[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"skill-azure-sdaf-ado-pipeline-catalogue":3,"mdc--pja9c-key":35,"related-org-azure-sdaf-ado-pipeline-catalogue":1394,"related-repo-azure-sdaf-ado-pipeline-catalogue":1569},{"slug":4,"name":4,"fn":5,"description":6,"org":7,"tags":12,"stars":24,"repoUrl":25,"updatedAt":26,"license":27,"forks":28,"topics":29,"repo":30,"sourceUrl":33,"mdContent":34},"sdaf-ado-pipeline-catalogue","reference SDAF Azure DevOps pipelines","Reference catalogue of the 13 Azure DevOps pipeline wrappers that ship in\nsap-automation-bootstrap\u002Fpipelines: what each wrapper does, its documented\nparameters and preconditions, which variable groups it reads\n(SDAF-General, SDAF-\u003Ccontrol-plane>, SDAF-\u003Cworkload-environment>), and the\ndocumented 20 \u002F 21 \u002F 22 self-update (\"level-up\") path. Grounded in\ndocs\u002Fpipeline-reference.md and docs\u002F07-00-operations.md. Use when an\noperator says: \"which pipeline should I run for X?\", \"what does pipeline\n01\u002F02\u002F03\u002F04\u002F05\u002F07\u002F10\u002F11\u002F12\u002F20\u002F21\u002F22 do?\", \"what parameters does the\nworkload-zone pipeline take?\", \"what variable group does 05 read?\",\n\"explain 20 vs 21 vs 22\", \"how do I level up SDAF pipelines?\". NOT for\nstanding the ADO project up in the first place (see\nsdaf-ado-project-bootstrap), for running a deployment, or for GitHub\nActions workflows.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},"azure","Azure (Microsoft)","https:\u002F\u002Fpexgzepcugksgbtrxkhf.supabase.co\u002Fstorage\u002Fv1\u002Fobject\u002Fpublic\u002Forg-logos\u002Fazure.png","Azure",[13,15,18,21],{"name":11,"slug":8,"type":14},"tag",{"name":16,"slug":17,"type":14},"Documentation","documentation",{"name":19,"slug":20,"type":14},"Azure DevOps","azure-devops",{"name":22,"slug":23,"type":14},"SAP","sap",11,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fsap-automation-bootstrap","2026-09-02T07:46:50.474067","MIT",20,[],{"repoUrl":25,"stars":24,"forks":28,"topics":31,"description":32},[],"Bootstrap repo for SDAF","https:\u002F\u002Fgithub.com\u002FAzure\u002Fsap-automation-bootstrap\u002Ftree\u002FHEAD\u002Fskills\u002Fsdaf-ado-pipeline-catalogue","---\nname: sdaf-ado-pipeline-catalogue\ndescription: |\n  Reference catalogue of the 13 Azure DevOps pipeline wrappers that ship in\n  sap-automation-bootstrap\u002Fpipelines: what each wrapper does, its documented\n  parameters and preconditions, which variable groups it reads\n  (SDAF-General, SDAF-\u003Ccontrol-plane>, SDAF-\u003Cworkload-environment>), and the\n  documented 20 \u002F 21 \u002F 22 self-update (\"level-up\") path. Grounded in\n  docs\u002Fpipeline-reference.md and docs\u002F07-00-operations.md. Use when an\n  operator says: \"which pipeline should I run for X?\", \"what does pipeline\n  01\u002F02\u002F03\u002F04\u002F05\u002F07\u002F10\u002F11\u002F12\u002F20\u002F21\u002F22 do?\", \"what parameters does the\n  workload-zone pipeline take?\", \"what variable group does 05 read?\",\n  \"explain 20 vs 21 vs 22\", \"how do I level up SDAF pipelines?\". NOT for\n  standing the ADO project up in the first place (see\n  sdaf-ado-project-bootstrap), for running a deployment, or for GitHub\n  Actions workflows.\nlicense: MIT\n---\n\n# SDAF — Azure DevOps pipeline catalogue\n\nContext primer for the 13 pipeline wrappers shipped in\n[`pipelines\u002F`](..\u002F..\u002Fpipelines\u002F). Answers \"what does this pipeline do, what\ninputs does it take, what does it read, and when should I use it?\" using only\nwhat `docs\u002Fpipeline-reference.md` and `docs\u002F07-00-operations.md` document.\n\nTwo repository-resource files back the wrappers:\n[`pipelines\u002Fresources.yml`](..\u002F..\u002Fpipelines\u002Fresources.yml) declares\n`sap-automation`; [`pipelines\u002Fresources_including_samples.yml`](..\u002F..\u002Fpipelines\u002Fresources_including_samples.yml)\ndeclares `sap-automation` and `sap-samples`. Both currently use `ref: main`.\nAll pipeline files use `trigger: none`\n([`docs\u002Fpipeline-reference.md`](..\u002F..\u002Fdocs\u002Fpipeline-reference.md)).\n\n## When to invoke\n\n- \"What does pipeline `03` do?\" \u002F \"when do I run `10` vs `11` vs `12`?\"\n- \"Which variable group does `05` read?\" \u002F \"what does `SDAF-General` supply?\"\n- \"What are the parameters for the workload-zone pipeline?\"\n- \"How do I level up my ADO pipelines from upstream?\"\n- \"Explain `20` vs `21` vs `22`.\"\n\nDo **not** invoke for:\n\n- Creating the Azure DevOps project, agent pool, MSI, service connections, or\n  variable groups (`sdaf-ado-project-bootstrap`).\n- Actually running a deployment — this skill primes context; it does not\n  drive commands.\n- GitHub Actions workflows.\n\n## Deployment wrappers\n\nEach wrapper lives in\n[`pipelines\u002F`](..\u002F..\u002Fpipelines\u002F) and `extends` a core template in\n`Azure\u002Fsap-automation`. See\n[`docs\u002Fpipeline-reference.md § Deployment wrappers`](..\u002F..\u002Fdocs\u002Fpipeline-reference.md).\n\n| Wrapper | Purpose (documented) | Reads |\n| --- | --- | --- |\n| `01-deploy-control-plane.yml` | Deploys control-plane resources and optional Web App. Key params: `deployer`, `library`, `environment`, `use_deployer`, `reset`, `test`. **`test` is NOT forwarded to deployment scripts.** `reset` may need multiple runs. | `SDAF-\u003Ccontrol-plane>` |\n| `02-sap-workload-zone.yml` | Stores credentials in Key Vault and deploys the workload zone. `test: true` reaches the installer and exits after `terraform plan`. Params include `inherit_settings`. | `SDAF-\u003Cworkload-environment>` |\n| `03-sap-system-deployment.yml` | Deploys SAP-system infrastructure from a prepared `SYSTEM` configuration. Params: `sap_system`, `environment`, `test` (plan-only via `TEST_ONLY`). | `SDAF-\u003Cworkload-environment>` |\n| `04-sap-software-download.yml` | Downloads a selected combined BOM. Uses `resources_including_samples.yml`. Params: combined BOM, override, environment, region, extras, `re_download`. | `SDAF-\u003Cworkload-environment>` (+ shared values from `SDAF-General`) |\n| `04-sap-software-download_v2.yml` | Documented alongside `04` in `docs\u002Fpipeline-reference.md § Deployment wrappers`: constructs a combined BOM from application, database, and kernel BOMs and derives region from environment. Uses `resources_including_samples.yml`. Public selection criteria versus `04` are **unresolved in docs**. | `SDAF-\u003Cworkload-environment>` (+ shared values from `SDAF-General`) |\n| `05-DB-and-SAP-installation.yml` | Runs parameter validation and selected Ansible install stages. Params: system, environment, BOM, stage booleans, extras. The core job has no timeout. | `SDAF-\u003Cworkload-environment>` |\n| `07-sap-cal-installation.yml` | SAP CAL install wrapper. **The referenced core template was absent from the validated core checkout**; do not run until the selected core `ref` supplies a validated template ([`docs\u002Fpipeline-reference.md`](..\u002F..