure Container Apps
Deploys Docker containers to Azure Container Apps with scale-to-zero, multi-container sidecars, shared managed environments, and Container Apps Jobs for batch workloads. Use when SWA + FC1 don't fit — long-running servers, WebSocket/SSE streaming, custom Docker runtimes, scheduled or queue-driven background jobs, or multi-process workloads with sidecars.
Deploying Azure Static Web Apps
Deploys React + Azure Functions apps to Azure Static Web Apps with managed API functions, including the CommonJS / index.ts import / route-registration gotchas that make new functions 404 silently. Provides the SWA Bicep module, staticwebapp.config.json routing + security headers, and the API entrypoint convention. Use when scaffolding a SWA-based project, adding a new API function, or fixing a d…
Adding Azure Communication Services Email
Adds transactional email to an Azure web app via Azure Communication Services (ACS) Email — verification emails, password resets, notifications. Encodes the three ACS quirks that consistently break Bicep deploys (location:'global' literal, dataLocation in plain English not Azure region IDs, declare-order to avoid circular dependency), and the safeSend() wrapper that prevents email failures from c…
Scheduling With Azure Logic Apps Consumption
Creates Azure Logic Apps on the Consumption tier for recurring HTTP triggers and lightweight Power-Automate-style flows. Costs ~$0.22/month for a 5-minute recurrence (~8,640 actions at $0.000025 each). Use when adding a scheduled webhook ping, polling a SharePoint list, ticking a microservice every N minutes, or graduating a Power Automate flow that has hit its limits.
Scaffolding Multi Tenant Azure Apps
Scaffolds a multi-tenant Azure app where each tenant gets its own resource group on a shared subscription, with one Bicep main.bicep driven by a single tenant parameter that cascades through every resource name. The default tenant keeps the original (single-tenant) names byte-identical so the pattern works for the first deployment with no migration. Use when onboarding the second tenant onto an a…
Scaffolding Azure Bicep Infrastructure
Generates a subscription-scoped Bicep stack + GitHub Actions workflows for an Azure web app, with opt-in module toggles (SQL, Storage, Observability) and the {org}-{project}-{component}-{env} naming formula. Use when bootstrapping a new Azure project's IaC, adding a Bicep module, or refactoring into the modular-toggle pattern.
Diagnosing Azure Deployment Failures
Matches Azure deploy / CI / runtime failures against 37+ documented gotchas with verified fixes (BCP258, AADSTS70021, sqlcmd-not-found, FC1-CLI-silent-fallback, ACS dataLocation quirks, SSE timeouts, and more). Delegates to Microsoft's azure-diagnostics for live log/metric queries. Use when a deploy fails, a deployed app misbehaves, or a CI step errors.
Managing Azure Sql Migrations
Manages versioned, idempotent Azure SQL migrations that run on every deployment via sqlcmd in GitHub Actions. Provides the migration-history tracking table, the guard-clause template every migration uses, and the workflow step that installs sqlcmd on ubuntu-24.04, manages the SQL firewall with trap cleanup, and runs all files in alphabetical order. Use when adding a new SQL migration, setting up…
Developing Azure Apps Locally
Runs an Azure Lean Stack app fully offline on localhost — API + SQL Server + blob storage — with no Azure dependency, as the "try" tier of the local→test→prod flow on the main branch. Provides a docker-compose stack (SQL Server 2022 + Azurite), a one-command bootstrap, mock-mode for unset service keys, and an optional seed-from-test path. Use when setting up local development, running the app off…