azure-validate

在部署前深度检查 Azure 配置、权限与基础设施就绪情况，提前发现风险。

来源

GitHub

更新于

2026-06-07

// 安全评估低风险

仅提示词，不执行代码
开源可审计

正在进行安全审计…

凭证密钥
网络外发
代码执行
数据访问
来源供应链

// 安装

复制安装指令，让 AI 自动完成配置 · 推荐新手

请帮我安装 askskill 上的 "azure-validate" 技能：
1. 下载 https://raw.githubusercontent.com/microsoft/GitHub-Copilot-for-Azure/main/plugin/skills/azure-validate/SKILL.md
2. 保存为 ~/.claude/skills/azure-validate/SKILL.md
3. 装好后重载技能，告诉我可以用了

// 下载

下载 SKILL.md机读安装清单 ↗

// 用法示例

发布前就绪检查

输入

请帮我验证这个 Azure 应用是否已准备好部署。检查 azure.yaml、环境配置、依赖资源、订阅与区域设置，并列出阻塞部署的问题和修复建议。

预期产出

一份部署前检查报告，说明是否可部署、存在的问题、风险等级及修复建议。

验证 Bicep 或 Terraform

输入

请检查这份 Bicep/Terraform 基础设施定义是否适合在 Azure 部署，验证资源配置、依赖关系、命名、参数、配额与潜在冲突，并指出需要修改的地方。

预期产出

一份基础设施验证结果，包含配置错误、潜在风险、不兼容项与修改建议。

检查 RBAC 与托管身份权限

输入

请验证这个 Azure Functions/Container Apps 部署所需的 RBAC 角色分配和托管身份权限是否齐全，找出缺失权限、作用域错误或最小权限原则问题。

预期产出

一份权限审查结果，列出缺失角色、错误作用域、权限风险及建议的最小权限配置。

// 文档

Azure Validate

AUTHORITATIVE GUIDANCE — Follow these instructions exactly unless they contradict security policies given to you.

⛔ STOP — PREREQUISITE CHECK REQUIRED

Before proceeding, verify this prerequisite is met:

azure-prepare was invoked and completed → .azure/deployment-plan.md exists with status Approved or later

If the plan is missing, STOP IMMEDIATELY and invoke azure-prepare first.

The complete workflow ensures success:

azure-prepare → azure-validate → azure-deploy

Triggers

Check if app is ready to deploy
Validate azure.yaml or Bicep
Run preflight checks
Troubleshoot deployment errors

Rules

Run after azure-prepare, before azure-deploy
All checks must pass—do not deploy with failures
⛔ Destructive actions require ask_user — global-rules

Steps

#	Action	Reference
1	Load Plan — Read `.azure/deployment-plan.md` for recipe and configuration. If missing → run azure-prepare first	`.azure/deployment-plan.md`
2	Add Validation Steps — Copy recipe "Validation Steps" to `.azure/deployment-plan.md` as children of "All validation checks pass"	recipes/README.md, `.azure/deployment-plan.md`
3	Run Validation — Execute recipe-specific validation commands	recipes/README.md
4	Build Verification — Build the project and fix any errors before proceeding	See recipe
5	Static Role Verification — Review Bicep/Terraform for correct RBAC role assignments in code	role-verification.md
6	Record Proof — Populate Section 7: Validation Proof with commands run and results	`.azure/deployment-plan.md`
7	Resolve Errors — Fix failures before proceeding	See recipe's `errors.md`
8	Update Status — Only after ALL checks pass, set status to `Validated`	`.azure/deployment-plan.md`
9	Deploy — Invoke azure-deploy skill	—

⛔ VALIDATION AUTHORITY

This skill is the officially verified way to set plan status to Validated. You MUST follow these steps to make sure every prerequisite is fulfilled before setting status to Validated:

Run actual validation commands (azd provision --preview, bicep build, terraform validate, etc.)

Populate Section 7: Validation Proof with the commands you ran and their results

Only then set status to Validated

Do NOT set status to Validated without running checks and recording proof.

⚠️ MANDATORY NEXT STEP — DO NOT SKIP

After ALL validations pass, you MUST invoke azure-deploy to execute the deployment. Do NOT attempt to run azd up, azd deploy, or any deployment commands directly. Let azure-deploy handle execution.

If any validation failed, fix the issues and re-run azure-validate before proceeding.