\u002Fdocs\u002Fpipeline-reference.md)). | `SDAF-\u003Cworkload-environment>` |\n\n**Validation evidence:** deployment templates change Azure resources,\nTerraform state, Key Vault content, SAP library content, or host\nconfiguration. They do not publish a general plan artefact through these\nwrappers. Use run logs, Terraform output, Azure resources, state, and\nservice checks. Pipeline `01`'s `test` parameter does **not** drive a dry run.\n`02` and `03` provide plan-only through `TEST_ONLY`.\n\n## Removal wrappers\n\nReverse-dependency order. Prefer Terraform removal; ARM fallback is\nlast-resort, not a normal retry ([`docs\u002Fpipeline-reference.md § Removal\nwrappers`](..\u002F..\u002Fdocs\u002Fpipeline-reference.md)).\n\n| Wrapper | Documented behaviour |\n| --- | --- |\n| `10-remover-terraform.yml` | Terraform-based removal of the SAP system and workload zone per `cleanup_sap` \u002F `cleanup_zone`. Wrapper defaults: SAP-system cleanup enabled, workload-zone cleanup disabled. |\n| `11-remover-arm-fallback.yml` | Deletes selected resource groups via ARM and removes corresponding `WORKSPACES` artefacts. All three cleanup scopes default to enabled in the wrapper. Last resort. |\n| `12-remove-control-plane.yml` | Removes the control plane in a deployer-agent stage and a finalization stage. Loads the control-plane variable group; uses `AZURE_CONNECTION_NAME`. |\n\n## Standalone configuration and update pipelines — the 20 \u002F 21 \u002F 22 level-up path\n\nDocumented in [`docs\u002Fpipeline-reference.md § Standalone configuration and\nupdate pipelines`](..\u002F..\u002Fdocs\u002Fpipeline-reference.md) and\n[`docs\u002F07-00-operations.md`](..\u002F..\u002Fdocs\u002F07-00-operations.md).\n\n| Pipeline | Behaviour |\n| --- | --- |\n| `20-update-repositories.yml` | Pulls GitHub content into the Azure Repos core and sample repositories. Params: core source URL, sample source URL, branch, tag, `force`. `force: true` force-pushes. |\n| `21-update-pipelines.yml` | Copies an enumerated set of wrapper files from source `main` into the bootstrap repository, commits, pushes. **Omits `_v2` and `07`.** `force: true` force-pushes. |\n| `22-sample-deployer-configuration.yml` | Creates missing deployer and library examples, commits them, rewrites selected wrapper defaults, pushes each change. Does **not** generate complete workload-zone or SAP-system configuration. Params include control-plane and workload names, region, optional services, deployer count, identity. |\n\n**Level-up sequence.** `docs\u002F07-00-operations.md` documents these pipelines\nin the order `20` (refresh source refs into Azure Repos) → `21` (refresh\nwrapper files in this repository) → `22` (regenerate optional deployer \u002F\nlibrary samples). Treat that as the documented order, not a mandate the\ndocs enforce. Keep `force=false` unless a rollback is being executed. Re-run\ndependent deploy stages only after reviewing the new configuration and\npreserving state.\n\n## Variable-group dependencies\n\nFrom [`docs\u002Fpipeline-reference.md § Variable-group dependencies`](..\u002F..\u002Fdocs\u002Fpipeline-reference.md):\n\n- Infrastructure templates load `SDAF-General`.\n- Control-plane templates load `SDAF-\u003Ccontrol-plane>`.\n- Workload-zone, SAP-system, software, installation, and workload removal\n  templates load `SDAF-\u003Cworkload-environment>` as applicable.\n- `SDAF-General` supplies shared values including\n  `Deployment_Configuration_Path`, tool versions, and SAP credentials\n  (`S-Username` \u002F `S-Password`).\n- Environment groups supply Azure identity, subscription, connection, agent,\n  state, and Key Vault values.\n\nAn exhaustive per-variable catalogue for each environment group is **NOT\ndocumented** in this repository. When an operator asks for the full field\nlist, state that gap and point at the two \"Configure\" pages that create the\ngroups.\n\n## Preconditions common to every pipeline\n\nDocumented in [`docs\u002F02-00-bootstrap.md`](..\u002F..\u002Fdocs\u002F02-00-bootstrap.md) and\n[`docs\u002F02-10-configure-devops-project.md`](..\u002F..\u002Fdocs\u002F02-10-configure-devops-project.md):\n\n1. The pipeline YAML path is created as a pipeline definition in the project.\n2. Repository resources in `resources.yml` \u002F\n   `resources_including_samples.yml` resolve their declared repositories.\n3. The Post Build Cleanup extension (`PostBuildCleanup@4`) is installed.\n4. The referenced agent pool exists, has an online compatible agent, and is\n   authorized for the pipeline.\n5. Every referenced variable group and service connection is authorized for\n   the pipeline.\n\n## See also\n\n- `sdaf-ado-project-bootstrap` — creates the project, pipelines, agent pool,\n  MSI, service connections, variable groups, and Web App that this catalogue\n  describes.\n- [`docs\u002Ftroubleshooting.md`](..\u002F..\u002Fdocs\u002Ftroubleshooting.md) — precondition\n  failures (variable group missing, service connection fails, no agent,\n  repository checkout fails, configuration not found).\n- [`docs\u002F07-00-operations.md`](..\u002F..\u002Fdocs\u002F07-00-operations.md) — operator\n  context for level-up and removal ordering.",{"data":36,"body":37},{"name":4,"description":6,"license":27},{"type":38,"children":39},"root",[40,49,85,163,170,269,282,307,313,354,775,826,832,847,950,956,982,1110,1155,1161,1177,1251,1263,1269,1295,1347,1353],{"type":41,"tag":42,"props":43,"children":45},"element","h1",{"id":44},"sdaf-azure-devops-pipeline-catalogue",[46],{"type":47,"value":48},"text","SDAF — Azure DevOps pipeline catalogue",{"type":41,"tag":50,"props":51,"children":52},"p",{},[53,55,67,69,75,77,83],{"type":47,"value":54},"Context primer for the 13 pipeline wrappers shipped in\n",{"type":41,"tag":56,"props":57,"children":59},"a",{"href":58},"..\u002F..\u002Fpipelines\u002F",[60],{"type":41,"tag":61,"props":62,"children":64},"code",{"className":63},[],[65],{"type":47,"value":66},"pipelines\u002F",{"type":47,"value":68},". Answers \"what does this pipeline do, what\ninputs does it take, what does it read, and when should I use it?\" using only\nwhat ",{"type":41,"tag":61,"props":70,"children":72},{"className":71},[],[73],{"type":47,"value":74},"docs\u002Fpipeline-reference.md",{"type":47,"value":76}," and ",{"type":41,"tag":61,"props":78,"children":80},{"className":79},[],[81],{"type":47,"value":82},"docs\u002F07-00-operations.md",{"type":47,"value":84}," document.",{"type":41,"tag":50,"props":86,"children":87},{},[88,90,100,102,108,110,120,122,127,128,134,136,142,144,150,152,161],{"type":47,"value":89},"Two repository-resource files back the wrappers:\n",{"type":41,"tag":56,"props":91,"children":93},{"href":92},"..\u002F..\u002Fpipelines\u002Fresources.yml",[94],{"type":41,"tag":61,"props":95,"children":97},{"className":96},[],[98],{"type":47,"value":99},"pipelines\u002Fresources.yml",{"type":47,"value":101}," declares\n",{"type":41,"tag":61,"props":103,"children":105},{"className":104},[],[106],{"type":47,"value":107},"sap-automation",{"type":47,"value":109},"; ",{"type":41,"tag":56,"props":111,"children":113},{"href":112},"..\u002F..