Audita Azure DevOps Pipelines con Claude Code para agencias

En una agencia web, el pull request, la URL de staging, la aprobación del cliente y el run de Azure Pipelines suelen estar en pestañas distintas. Un cambio pequeño puede llegar a producción porque todos creían que otra persona lo revisó. Este artículo convierte branch policies, ManualValidation y approvals en una tabla de publicación.

Dónde fallan los lanzamientos de agencia

• Separa aprobación de PR, revisión de staging, aprobación del cliente y aprobación de producción.
• Usa branch policies para proteger main o release antes del merge.
• Usa ManualValidation para pausar y revisar staging URL y rollback.
• Usa environment approvals como puerta antes de producción.
• Claude Code resume YAML y diffs; clientes, precios, legal, fecha y rollback quedan en personas.

The source base is Microsoft Learn for pipeline deployment approvals, ManualValidation@1, release approvals, branch policies, and the tasks reference. For an internal release-flow pattern, see the agency cloud release article.

Qué prepara Claude Code y qué aprueban las personas

En una agencia web, el pull request, la URL de staging, la aprobación del cliente y el run de Azure Pipelines suelen estar en pestañas distintas. Un cambio pequeño puede llegar a producción porque todos creían que otra persona lo revisó. Este artículo convierte branch policies, ManualValidation y approvals en una tabla de publicación. Claude Code should read pipeline YAML, PR template, diff summary, staging checklist, branch policy notes, and environment approval notes. It should output a release table that names branch, build, staging deploy, manual validation, production environment, approver, timeout, rollback note, and evidence link.

Humans keep client acceptance, ad claims, pricing, legal copy, publish timing, emergency exceptions, and rollback decision. This distinction keeps the agent from acting like the release owner. The agent prepares evidence; the agency decides.

Tres casos de uso

Use case 1

Entrada: PR URL, diff, build, reviewers, branch policy y página objetivo. Salida: tabla de PR, producción y cliente. Revisión humana: precios, copy legal, anuncios, aprobación del cliente, fecha y rollback.

Use case 2

Entrada: staging URL, email del revisor, capturas, diff, rollback y fecha límite. Salida: instrucciones de ManualValidation@1 y checklist. Revisión humana: móvil, formularios, imágenes, links, analytics y OK del cliente.

Use case 3

Entrada: production environment, approvers, branch control, business hours, exclusive lock y canal. Salida: orden, owner, timeout y contacto de fallo. Revisión humana: no autoaprobación, noche, campañas y owner de rollback.

Prompt para copiar

You are auditing an Azure DevOps release flow for a web agency.
Inputs: azure-pipelines.yml, PR template, branch policy memo, production environment approvals memo, staging URL checklist, and a recent rollback or rework note.
Output:
1. Three-column table: PR review, staging/client review, production approval.
2. ManualValidation@1 instruction text with staging URL, diff, rollback note, owner, and deadline.
3. Production environment approvals and checks proposal.
4. Branch policy list: reviewer, build validation, comment resolution, status check.
5. One first action that can be done in 30 minutes.
Rules: do not let the agent approve client acceptance, pricing, legal wording, publish timing, or production release.

Código de comprobación

const pipelineText = [
  "trigger:",
  "  branches:",
  "    include:",
  "      - main",
  "stages:",
  "  - stage: Build",
  "    jobs:",
  "      - job: build",
  "        steps:",
  "          - script: npm ci && npm run build",
  "  - stage: DeployStaging",
  "    jobs:",
  "      - job: deploy_staging",
  "        steps:",
  "          - script: echo deploy staging",
  "  - stage: ClientCheck",
  "    jobs:",
  "      - job: wait_for_client",
  "        pool: server",
  "        steps:",
  "          - task: ManualValidation@1",
  "            inputs:",
  "              notifyUsers: [email protected]",
  "              instructions: Check staging URL, PR diff, rollback note, and client approval.",
  "  - stage: DeployProduction",
  "    jobs:",
  "      - deployment: production",
  "        environment: production",
  "        strategy:",
  "          runOnce:",
  "            deploy:",
  "              steps:",
  "                - script: echo deploy production"
].join(String.fromCharCode(10));

const required = [
  { name: "main branch trigger", pattern: /- main/ },
  { name: "staging stage", pattern: /DeployStaging/ },
  { name: "manual validation", pattern: /ManualValidation@1/ },
  { name: "server pool for manual validation", pattern: /pool:\s*server/ },
  { name: "production environment", pattern: /environment:\s*production/ },
  { name: "rollback note in approval text", pattern: /rollback/i }
];

const findings = [];
for (const rule of required) {
  if (!rule.pattern.test(pipelineText)) {
    findings.push({ item: rule.name, fix: "add this gate before production release" });
  }
}

const productionIndex = pipelineText.indexOf("DeployProduction");
const validationIndex = pipelineText.indexOf("ManualValidation@1");
if (productionIndex !== -1 && validationIndex !== -1 && validationIndex > productionIndex) {
  findings.push({
    item: "approval order",
    fix: "place client/manual validation before production deployment"
  });
}

console.table(findings);
if (findings.length > 0) process.exitCode = 1;

Pitfall: errores comunes

The first cause is treating PR approval as production approval. The fix is to separate code review, staging review, client acceptance, and production approval by name and owner.

The second cause is relying on notification recipients as if they were approvers. The fix is to inspect environment approval and project permissions separately from notifyUsers.

The third cause is approving without a rollback note. The fix is to add rollback commit, previous artifact, owner, and contact path to the approval text.

The fourth cause is bypassing branch policy under pressure. The fix is to define an emergency exception path with time limit, approver, evidence, and follow-up review.

Preguntas frecuentes

Q. Should we use ManualValidation or environment approval? A. Use ManualValidation for an in-stage pause such as staging URL review. Use environment approvals and checks as the production gate.

Q. Should client approval live inside Azure DevOps? A. If the client does not use Azure DevOps, store the approval URL or message link in the release memo and tie it to the pipeline run.

Q. Does a small content change need branch policy? A. Yes. Pricing pages, hiring pages, and ad landing pages can affect leads and revenue even when the code diff is small.

Q. Can Claude Code approve the release? A. No. It can summarize diff, list missing evidence, and draft checklists. Humans approve production.

Camino a consultoría

Para agencias, el valor no es más YAML. Es menos publicaciones equivocadas y evidencia clara para clientes. Lleva PR reciente, YAML, checklist de staging y rollback a consultoría. Use Claude Code training and consultation if the team needs help turning PRs, pipeline YAML, staging checks, and rollback memos into a repeatable release workflow.

Qué verifiqué

Verifiqué Microsoft Learn sobre approvals, ManualValidation@1, release approvals, branch policies y task reference. Ejecuté el código local y revisa ManualValidation, server pool, production environment y rollback note. Primer paso: separar PR, staging y producción en tres columnas.