# Reusable template — store in shared repo
# templates/deploy-to-aks.yaml
parameters:
  - name: environment
    type: string
  - name: imageTag
    type: string
  - name: namespace
    type: string
    default: default

steps:
  - task: KubernetesManifest@1
    inputs:
      action: deploy
      kubernetesServiceConnection: aks-$(parameters.environment)
      namespace: $(parameters.namespace)
      manifests: k8s/
      containers: myregistry.azurecr.io/myapp:$(parameters.imageTag)

# Main pipeline using the template
stages:
  - stage: Deploy
    jobs:
      - deployment: DeployProd
        environment: production
        strategy:
          runOnce:
            deploy:
              steps:
                - template: templates/deploy-to-aks.yaml@shared-templates
                  parameters:
                    environment: prod
                    imageTag: $(Build.BuildId)

# Automatically close work items when PR merges (requires "complete linked
# work items after merging" enabled on the PR, or a branch policy for it)
# In PR description or commit message:
Fixes AB#1234      # AB# is the reliable prefix for Azure Boards work item links
Resolves AB#1234
# (needs verification — plain "#1234" without the AB# prefix may or may not
#  auto-link depending on repo/integration settings; use AB# to be unambiguous)

# Pipeline: create work item on failure
- task: CreateWorkItem@1
  condition: failed()
  inputs:
    workItemType: Bug
    title: "Pipeline failed: $(Build.DefinitionName) #$(Build.BuildNumber)"
    assignedTo: $(Build.RequestedFor)
    areaPath: MyProject\Engineering
    iterationPath: MyProject\Sprint 1

# Service connections: NEVER put credentials in pipelines
# Use service connections: Project Settings → Service connections

# Pipeline permissions: restrict which pipelines can use a connection
# Resource: Settings → Pipelines → select allowed pipelines

# Secrets from Azure Key Vault
variables:
  - group: prod-secrets   # Variable group linked to Key Vault

# Or directly in pipeline
- task: AzureKeyVault@2
  inputs:
    azureSubscription: prod-service-connection
    KeyVaultName: prod-vault
    SecretsFilter: DB_PASSWORD,API_KEY
    RunAsPreJob: true
# Secrets now available as $(DB_PASSWORD)