\u002Fpipelines\u002Fresources_including_samples.yml",[114],{"type":41,"tag":61,"props":115,"children":117},{"className":116},[],[118],{"type":47,"value":119},"pipelines\u002Fresources_including_samples.yml",{"type":47,"value":121},"\ndeclares ",{"type":41,"tag":61,"props":123,"children":125},{"className":124},[],[126],{"type":47,"value":107},{"type":47,"value":76},{"type":41,"tag":61,"props":129,"children":131},{"className":130},[],[132],{"type":47,"value":133},"sap-samples",{"type":47,"value":135},". Both currently use ",{"type":41,"tag":61,"props":137,"children":139},{"className":138},[],[140],{"type":47,"value":141},"ref: main",{"type":47,"value":143},".\nAll pipeline files use ",{"type":41,"tag":61,"props":145,"children":147},{"className":146},[],[148],{"type":47,"value":149},"trigger: none",{"type":47,"value":151},"\n(",{"type":41,"tag":56,"props":153,"children":155},{"href":154},"..\u002F..\u002Fdocs\u002Fpipeline-reference.md",[156],{"type":41,"tag":61,"props":157,"children":159},{"className":158},[],[160],{"type":47,"value":74},{"type":47,"value":162},").",{"type":41,"tag":164,"props":165,"children":167},"h2",{"id":166},"when-to-invoke",[168],{"type":47,"value":169},"When to invoke",{"type":41,"tag":171,"props":172,"children":173},"ul",{},[174,211,232,237,242],{"type":41,"tag":175,"props":176,"children":177},"li",{},[178,180,186,188,194,196,202,203,209],{"type":47,"value":179},"\"What does pipeline ",{"type":41,"tag":61,"props":181,"children":183},{"className":182},[],[184],{"type":47,"value":185},"03",{"type":47,"value":187}," do?\" \u002F \"when do I run ",{"type":41,"tag":61,"props":189,"children":191},{"className":190},[],[192],{"type":47,"value":193},"10",{"type":47,"value":195}," vs ",{"type":41,"tag":61,"props":197,"children":199},{"className":198},[],[200],{"type":47,"value":201},"11",{"type":47,"value":195},{"type":41,"tag":61,"props":204,"children":206},{"className":205},[],[207],{"type":47,"value":208},"12",{"type":47,"value":210},"?\"",{"type":41,"tag":175,"props":212,"children":213},{},[214,216,222,224,230],{"type":47,"value":215},"\"Which variable group does ",{"type":41,"tag":61,"props":217,"children":219},{"className":218},[],[220],{"type":47,"value":221},"05",{"type":47,"value":223}," read?\" \u002F \"what does ",{"type":41,"tag":61,"props":225,"children":227},{"className":226},[],[228],{"type":47,"value":229},"SDAF-General",{"type":47,"value":231}," supply?\"",{"type":41,"tag":175,"props":233,"children":234},{},[235],{"type":47,"value":236},"\"What are the parameters for the workload-zone pipeline?\"",{"type":41,"tag":175,"props":238,"children":239},{},[240],{"type":47,"value":241},"\"How do I level up my ADO pipelines from upstream?\"",{"type":41,"tag":175,"props":243,"children":244},{},[245,247,253,254,260,261,267],{"type":47,"value":246},"\"Explain ",{"type":41,"tag":61,"props":248,"children":250},{"className":249},[],[251],{"type":47,"value":252},"20",{"type":47,"value":195},{"type":41,"tag":61,"props":255,"children":257},{"className":256},[],[258],{"type":47,"value":259},"21",{"type":47,"value":195},{"type":41,"tag":61,"props":262,"children":264},{"className":263},[],[265],{"type":47,"value":266},"22",{"type":47,"value":268},".\"",{"type":41,"tag":50,"props":270,"children":271},{},[272,274,280],{"type":47,"value":273},"Do ",{"type":41,"tag":275,"props":276,"children":277},"strong",{},[278],{"type":47,"value":279},"not",{"type":47,"value":281}," invoke for:",{"type":41,"tag":171,"props":283,"children":284},{},[285,297,302],{"type":41,"tag":175,"props":286,"children":287},{},[288,290,296],{"type":47,"value":289},"Creating the Azure DevOps project, agent pool, MSI, service connections, or\nvariable groups (",{"type":41,"tag":61,"props":291,"children":293},{"className":292},[],[294],{"type":47,"value":295},"sdaf-ado-project-bootstrap",{"type":47,"value":162},{"type":41,"tag":175,"props":298,"children":299},{},[300],{"type":47,"value":301},"Actually running a deployment — this skill primes context; it does not\ndrive commands.",{"type":41,"tag":175,"props":303,"children":304},{},[305],{"type":47,"value":306},"GitHub Actions workflows.",{"type":41,"tag":164,"props":308,"children":310},{"id":309},"deployment-wrappers",[311],{"type":47,"value":312},"Deployment wrappers",{"type":41,"tag":50,"props":314,"children":315},{},[316,318,326,327,333,335,341,343,352],{"type":47,"value":317},"Each wrapper lives in\n",{"type":41,"tag":56,"props":319,"children":320},{"href":58},[321],{"type":41,"tag":61,"props":322,"children":324},{"className":323},[],[325],{"type":47,"value":66},{"type":47,"value":76},{"type":41,"tag":61,"props":328,"children":330},{"className":329},[],[331],{"type":47,"value":332},"extends",{"type":47,"value":334}," a core template in\n",{"type":41,"tag":61,"props":336,"children":338},{"className":337},[],[339],{"type":47,"value":340},"Azure\u002Fsap-automation",{"type":47,"value":342},". See\n",{"type":41,"tag":56,"props":344,"children":345},{"href":154},[346],{"type":41,"tag":61,"props":347,"children":349},{"className":348},[],[350],{"type":47,"value":351},"docs\u002Fpipeline-reference.md § Deployment wrappers",{"type":47,"value":353},".",{"type":41,"tag":355,"props":356,"children":357},"table",{},[358,382],{"type":41,"tag":359,"props":360,"children":361},"thead",{},[362],{"type":41,"tag":363,"props":364,"children":365},"tr",{},[366,372,377],{"type":41,"tag":367,"props":368,"children":369},"th",{},[370],{"type":47,"value":371},"Wrapper",{"type":41,"tag":367,"props":373,"children":374},{},[375],{"type":47,"value":376},"Purpose (documented)",{"type":41,"tag":367,"props":378,"children":379},{},[380],{"type":47,"value":381},"Reads",{"type":41,"tag":383,"props":384,"children":385},"tbody",{},[386,476,525,585,634,701,726],{"type":41,"tag":363,"props":387,"children":388},{},[389,399,467],{"type":41,"tag":390,"props":391,"children":392},"td",{},[393],{"type":41,"tag":61,"props":394,"children":396},{"className":395},[],[397],{"type":47,"value":398},"01-deploy-control-plane.yml",{"type":41,"tag":390,"props":400,"children":401},{},[402,404,410,412,418,419,425,426,432,433,439,440,446,448,458,460,465],{"type":47,"value":403},"Deploys control-plane resources and optional Web App. Key params: ",{"type":41,"tag":61,"props":405,"children":407},{"className":406},[],[408],{"type":47,"value":409},"deployer",{"type":47,"value":411},", ",{"type":41,"tag":61,"props":413,"children":415},{"className":414},[],[416],{"type":47,"value":417},"library",{"type":47,"value":411},{"type":41,"tag":61,"props":420,"children":422},{"className":421},[],[423],{"type":47,"value":424},"environment",{"type":47,"value":411},{"type":41,"tag":61,"props":427,"children":429},{"className":428},[],[430],{"type":47,"value":431},"use_deployer",{"type":47,"value":411},{"type":41,"tag":61,"props":434,"children":436},{"className":435},[],[437],{"type":47,"value":438},"reset",{"type":47,"value":411},{"type":41,"tag":61,"props":441,"children":443},{"className":442},[],[444],{"type":47,"value":445},"test",{"type":47,"value":447},". ",{"type":41,"tag":275,"props":449,"children":450},{},[451,456],{"type":41,"tag":61,"props":452,"children":454},{"className":453},[],[455],{"type":47,"value":445},{"type":47,"value":457}," is NOT forwarded to deployment