Azure DevOps Pipelines: CI/CD na Microsoft Cloud

# azure-pipelines.yml — pipeline real de uma API Node
trigger:
  branches:
    include: [main, release/*]
  paths:
    exclude: [docs/*, README.md]

pr:
  branches:
    include: [main]

variables:
  - group: 'shared-config'          # Variable Group da Library
  - name: NODE_VERSION
    value: '20.x'

pool:
  vmImage: 'ubuntu-latest'

stages:
  - stage: Build
    jobs:
      - job: build_test
        displayName: 'Build & Test'
        steps:
          - task: NodeTool@0
            inputs: { versionSpec: $(NODE_VERSION) }

          - task: Cache@2
            inputs:
              key: 'npm | "$(Agent.OS)" | package-lock.json'
              restoreKeys: |
                npm | "$(Agent.OS)"
              path: $(Pipeline.Workspace)/.npm

          - script: npm ci --cache $(Pipeline.Workspace)/.npm
            displayName: 'Install deps'

          - script: npm run lint
            displayName: 'Lint'

          - script: npm test -- --ci --coverage
            displayName: 'Test'

          - task: PublishTestResults@2
            condition: succeededOrFailed()
            inputs: { testResultsFiles: 'junit.xml' }

          - task: PublishCodeCoverageResults@2
            inputs:
              summaryFileLocation: 'coverage/cobertura-coverage.xml'

          - script: npm run build
          - publish: dist
            artifact: app

- stage: Deploy_Staging
  dependsOn: Build
  condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
  variables:
    - group: aks-staging           # conn string, KV secrets
  jobs:
    - deployment: deploy_aks
      environment: 'staging.aks'   # environment com approval/checks
      strategy:
        runOnce:
          deploy:
            steps:
              - download: current
                artifact: app

              - task: KubernetesManifest@1
                displayName: 'Deploy to AKS'
                inputs:
                  action: 'deploy'
                  kubernetesServiceConnection: 'aks-staging-connection'
                  namespace: 'api'
                  manifests: |
                    k8s/deployment.yaml
                    k8s/service.yaml
                  containers: |
                    acrmeusite.azurecr.io/api:$(Build.BuildId)

- stage: Deploy_Prod
  dependsOn: Deploy_Staging
  jobs:
    - deployment: deploy_prod
      environment: 'production.aks'   # environment exige 2 approvers
      strategy:
        canary:
          increments: [10, 50, 100]
          preDeploy:
            steps:
              - script: echo "Starting canary rollout"
          deploy:
            steps:
              - task: KubernetesManifest@1
                inputs:
                  action: 'deploy'
                  kubernetesServiceConnection: 'aks-prod-connection'
                  namespace: 'api'
                  manifests: k8s/deployment.yaml
                  containers: acrmeusite.azurecr.io/api:$(Build.BuildId)
          postRouteTraffic:
            steps:
              - script: ./scripts/smoke-test.sh $(canary.percentage)
          on:
            failure:
              steps:
                - script: echo "Rollback automático"
            success:
              steps:
                - script: echo "Canary $(canary.percentage)% OK"

# Com WIF, o YAML não muda muito — a mágica é na Service Connection
- task: AzureCLI@2
  inputs:
    azureSubscription: 'prod-wif'     # Service Connection configurada como WIF
    scriptType: bash
    scriptLocation: inlineScript
    inlineScript: |
      az aks get-credentials -n prod-cluster -g prod-rg
      kubectl get pods -A

# templates/node-build.yml  (no repo pipelines-templates)
parameters:
  - name: nodeVersion
    type: string
    default: '20.x'
  - name: runCoverage
    type: boolean
    default: true

steps:
  - task: NodeTool@0
    inputs: { versionSpec: ${'$'}{{ parameters.nodeVersion }} }
  - script: npm ci
  - script: npm run lint
  - script: npm test -- --ci
    displayName: 'Test'
  - ${'$'}{{ if eq(parameters.runCoverage, true) }}:
    - task: PublishCodeCoverageResults@2
      inputs: { summaryFileLocation: 'coverage/cobertura-coverage.xml' }

# pipeline consumidor
resources:
  repositories:
    - repository: templates
      type: git
      name: infra/pipelines-templates
      ref: refs/tags/v2.1.0        # pin de versão

jobs:
  - job: build
    steps:
      - template: templates/node-build.yml@templates
        parameters:
          nodeVersion: '22.x'
          runCoverage: true

trigger:
  branches: { include: [main] }
  paths:
    include:
      - apps/api/**
      - libs/**
      - azure-pipelines-api.yml

jobs:
  - job: test_matrix
    strategy:
      matrix:
        node18_linux:
          NODE: '18.x'
          VMIMG: 'ubuntu-latest'
        node20_linux:
          NODE: '20.x'
          VMIMG: 'ubuntu-latest'
        node20_windows:
          NODE: '20.x'
          VMIMG: 'windows-latest'
    pool:
      vmImage: $(VMIMG)
    steps:
      - task: NodeTool@0
        inputs: { versionSpec: $(NODE) }
      - script: npm ci
      - script: npm test