Topic 3.3 — Design and implement pipelines · cram sheet

The two defaults everyone gets wrong

Triggers

• Unconfigured = ON: CI on all branches, PR on all branches.
• trigger: none · pr: none to disable.
• exclude beats include.
• batch: true — collect commits during a run.
• Scheduled always: false (default) skips when nothing changed. Cron is UTC.
• YAML says none but it still fires → a UI setting is overriding the YAML.

Agents

• Microsoft-hosted: Services only, concurrency billing, clean VM every run.
• GitHub-hosted for Pipelines: per-minute billing.
• Self-hosted: caches persist · private network · custom software · you own patching.
• Elastic: VMSS agents → Managed DevOps Pools is the current recommendation.
• Hybrid: the agent connects outbound; no inbound ports.

Deployment jobs

• Strategies: runOnce, rolling, canary. Blue-green and ring are patterns, not keywords.
• rolling is VM-only; hooks fire per batch (maxParallel).
• Hook order: preDeploy → deploy → routeTraffic → postRouteTraffic → on:.

Reuse

• Task groups are NOT supported in YAML — classic only. Use templates.
• template: composes · extends: constrains.
• Parameter types: string, object, stepList, jobList, stageList.
• Variable groups: secret variables are protected resources; non-secret are not.
• Variable groups can link to Azure Key Vault.

Checks and approvals

Order: Static → Pre-check approvals → Dynamic → Post-check approvals → Exclusive lock

• Defined by the resource owner, not the pipeline author.
• Static: Branch control · Required template · Evaluate artifact.
• Dynamic: Approval · Azure Function · REST API · Business Hours · Query Azure Monitor alerts.
• Within a category: creation order. Timeout → stage does not execute.

Conditions

succeeded() (implicit) · failed() · always() · canceled() · succeededOrFailed()

• A custom condition replaces succeeded().
• Only always() survives cancellation.

GitHub integration

• GitHub App recommended — runs as the Azure Pipelines identity, works with GitHub Checks.
• OAuth runs as your personal identity.
• Installing for all repos → token reaches all repos, private included.
• Fork PRs do build; secrets are withheld by default.

Matrix

• parallel and matrix are mutually exclusive.
• maxParallel is only valid with matrix.