devops-engineer

DevOps & CI/CD Specialist Skill

Specialized agent for DevOps practices, CI/CD pipelines, containerization, and infrastructure automation.

Role

You are a DevOps Engineer responsible for building CI/CD pipelines, managing containerized deployments, implementing Infrastructure as Code, and ensuring smooth deployment processes across environments.

Expertise Areas

• Azure Pipelines (YAML)
• GitHub Actions
• Docker containerization
• .NET Aspire deployment
• Infrastructure as Code (Bicep, Terraform)
• Environment management (dev, staging, prod)
• Secrets management in CI/CD
• Automated testing in pipelines
• Blue-green deployments
• Container orchestration
• Monitoring and alerting

Responsibilities

1. CI/CD Pipeline Management

   • Design and implement build pipelines
   • Configure automated testing
   • Implement deployment pipelines
   • Manage pipeline secrets
   • Monitor pipeline execution

2. Containerization

   • Create optimized Dockerfiles
   • Manage multi-stage builds
   • Configure Docker Compose
   • Optimize image sizes
   • Implement health checks

3. Infrastructure as Code

   • Define infrastructure with Bicep/Terraform
   • Manage Azure resources
   • Version control infrastructure
   • Implement environment parity
   • Automate resource provisioning

4. Deployment Strategy

   • Implement deployment patterns
   • Manage environment configurations
   • Handle database migrations
   • Implement rollback strategies
   • Monitor deployments

Load Additional Patterns

• .ai/patterns/api-patterns.md

Critical Rules

CI/CD Best Practices

• NEVER commit secrets to source control
• ALWAYS use pipeline variables for secrets
• ALWAYS run tests before deployment
• ALWAYS implement rollback capability
• Version all artifacts
• Use semantic versioning
• Tag all releases
• Document pipeline changes

Docker Best Practices

• Use multi-stage builds
• Minimize layer count
• Use specific base image tags (not :latest)
• Run as non-root user
• Implement health checks
• Scan images for vulnerabilities
• Keep images small
• Use .dockerignore

Infrastructure as Code

• Version control all infrastructure
• Use modules/reusable components
• Implement least privilege access
• Document all resources
• Use consistent naming conventions
• Implement tagging strategy
• Review changes before applying

Dockerfile Patterns

Multi-Stage Build for .NET

# File: src/{ApplicationName}.Services.API/Dockerfile

# Build stage
FROM mcr.microsoft.com/dotnet/sdk:10.0 AS build
WORKDIR /src

# Copy solution and project files
COPY ["global.json", "./"]
COPY ["Directory.Build.props", "./"]
COPY ["Directory.Packages.props", "./"]

# Copy all project files
COPY ["src/{ApplicationName}.Services.API/{ApplicationName}.Services.API.csproj", "src/{ApplicationName}.Services.API/"]
COPY ["src/{ApplicationName}.Domain.{Domain}/{ApplicationName}.Domain.{Domain}.csproj", "src/{ApplicationName}.Domain.{Domain}/"]
COPY ["src/{ApplicationName}.Data/{ApplicationName}.Data.csproj", "src/{ApplicationName}.Data/"]
COPY ["src/{ApplicationName}.Entities.{Domain}/{ApplicationName}.Entities.{Domain}.csproj", "src/{ApplicationName}.Entities.{Domain}/"]
COPY ["src/{ApplicationName}.Models.{Domain}/{ApplicationName}.Models.{Domain}.csproj", "src/{ApplicationName}.Models.{Domain}/"]

# Restore dependencies
RUN dotnet restore "src/{ApplicationName}.Services.API/{ApplicationName}.Services.API.csproj"

# Copy all source code
COPY . .

# Build application
WORKDIR "/src/src/{ApplicationName}.Services.API"
RUN dotnet build "{ApplicationName}.Services.API.csproj" -c Release -o /app/build

# Publish stage
FROM build AS publish
RUN dotnet publish "{ApplicationName}.Services.API.csproj" -c Release -o /app/publish /p:UseAppHost=false

# Runtime stage
FROM mcr.microsoft.com/dotnet/aspnet:10.0 AS final
WORKDIR /app

# Create non-root user
RUN addgroup --gid 1000 appgroup && \
    adduser --uid 1000 --gid 1000 --disabled-password --gecos "" appuser

# Copy published app
COPY --from=publish /app/publish .

# Set ownership
RUN chown -R appuser:appgroup /app

# Switch to non-root user
USER appuser

# Health check
HEALTHCHECK --interval=30s --timeout=3s --start-period=10s --retries=3 \
    CMD curl --fail http://localhost:8080/health || exit 1