scripts.",{"type":47,"value":459}," ",{"type":41,"tag":61,"props":461,"children":463},{"className":462},[],[464],{"type":47,"value":438},{"type":47,"value":466}," may need multiple runs.",{"type":41,"tag":390,"props":468,"children":469},{},[470],{"type":41,"tag":61,"props":471,"children":473},{"className":472},[],[474],{"type":47,"value":475},"SDAF-\u003Ccontrol-plane>",{"type":41,"tag":363,"props":477,"children":478},{},[479,488,516],{"type":41,"tag":390,"props":480,"children":481},{},[482],{"type":41,"tag":61,"props":483,"children":485},{"className":484},[],[486],{"type":47,"value":487},"02-sap-workload-zone.yml",{"type":41,"tag":390,"props":489,"children":490},{},[491,493,499,501,507,509,515],{"type":47,"value":492},"Stores credentials in Key Vault and deploys the workload zone. ",{"type":41,"tag":61,"props":494,"children":496},{"className":495},[],[497],{"type":47,"value":498},"test: true",{"type":47,"value":500}," reaches the installer and exits after ",{"type":41,"tag":61,"props":502,"children":504},{"className":503},[],[505],{"type":47,"value":506},"terraform plan",{"type":47,"value":508},". Params include ",{"type":41,"tag":61,"props":510,"children":512},{"className":511},[],[513],{"type":47,"value":514},"inherit_settings",{"type":47,"value":353},{"type":41,"tag":390,"props":517,"children":518},{},[519],{"type":41,"tag":61,"props":520,"children":522},{"className":521},[],[523],{"type":47,"value":524},"SDAF-\u003Cworkload-environment>",{"type":41,"tag":363,"props":526,"children":527},{},[528,537,577],{"type":41,"tag":390,"props":529,"children":530},{},[531],{"type":41,"tag":61,"props":532,"children":534},{"className":533},[],[535],{"type":47,"value":536},"03-sap-system-deployment.yml",{"type":41,"tag":390,"props":538,"children":539},{},[540,542,548,550,556,557,562,563,568,570,576],{"type":47,"value":541},"Deploys SAP-system infrastructure from a prepared ",{"type":41,"tag":61,"props":543,"children":545},{"className":544},[],[546],{"type":47,"value":547},"SYSTEM",{"type":47,"value":549}," configuration. Params: ",{"type":41,"tag":61,"props":551,"children":553},{"className":552},[],[554],{"type":47,"value":555},"sap_system",{"type":47,"value":411},{"type":41,"tag":61,"props":558,"children":560},{"className":559},[],[561],{"type":47,"value":424},{"type":47,"value":411},{"type":41,"tag":61,"props":564,"children":566},{"className":565},[],[567],{"type":47,"value":445},{"type":47,"value":569}," (plan-only via ",{"type":41,"tag":61,"props":571,"children":573},{"className":572},[],[574],{"type":47,"value":575},"TEST_ONLY",{"type":47,"value":162},{"type":41,"tag":390,"props":578,"children":579},{},[580],{"type":41,"tag":61,"props":581,"children":583},{"className":582},[],[584],{"type":47,"value":524},{"type":41,"tag":363,"props":586,"children":587},{},[588,597,617],{"type":41,"tag":390,"props":589,"children":590},{},[591],{"type":41,"tag":61,"props":592,"children":594},{"className":593},[],[595],{"type":47,"value":596},"04-sap-software-download.yml",{"type":41,"tag":390,"props":598,"children":599},{},[600,602,608,610,616],{"type":47,"value":601},"Downloads a selected combined BOM. Uses ",{"type":41,"tag":61,"props":603,"children":605},{"className":604},[],[606],{"type":47,"value":607},"resources_including_samples.yml",{"type":47,"value":609},". Params: combined BOM, override, environment, region, extras, ",{"type":41,"tag":61,"props":611,"children":613},{"className":612},[],[614],{"type":47,"value":615},"re_download",{"type":47,"value":353},{"type":41,"tag":390,"props":618,"children":619},{},[620,625,627,632],{"type":41,"tag":61,"props":621,"children":623},{"className":622},[],[624],{"type":47,"value":524},{"type":47,"value":626}," (+ shared values from ",{"type":41,"tag":61,"props":628,"children":630},{"className":629},[],[631],{"type":47,"value":229},{"type":47,"value":633},")",{"type":41,"tag":363,"props":635,"children":636},{},[637,646,686],{"type":41,"tag":390,"props":638,"children":639},{},[640],{"type":41,"tag":61,"props":641,"children":643},{"className":642},[],[644],{"type":47,"value":645},"04-sap-software-download_v2.yml",{"type":41,"tag":390,"props":647,"children":648},{},[649,651,657,659,664,666,671,673,678,680,685],{"type":47,"value":650},"Documented alongside ",{"type":41,"tag":61,"props":652,"children":654},{"className":653},[],[655],{"type":47,"value":656},"04",{"type":47,"value":658}," in ",{"type":41,"tag":61,"props":660,"children":662},{"className":661},[],[663],{"type":47,"value":351},{"type":47,"value":665},": constructs a combined BOM from application, database, and kernel BOMs and derives region from environment. Uses ",{"type":41,"tag":61,"props":667,"children":669},{"className":668},[],[670],{"type":47,"value":607},{"type":47,"value":672},". Public selection criteria versus ",{"type":41,"tag":61,"props":674,"children":676},{"className":675},[],[677],{"type":47,"value":656},{"type":47,"value":679}," are ",{"type":41,"tag":275,"props":681,"children":682},{},[683],{"type":47,"value":684},"unresolved in docs",{"type":47,"value":353},{"type":41,"tag":390,"props":687,"children":688},{},[689,694,695,700],{"type":41,"tag":61,"props":690,"children":692},{"className":691},[],[693],{"type":47,"value":524},{"type":47,"value":626},{"type":41,"tag":61,"props":696,"children":698},{"className":697},[],[699],{"type":47,"value":229},{"type":47,"value":633},{"type":41,"tag":363,"props":702,"children":703},{},[704,713,718],{"type":41,"tag":390,"props":705,"children":706},{},[707],{"type":41,"tag":61,"props":708,"children":710},{"className":709},[],[711],{"type":47,"value":712},"05-DB-and-SAP-installation.yml",{"type":41,"tag":390,"props":714,"children":715},{},[716],{"type":47,"value":717},"Runs parameter validation and selected Ansible install stages. Params: system, environment, BOM, stage booleans, extras. The core job has no timeout.",{"type":41,"tag":390,"props":719,"children":720},{},[721],{"type":41,"tag":61,"props":722,"children":724},{"className":723},[],[725],{"type":47,"value":524},{"type":41,"tag":363,"props":727,"children":728},{},[729,738,767],{"type":41,"tag":390,"props":730,"children":731},{},[732],{"type":41,"tag":61,"props":733,"children":735},{"className":734},[],[736],{"type":47,"value":737},"07-sap-cal-installation.yml",{"type":41,"tag":390,"props":739,"children":740},{},[741,743,748,750,756,758,766],{"type":47,"value":742},"SAP CAL install wrapper. ",{"type":41,"tag":275,"props":744,"children":745},{},[746],{"type":47,"value":747},"The referenced core template was absent from the validated core checkout",{"type":47,"value":749},"; do not run until the selected core ",{"type":41,"tag":61,"props":751,"children":753},{"className":752},[],[754],{"type":47,"value":755},"ref",{"type":47,"value":757}," supplies a validated template (",{"type":41,"tag":56,"props":759,"children":760},{"href":154},[761],{"type":41,"tag":61,"props":762,"children":764},{"className":763},[],[765],{"type":47,"value":74},{"type":47,"value":162},{"type":41,"tag":390,"props":768,"children":769},{},[770],{"type":41,"tag":61,"props":771,"children":773},{"className":772},[],[774],{"type":47,"value":524},{"type":41,"tag":50,"props":776,"children":777},{},[778,783,785,791,793,798,800,804,806,812,813,818,820,825],{"type":41,"tag":275,"props":779,"children":780},{},[781],{"type":47,"value":782},"Validation evidence:",{"type":47,"value":784}," deployment templates change Azure resources,\nTerraform state, Key Vault content, SAP library content, or host\nconfiguration. They do not publish a general plan artefact through these\nwrappers. Use run logs, Terraform output, Azure resources, state, and\nservice checks. Pipeline ",{"type":41,"tag":61,"props":786,"children":788},{"className":787},[],[789],{"type":47,"value":790},"01",{"type":47,"value":792},"'s ",{"type":41,"tag":61,"props":794,"children":796},{"className":795},[],[797],{"type":47,"value":445},{"type":47,"value":799}," parameter does ",{"type":41,"tag":275,"props":801,"children":802},{},[803],{"type":47,"value":279},{"type":47,"value":805}," drive a dry run.