azure-variable-groups_skill

Overview

This skill manages Azure Pipelines variable groups and library secrets to centralize pipeline configuration. It helps create, update, and link variable groups, integrate Azure Key Vault secrets, and reference environment-specific variables across CI/CD pipelines. Use it to simplify secret handling and maintain consistent settings across Dev, Staging, and Prod.

How this skill works

The skill uses Azure CLI commands and pipeline YAML snippets to create and modify variable groups, add individual variables, and authorize groups for pipeline use. It supports linking Key Vault secrets into variable groups and shows how to pull those secrets into pipeline steps with the AzureKeyVault task. Conditional YAML examples demonstrate swapping groups based on branch or environment.

When to use it

• Centralizing shared pipeline configuration across multiple pipelines or projects
• Storing non-code configuration like database hosts, API endpoints, and feature flags
• Injecting secrets from Azure Key Vault into pipelines without hardcoding values
• Applying environment-specific variables for Dev, Staging, and Production deployments
• Enabling secure, auditable variable management and reuse across teams

Best practices

• Keep secrets in Azure Key Vault and link them to variable groups rather than storing plaintext
• Authorize variable groups for only the pipelines that need them to reduce blast radius
• Use environment- or branch-based conditional groups to avoid manual YAML changes
• Name groups clearly (e.g., Prod-Variables, Dev-Variables, Prod-Secrets) for easy discovery
• Version control pipeline YAML and restrict CLI access with scoped service principals

Example use cases

• Create a Production-Variables group with DB host, DB name, and API URL for deployment pipelines
• Link Key Vault secrets to a Production-Secrets group and reference them in release stages
• Add a new variable to an existing group via az pipelines variable-group variable create
• Conditionally include Dev-Variables when building from the develop branch and Prod-Variables for main
• Run an AzureKeyVault@2 step as a pre-job to fetch all secrets before deployment steps