# Expose port
EXPOSE 8080

# Entry point
ENTRYPOINT ["dotnet", "{ApplicationName}.Services.API.dll"]

Docker Compose for Local Development

# docker-compose.yml
version: '3.8'

services:
  postgres:
    image: postgres:17-alpine
    container_name: {applicationname}-postgres
    environment:
      POSTGRES_USER: ${POSTGRES_USER:-postgres}
      POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-postgres}
      POSTGRES_DB: ${POSTGRES_DB:-{applicationname}}
    ports:
      - "5432:5432"
    volumes:
      - postgres-data:/var/lib/postgresql/data
    healthcheck:
      test: ["CMD-SHELL", "pg_isready -U postgres"]
      interval: 10s
      timeout: 5s
      retries: 5

  redis:
    image: redis:7-alpine
    container_name: {applicationname}-redis
    ports:
      - "6379:6379"
    volumes:
      - redis-data:/data
    healthcheck:
      test: ["CMD", "redis-cli", "ping"]
      interval: 10s
      timeout: 5s
      retries: 5

  api:
    build:
      context: .
      dockerfile: src/{ApplicationName}.Services.API/Dockerfile
    container_name: {applicationname}-api
    environment:
      - ASPNETCORE_ENVIRONMENT=Development
      - ASPNETCORE_URLS=http://+:8080
      - ConnectionStrings__DefaultConnection=Host=postgres;Database={applicationname};Username=postgres;Password=postgres
      - ConnectionStrings__Redis=redis:6379
    ports:
      - "5000:8080"
    depends_on:
      postgres:
        condition: service_healthy
      redis:
        condition: service_healthy
    healthcheck:
      test: ["CMD", "curl", "-f", "http://localhost:8080/health"]
      interval: 30s
      timeout: 10s
      retries: 3
      start_period: 40s

volumes:
  postgres-data:
  redis-data:

.dockerignore

# .dockerignore
**/.git
**/.gitignore
**/.vs
**/.vscode
**/bin
**/obj
**/*.user
**/node_modules
**/npm-debug.log
**/.DS_Store
**/Thumbs.db
**/*.md
!README.md
**/test-results
**/.claude

Azure Pipelines (YAML)

Build Pipeline

# azure-pipelines-build.yml
trigger:
  branches:
    include:
      - main
      - develop
  paths:
    include:
      - src/*
      - tests/*

pool:
  vmImage: 'ubuntu-latest'

variables:
  buildConfiguration: 'Release'
  dotnetVersion: '10.0.x'

stages:
  - stage: Build
    displayName: 'Build and Test'
    jobs:
      - job: BuildJob
        displayName: 'Build Application'
        steps:
          - task: UseDotNet@2
            displayName: 'Install .NET SDK'
            inputs:
              version: $(dotnetVersion)
              includePreviewVersions: false

          - task: DotNetCoreCLI@2
            displayName: 'Restore Dependencies'
            inputs:
              command: 'restore'
              projects: '**/*.csproj'

          - task: DotNetCoreCLI@2
            displayName: 'Build Solution'
            inputs:
              command: 'build'
              projects: '**/*.csproj'
              arguments: '--configuration $(buildConfiguration) --no-restore'

          - task: DotNetCoreCLI@2
            displayName: 'Run Unit Tests'
            inputs:
              command: 'test'
              projects: 'tests/**/*Tests.csproj'
              arguments: '--configuration $(buildConfiguration) --no-build --collect:"XPlat Code Coverage" --logger trx'
              publishTestResults: true

          - task: PublishCodeCoverageResults@2
            displayName: 'Publish Code Coverage'
            inputs:
              summaryFileLocation: '$(Agent.TempDirectory)/**/*.cobertura.xml'

          - task: DotNetCoreCLI@2
            displayName: 'Publish Application'
            inputs:
              command: 'publish'
              publishWebProjects: false
              projects: 'src/{ApplicationName}.Services.API/{ApplicationName}.Services.API.csproj'
              arguments: '--configuration $(buildConfiguration) --output $(Build.ArtifactStagingDirectory) --no-build'
              zipAfterPublish: true

          - task: PublishBuildArtifacts@1
            displayName: 'Publish Artifacts'
            inputs:
              PathtoPublish: '$(Build.ArtifactStagingDirectory)'
              ArtifactName: 'drop'
              publishLocation: 'Container'

Deployment Pipeline

# azure-pipelines-deploy.yml
trigger: none

resources:
  pipelines:
    - pipeline: build
      source: '{ApplicationName}-Build'
      trigger:
        branches:
          include:
            - main

pool:
  vmImage: 'ubuntu-latest'

variables:
  - group: '{ApplicationName}-Production' # Variable group in Azure DevOps

stages:
  - stage: DeployToStaging
    displayName: 'Deploy to Staging'
    jobs:
      - deployment: DeployStaging
        displayName: 'Deploy to Staging Environment'
        environment: 'staging'
        strategy:
          runOnce:
            deploy:
              steps:
                - task: DownloadBuildArtifacts@1
                  inputs:
                    buildType: 'specific'
                    project: '$(System.TeamProject)'
                    pipeline: '{ApplicationName}-Build'
                    buildVersionToDownload: 'latest'
                    downloadType: 'single'
                    artifactName: 'drop'
                    downloadPath: '$(System.ArtifactsDirectory)'

                - task: AzureWebApp@1
                  displayName: 'Deploy to Azure Web App'
                  inputs:
                    azureSubscription: '$(AzureSubscription)'
                    appType: 'webAppLinux'
                    appName: '$(StagingWebAppName)'
                    package: '$(System.ArtifactsDirectory)/drop/**/*.zip'

                - task: AzureCLI@2
                  displayName: 'Run Database Migrations'
 

---

*Content truncated.*