\n",{"type":41,"tag":61,"props":807,"children":809},{"className":808},[],[810],{"type":47,"value":811},"02",{"type":47,"value":76},{"type":41,"tag":61,"props":814,"children":816},{"className":815},[],[817],{"type":47,"value":185},{"type":47,"value":819}," provide plan-only through ",{"type":41,"tag":61,"props":821,"children":823},{"className":822},[],[824],{"type":47,"value":575},{"type":47,"value":353},{"type":41,"tag":164,"props":827,"children":829},{"id":828},"removal-wrappers",[830],{"type":47,"value":831},"Removal wrappers",{"type":41,"tag":50,"props":833,"children":834},{},[835,837,846],{"type":47,"value":836},"Reverse-dependency order. Prefer Terraform removal; ARM fallback is\nlast-resort, not a normal retry (",{"type":41,"tag":56,"props":838,"children":839},{"href":154},[840],{"type":41,"tag":61,"props":841,"children":843},{"className":842},[],[844],{"type":47,"value":845},"docs\u002Fpipeline-reference.md § Removal wrappers",{"type":47,"value":162},{"type":41,"tag":355,"props":848,"children":849},{},[850,865],{"type":41,"tag":359,"props":851,"children":852},{},[853],{"type":41,"tag":363,"props":854,"children":855},{},[856,860],{"type":41,"tag":367,"props":857,"children":858},{},[859],{"type":47,"value":371},{"type":41,"tag":367,"props":861,"children":862},{},[863],{"type":47,"value":864},"Documented behaviour",{"type":41,"tag":383,"props":866,"children":867},{},[868,901,926],{"type":41,"tag":363,"props":869,"children":870},{},[871,880],{"type":41,"tag":390,"props":872,"children":873},{},[874],{"type":41,"tag":61,"props":875,"children":877},{"className":876},[],[878],{"type":47,"value":879},"10-remover-terraform.yml",{"type":41,"tag":390,"props":881,"children":882},{},[883,885,891,893,899],{"type":47,"value":884},"Terraform-based removal of the SAP system and workload zone per ",{"type":41,"tag":61,"props":886,"children":888},{"className":887},[],[889],{"type":47,"value":890},"cleanup_sap",{"type":47,"value":892}," \u002F ",{"type":41,"tag":61,"props":894,"children":896},{"className":895},[],[897],{"type":47,"value":898},"cleanup_zone",{"type":47,"value":900},". Wrapper defaults: SAP-system cleanup enabled, workload-zone cleanup disabled.",{"type":41,"tag":363,"props":902,"children":903},{},[904,913],{"type":41,"tag":390,"props":905,"children":906},{},[907],{"type":41,"tag":61,"props":908,"children":910},{"className":909},[],[911],{"type":47,"value":912},"11-remover-arm-fallback.yml",{"type":41,"tag":390,"props":914,"children":915},{},[916,918,924],{"type":47,"value":917},"Deletes selected resource groups via ARM and removes corresponding ",{"type":41,"tag":61,"props":919,"children":921},{"className":920},[],[922],{"type":47,"value":923},"WORKSPACES",{"type":47,"value":925}," artefacts. All three cleanup scopes default to enabled in the wrapper. Last resort.",{"type":41,"tag":363,"props":927,"children":928},{},[929,938],{"type":41,"tag":390,"props":930,"children":931},{},[932],{"type":41,"tag":61,"props":933,"children":935},{"className":934},[],[936],{"type":47,"value":937},"12-remove-control-plane.yml",{"type":41,"tag":390,"props":939,"children":940},{},[941,943,949],{"type":47,"value":942},"Removes the control plane in a deployer-agent stage and a finalization stage. Loads the control-plane variable group; uses ",{"type":41,"tag":61,"props":944,"children":946},{"className":945},[],[947],{"type":47,"value":948},"AZURE_CONNECTION_NAME",{"type":47,"value":353},{"type":41,"tag":164,"props":951,"children":953},{"id":952},"standalone-configuration-and-update-pipelines-the-20-21-22-level-up-path",[954],{"type":47,"value":955},"Standalone configuration and update pipelines — the 20 \u002F 21 \u002F 22 level-up path",{"type":41,"tag":50,"props":957,"children":958},{},[959,961,970,972,981],{"type":47,"value":960},"Documented in ",{"type":41,"tag":56,"props":962,"children":963},{"href":154},[964],{"type":41,"tag":61,"props":965,"children":967},{"className":966},[],[968],{"type":47,"value":969},"docs\u002Fpipeline-reference.md § Standalone configuration and update pipelines",{"type":47,"value":971}," and\n",{"type":41,"tag":56,"props":973,"children":975},{"href":974},"..\u002F..\u002Fdocs\u002F07-00-operations.md",[976],{"type":41,"tag":61,"props":977,"children":979},{"className":978},[],[980],{"type":47,"value":82},{"type":47,"value":353},{"type":41,"tag":355,"props":983,"children":984},{},[985,1001],{"type":41,"tag":359,"props":986,"children":987},{},[988],{"type":41,"tag":363,"props":989,"children":990},{},[991,996],{"type":41,"tag":367,"props":992,"children":993},{},[994],{"type":47,"value":995},"Pipeline",{"type":41,"tag":367,"props":997,"children":998},{},[999],{"type":47,"value":1000},"Behaviour",{"type":41,"tag":383,"props":1002,"children":1003},{},[1004,1036,1087],{"type":41,"tag":363,"props":1005,"children":1006},{},[1007,1016],{"type":41,"tag":390,"props":1008,"children":1009},{},[1010],{"type":41,"tag":61,"props":1011,"children":1013},{"className":1012},[],[1014],{"type":47,"value":1015},"20-update-repositories.yml",{"type":41,"tag":390,"props":1017,"children":1018},{},[1019,1021,1027,1028,1034],{"type":47,"value":1020},"Pulls GitHub content into the Azure Repos core and sample repositories. Params: core source URL, sample source URL, branch, tag, ",{"type":41,"tag":61,"props":1022,"children":1024},{"className":1023},[],[1025],{"type":47,"value":1026},"force",{"type":47,"value":447},{"type":41,"tag":61,"props":1029,"children":1031},{"className":1030},[],[1032],{"type":47,"value":1033},"force: true",{"type":47,"value":1035}," force-pushes.",{"type":41,"tag":363,"props":1037,"children":1038},{},[1039,1048],{"type":41,"tag":390,"props":1040,"children":1041},{},[1042],{"type":41,"tag":61,"props":1043,"children":1045},{"className":1044},[],[1046],{"type":47,"value":1047},"21-update-pipelines.yml",{"type":41,"tag":390,"props":1049,"children":1050},{},[1051,1053,1059,1061,1080,1081,1086],{"type":47,"value":1052},"Copies an enumerated set of wrapper files from source ",{"type":41,"tag":61,"props":1054,"children":1056},{"className":1055},[],[1057],{"type":47,"value":1058},"main",{"type":47,"value":1060}," into the bootstrap repository, commits, pushes. ",{"type":41,"tag":275,"props":1062,"children":1063},{},[1064,1066,1072,1073,1079],{"type":47,"value":1065},"Omits ",{"type":41,"tag":61,"props":1067,"children":1069},{"className":1068},[],[1070],{"type":47,"value":1071},"_v2",{"type":47,"value":76},{"type":41,"tag":61,"props":1074,"children":1076},{"className":1075},[],[1077],{"type":47,"value":1078},"07",{"type":47,"value":353},{"type":47,"value":459},{"type":41,"tag":61,"props":1082,"children":1084},{"className":1083},[],[1085],{"type":47,"value":1033},{"type":47,"value":1035},{"type":41,"tag":363,"props":1088,"children":1089},{},[1090,1099],{"type":41,"tag":390,"props":1091,"children":1092},{},[1093],{"type":41,"tag":61,"props":1094,"children":1096},{"className":1095},[],[1097],{"type":47,"value":1098},"22-sample-deployer-configuration.yml",{"type":41,"tag":390,"props":1100,"children":1101},{},[1102,1104,1108],{"type":47,"value":1103},"Creates missing deployer and library examples, commits them, rewrites selected wrapper defaults, pushes each change. Does ",{"type":41,"tag":275,"props":1105,"children":1106},{},[1107],{"type":47,"value":279},{"type":47,"value":1109}," generate complete workload-zone or SAP-system configuration. Params include control-plane and workload names, region, optional services, deployer count, identity.",{"type":41,"tag":50,"props":1111,"children":1112},{},[1113,1118,1119,1124,1126,1131,1133,1138,1140,1145,1147,1153],{"type":41,"tag":275,"props":1114,"children":1115},{},[1116],{"type":47,"value":1117},"Level-up sequence.",{"type":47,"value":459},{"type":41,"tag":61,"props":1120,"children":1122},{"className":1121},[],[1123],{"type":47,"value":82},{"type":47,"value":1125}," documents these pipelines\nin the order ",{"type":41,"tag":61,"props":1127,"children":1129},{"className":1128},[],[1130],{"type":47,"value":252},{"type":47,"value":1132}," (refresh source refs into Azure Repos) → ",{"type":41,"tag":61,"props":1134,"children":1136},{"className":1135},[],[1137],{"type":47,"value":259},{"type":47,"value":1139}," (refresh\nwrapper files in this repository) → ",{"type":41,"tag":61,"props":1141,"children":1143},{"className":1142},[],[1144],{"type":47,"value":266},{"type":47,"value":1146}," (regenerate optional deployer \u002F\nlibrary samples). Treat that as the documented order, not a mandate the\ndocs enforce. Keep ",{"type":41,"tag":61,"props":1148,"children":1150},{"className":1149},[],[1151],{"type":47,"value":1152},"force=false",{"type":47,"value":1154}," unless a rollback is being executed. Re-run\ndependent deploy stages only after reviewing the new configuration and\npreserving state.",{"type":41,"tag":164,"props":1156,"children":1158},{"id":1157},"variable-group-dependencies",[1159],{"type":47,"value":1160},"Variable-group dependencies",{"type":41,"tag":50,"props":1162,"children":1163},{},[1164,1166,1175],{"type":47,"value":1165},"From ",{"type":41,"tag":56,"props":1167,"children":1168},{"href":154},[1169],{"type":41,"tag":61,"props":1170,"children":1172},{"className":1171},[],[1173],{"type":47,"value":1174},"docs\u002Fpipeline-reference.md § Variable-group dependencies",{"type":47,"value":1176},":",{"type":41,"tag":171,"props":1178,"children":1179},{},[1180,1191,1202,1214,1246],{"type":41,"tag":175,"props":1181,"children":1182},{},[1183,1185,1190],{"type":47,"value":1184},"Infrastructure templates load ",{"type":41,"tag":61,"props":1186,"children":1188},{"className":1187},[],[1189],{"type":47,"value":229},{"type":47,"value":353},{"type":41,"tag":175,"props":1192,"children":1193},{},[1194,1196,1201],{"type":47,"value":1195},"Control-plane templates load ",{"type":41,"tag":61,"props":1197,"children":1199},{"className":1198},[],[1200],{"type":47,"value":475},{"type":47,"value":353},{"type":41,"tag":175,"props":1203,"children":1204},{},[1205,1207,1212],{"type":47,"value":1206},"Workload-zone, SAP-system, software, installation, and workload removal\ntemplates load ",{"type":41,"tag":61,"props":1208,"children":1210},{"className":1209},[],[1211],{"type":47,"value":524},{"type":47,"value":1213}," as applicable.",{"type":41,"tag":175,"props":1215,"children":1216},{},[1217,1222,1224,1230,1232,1238,1239,1245],{"type":41,"tag":61,"props":1218,"children":1220},{"className":1219},[],[1221],{"type":47,"value":229},{"type":47,"value":1223}," supplies shared values including\n",{"type":41,"tag":61,"props":1225,"children":1227},{"className":1226},[],[1228],{"type":47,"value":1229},"Deployment_Configuration_Path",{"type":47,"value":1231},", tool versions, and SAP credentials\n(",{"type":41,"tag":61,"props":1233,"children":1235},{"className":1234},[],[1236],{"type":47,"value":1237},"S-Username",{"type":47,"value":892},{"type":41,"tag":61,"props":1240,"children":1242},{"className":1241},[],[1243],{"type":47,"value":1244},"S-Password",{"type":47,"value":162},{"type":41,"tag":175,"props":1247,"children":1248},{},[1249],{"type":47,"value":1250},"Environment groups supply Azure identity, subscription, connection, agent,\nstate, and Key Vault values.",{"type":41,"tag":50,"props":1252,"children":1253},{},[1254,1256,1261],{"type":47,"value":1255},"An exhaustive per-variable catalogue for each environment group is ",{"type":41,"tag":275,"props":1257,"children":1258},{},[1259],{"type":47,"value":1260},"NOT\ndocumented",{"type":47,"value":1262}," in this repository. When an operator asks for the full field\nlist, state that gap and point at the two \"Configure\" pages that create the\ngroups.",{"type":41,"tag":164,"props":1264,"children":1266},{"id":1265},"preconditions-common-to-every-pipeline",[1267],{"type":47,"value":1268},"Preconditions common to every pipeline",{"type":41,"tag":50,"props":1270,"children":1271},{},[1272,1273,1283,1284,1294],{"type":47,"value":960},{"type":41,"tag":56,"props":1274,"children":1276},{"href":1275},"..\u002F..\u002Fdocs\u002F02-00-bootstrap.md",[1277],{"type":41,"tag":61,"props":1278,"children":1280},{"className":1279},[],[1281],{"type":47,"value":1282},"docs\u002F02-00-bootstrap.md",{"type":47,"value":971},{"type":41,"tag":56,"props":1285,"children":1287},{"href":1286},"..\u002F..\u002Fdocs\u002F02-10-configure-devops-project.md",[1288],{"type":41,"tag":61,"props":1289,"children":1291},{"className":1290},[],[1292],{"type":47,"value":1293},"docs\u002F02-10-configure-devops-project.md",{"type":47,"value":1176},{"type":41,"tag":1296,"props":1297,"children":1298},"ol",{},[1299,1304,1324,1337,1342],{"type":41,"tag":175,"props":1300,"children":1301},{},[1302],{"type":47,"value":1303},"The pipeline YAML path is created as a pipeline definition in the project.",{"type":41,"tag":175,"props":1305,"children":1306},{},[1307,1309,1315,1317,1322],{"type":47,"value":1308},"Repository resources in ",{"type":41,"tag":61,"props":1310,"children":1312},{"className":1311},[],[1313],{"type":47,"value":1314},"resources.yml",{"type":47,"value":1316}," \u002F\n",{"type":41,"tag":61,"props":1318,"children":1320},{"className":1319},[],[1321],{"type":47,"value":607},{"type":47,"value":1323}," resolve their declared repositories.",{"type":41,"tag":175,"props":1325,"children":1326},{},[1327,1329,1335],{"type":47,"value":1328},"The Post Build Cleanup extension (",{"type":41,"tag":61,"props":1330,"children":1332},{"className":1331},[],[1333],{"type":47,"value":1334},"PostBuildCleanup@4",{"type":47,"value":1336},") is installed.",{"type":41,"tag":175,"props":1338,"children":1339},{},[1340],{"type":47,"value":1341},"The referenced agent pool exists, has an online compatible agent, and is\nauthorized for the pipeline.",{"type":41,"tag":175,"props":1343,"children":1344},{},[1345],{"type":47,"value":1346},"Every referenced variable group and service connection is authorized for\nthe pipeline.",{"type":41,"tag":164,"props":1348,"children":1350},{"id":1349},"see-also",[1351],{"type":47,"value":1352},"See also",{"type":41,"tag":171,"props":1354,"children":1355},{},[1356,1366,1381],{"type":41,"tag":175,"props":1357,"children":1358},{},[1359,1364],{"type":41,"tag":61,"props":1360,"children":1362},{"className":1361},[],[1363],{"type":47,"value":295},{"type":47,"value":1365}," — creates the project, pipelines, agent pool,\nMSI, service connections, variable groups, and Web App that this catalogue\ndescribes.",{"type":41,"tag":175,"props":1367,"children":1368},{},[1369,1379],{"type":41,"tag":56,"props":1370,"children":1372},{"href":1371},"..\u002F..\u002Fdocs\u002Ftroubleshooting.md",[1373],{"type":41,"tag":61,"props":1374,"children":1376},{"className":1375},[],[1377],{"type":47,"value":1378},"docs\u002Ftroubleshooting.md",{"type":47,"value":1380}," — precondition\nfailures (variable group missing, service connection fails, no agent,\nrepository checkout fails, configuration not found).",{"type":41,"tag":175,"props":1382,"children":1383},{},[1384,1392],{"type":41,"tag":56,"props":1385,"children":1386},{"href":974},[1387],{"type":41,"tag":61,"props":1388,"children":1390},{"className":1389},[],[1391],{"type":47,"value":82},{"type":47,"value":1393}," — operator\ncontext for level-up and removal ordering.",{"items":1395,"total":1568},[1396,1415,1434,1448,1461,1479,1490,1503,1513,1526,1537,1555],{"slug":1397,"name":1397,"fn":1398,"description":1399,"org":1400,"tags":1401,"stars":1412,"repoUrl":1413,"updatedAt":1414},"azure-arg-external-evaluation-policy-author","author and test Azure Resource Graph policies","Use when the user wants to author, design, or test an Azure Policy that queries Azure Resource Graph (ARG) at request-time — i.e. a policy whose deny\u002Faudit decision depends on data from elsewhere in the subscription (sibling\u002Fparent resource state, RG-wide invariants, multi-hop relationships, etc.). Formally called Azure Policy External Evaluation; sometimes referred to colloquially as \"Invoke\". Drives an iterative KQL co-design loop against the user's real subscription via `az graph query`, then emits a policy definition, assignment, `.http` test flow, and an `EXPLANATION.md` companion. Read-only; never provisions anything.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1402,1403,1406,1409],{"name":11,"slug":8,"type":14},{"name":1404,"slug":1405,"type":14},"Compliance","compliance",{"name":1407,"slug":1408,"type":14},"Governance","governance",{"name":1410,"slug":1411,"type":14},"Policy","policy",1689,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fazure-policy","2026-07-12T08:17:48.378432",{"slug":1416,"name":1416,"fn":1417,"description":1418,"org":1419,"tags":1420,"stars":1431,"repoUrl":1432,"updatedAt":1433},"azure-blueprints-migration","migrate Azure Blueprints to Template Specs","Use when a user needs to migrate off Azure Blueprints (definitions and\u002For assignments) to Template Specs and Deployment Stacks before the January 31, 2027 retirement. Covers inventory, export, conversion to Bicep, policy decoupling, Template Spec publishing, Deployment Stack deployment with deny-settings, validation, and cutover.",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1421,1422,1425,1428],{"name":11,"slug":8,"type":14},{"name":1423,"slug":1424,"type":14},"Deployment","deployment",{"name":1426,"slug":1427,"type":14},"Infrastructure as Code","infrastructure-as-code",{"name":1429,"slug":1430,"type":14},"Migration","migration",261,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fazure-blueprints","2026-08-20T03:28:18.136156",{"slug":1435,"name":1435,"fn":1436,"description":1437,"org":1438,"tags":1439,"stars":1445,"repoUrl":1446,"updatedAt":1447},"sdaf-bom-selection","select SAP Bill of Materials","Pick the right SDAF BOM for a target SAP product \u002F release \u002F DB platform \u002F version \u002F kernel \u002F topology. Explains where BOMs live in the samples repo (`SAP\u002F` for whole products, `BOM\u002F` for components), decodes the `ms`, `v####`, and `latest` suffix conventions, points at the compatibility guardrails (`supportedPlatforms`, `supportedDBVersions`, `supportedKernels`), and reminds the operator that the download flow needs four explicit BOM keys in `sap-parameters.yaml`. Use when a user says \"which BOM do I use\", \"product BOM vs component BOM\", \"SAP samples BOM catalog\", \"BOM_CATALOG\", \"S4\u002F2023 BOM\", \"HANA BOM\", or \"how do I pick a BOM for HANA\u002FOracle\u002FDB2\u002FASE\". Do NOT use to author a new BOM, to acquire media (`sdaf-media-acquisition`), or to troubleshoot a checksum \u002F 404 (`sdaf-media-diagnostics`).\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1440,1441,1444],{"name":11,"slug":8,"type":14},{"name":1442,"slug":1443,"type":14},"Configuration","configuration",{"name":22,"slug":23,"type":14},143,"https:\u002F\u002Fgithub.com\u002FAzure\u002Fsap-automation","2026-09-02T07:47:45.597063",{"slug":1449,"name":1449,"fn":1450,"description":1451,"org":1452,"tags":1453,"stars":1445,"repoUrl":1446,"updatedAt":1460},"sdaf-control-plane-bootstrap","deploy SDAF control plane infrastructure","Deploy the SDAF control plane locally: prepare DEPLOYER and LIBRARY tfvars, review the plan, run `deploy_controlplane.sh` per `docs\u002Flocal\u002F03-00-control-plane.md § Run`, and validate the deployer + library + state hand-off. Grounded in `docs\u002Flocal\u002F03-00-control-plane.md`. Use when a user says \"deploy the SDAF control plane\", \"run deploy_controlplane.sh\", \"bootstrap SDAF from an empty subscription\", \"install the deployer\" or \"create the SAP library\". Do NOT use for workload zone (see sdaf-workload-zone), SAP system (see sdaf-sap-system), removal (`sdaf-safe-removal`), or Azure Government \u002F sovereign-cloud deltas (`sdaf-sovereign-cloud`).\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1454,1455,1456,1459],{"name":11,"slug":8,"type":14},{"name":1423,"slug":1424,"type":14},{"name":1457,"slug":1458,"type":14},"Infrastructure","infrastructure",{"name":22,"slug":23,"type":14},"2026-09-02T07:46:51.573641",{"slug":1462,"name":1462,"fn":1463,"description":1464,"org":1465,"tags":1466,"stars":1445,"repoUrl":1446,"updatedAt":1478},"sdaf-failure-triage","triage failed SAP automation runs","Triage a failed or suspicious SDAF run: distinguish a real failure from a green no-op or a clean plan reported as failure, map the observed symptom to a documented cause in `docs\u002Flocal\u002Ftroubleshooting.md`, and hand off to the stage-owning skill for retry. Use when a user says \"SDAF run failed\", \"my deploy exited non-zero\", \"the plan was clean but exit 1\", \"the run said success but nothing was deployed\", \"state lock error\", \"unexpected replacement\", \"control plane stopped partway\", \"generated hosts.yaml missing\", \"workload-zone private endpoint failure\", \"workload-zone subnet policy failure\", or \"SDAF exit 2\". Do NOT use to actually deploy or to redesign the workspace layout.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1467,1468,1471,1474,1475],{"name":11,"slug":8,"type":14},{"name":1469,"slug":1470,"type":14},"Diagnostics","diagnostics",{"name":1472,"slug":1473,"type":14},"Operations","operations",{"name":22,"slug":23,"type":14},{"name":1476,"slug":1477,"type":14},"Triage","triage","2026-09-02T07:47:40.607437",{"slug":1480,"name":1480,"fn":1481,"description":1482,"org":1483,"tags":1484,"stars":1445,"repoUrl":1446,"updatedAt":1489},"sdaf-ha-diagnostics","diagnose SDAF high-availability cluster failures","Diagnose a live or recently failed SDAF high-availability cluster without changing cluster state. Start read-first: capture `crm status full` or `pcs status --full`, inspect SBD or fencing evidence, confirm current resource placement, and reuse existing quality-assurance or HCMT artifacts. Grounded in `docs\u002Flocal\u002F07-10-quality-assurance.md`, the shipped Pacemaker role vars\u002Ftasks, and the SAP Automation QA setup role. Use when a user says \"diagnose my HANA failover\", \"crm status\", \"pcs status\", \"check fencing\", \"why is the SCS\u002FERS cluster unhealthy\", \"offline_validation\u002Fcib\", or \"review an HCMT result zip\". Do NOT use for pre-deploy topology or design choices (see `sdaf-ha-topology`), fresh installation\u002Fdeploy, or disruptive failover\u002Ffencing exercises (see `sdaf-quality-assurance`).\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1485,1486,1487,1488],{"name":11,"slug":8,"type":14},{"name":1469,"slug":1470,"type":14},{"name":1472,"slug":1473,"type":14},{"name":22,"slug":23,"type":14},"2026-09-02T07:48:04.154501",{"slug":1491,"name":1491,"fn":1492,"description":1493,"org":1494,"tags":1495,"stars":1445,"repoUrl":1446,"updatedAt":1502},"sdaf-ha-topology","design high-availability SAP topologies","Choose the documented SDAF high-availability design before SAP-system deployment. Use when a user asks which HA topology to deploy, whether to use AFA or SBD, AFS or ANF, HANA scale-up or scale-out, whether ANGI is allowed, or which HA inputs must be set before deployment. Ground answers in the current support matrix, Ansible roles, sample tfvars, and validation logic. Do NOT use for live cluster diagnosis (sdaf-ha-diagnostics) or for running the installers (sdaf-sap-installation).\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1496,1499,1500,1501],{"name":1497,"slug":1498,"type":14},"Architecture","architecture",{"name":11,"slug":8,"type":14},{"name":1457,"slug":1458,"type":14},{"name":22,"slug":23,"type":14},"2026-09-02T07:47:43.405138",{"slug":1504,"name":1504,"fn":1505,"description":1506,"org":1507,"tags":1508,"stars":1445,"repoUrl":1446,"updatedAt":1512},"sdaf-media-acquisition","acquire SAP installation media","Acquire approved SAP media into the SDAF library after SAP-system infrastructure exists. Drives local `deploy\u002Fansible\u002Fdownload_menu.sh` per `docs\u002Flocal\u002F06-00-software-and-installation.md § Download software`, enforces the documented `BOM_CATALOG` root and the four required `sap-parameters.yaml` BOM keys (`application_bom_name`, `database_bom_name`, `sap_kernel_bom_name`, `save_bom_as`), and explains the documented download and validation flow. Use for \"download SAP media\", \"run download_menu.sh\", \"acquire software into the library\", \"BOM Downloader\", \"BOM_CATALOG\", or \"assemble application\u002Fdatabase\u002Fkernel BOMs for download\". Do NOT use to choose a BOM, troubleshoot a failed download, or run installation playbooks.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1509,1510,1511],{"name":11,"slug":8,"type":14},{"name":1472,"slug":1473,"type":14},{"name":22,"slug":23,"type":14},"2026-09-02T07:46:44.504107",{"slug":1514,"name":1514,"fn":1515,"description":1516,"org":1517,"tags":1518,"stars":1445,"repoUrl":1446,"updatedAt":1525},"sdaf-media-diagnostics","diagnose SDAF media and BOM processing","Diagnose SDAF software-download and BOM-processing failures after a BOM is already selected. Covers the documented local media path, SAP download, storage-account upload\u002Fdownload, checksum validation, and `SAPCAR` \u002F `.EXE` extraction. Use when a user says \"download_menu failed\", \"BOM downloader 404\", \"missing archive\", \"checksum mismatch\", \"SAPCAR failed\", \"bom-processing-done missing\", or \"my SPS07 media run can't find a file\". Do NOT use to choose a BOM (see `sdaf-bom-selection`), to run a clean first-time media download with no failure, or to diagnose a later non-media install failure.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1519,1520,1521,1522],{"name":11,"slug":8,"type":14},{"name":1469,"slug":1470,"type":14},{"name":22,"slug":23,"type":14},{"name":1523,"slug":1524,"type":14},"Storage","storage","2026-09-02T07:48:06.369058",{"slug":1527,"name":1527,"fn":1528,"description":1529,"org":1530,"tags":1531,"stars":1445,"repoUrl":1446,"updatedAt":1536},"sdaf-orientation-and-surface","orient users to SDAF architecture","Orient a newcomer to the SAP Deployment Automation Framework (SDAF): explain the spine (control plane → workload zone → SAP system → software → install → operate\u002Fremove), summarise the three execution surfaces (Local, Azure DevOps, GitHub Actions), and print the install command for the matching surface bootstrap plugin — as documented in this repository's `docs\u002FPLUGINS.md` — so the operator can run it manually. Use when a user says \"what is SDAF\", \"how is SDAF structured\", \"where do I start with SDAF\", \"which surface should I use\", \"SDAF Local vs ADO vs GitHub\", \"workstation vs Azure Pipelines vs GitHub workflows\", \"how do I install the SDAF ADO\u002FGitHub plugin\", or \"I'm new to SDAF\". Do NOT use for readiness pre-flight (see sdaf-readiness-check), workspace\u002Ftfvars layout (see sdaf-workspace-and-tfvars), or troubleshooting a failed run (see sdaf-failure-triage).\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1532,1533,1534,1535],{"name":1497,"slug":1498,"type":14},{"name":11,"slug":8,"type":14},{"name":16,"slug":17,"type":14},{"name":22,"slug":23,"type":14},"2026-09-02T07:46:52.116557",{"slug":1538,"name":1538,"fn":1539,"description":1540,"org":1541,"tags":1542,"stars":1445,"repoUrl":1446,"updatedAt":1554},"sdaf-plan-and-test-semantics","manage SDAF plan and test semantics","Explain SDAF plan-only \u002F test \u002F apply semantics without pretending they are universal. Compares the documented Local commands, Azure DevOps wrapper pipelines, and GitHub Actions workflows for control plane, workload zone, and SAP system: local stage commands show Terraform plans and then apply after approval; ADO\u002FGitHub workload-zone and SAP-system test runs stop after the plan; the current hosted control-plane test options do not provide a plan-only run. Use when a user says \"what does test do in SDAF\", \"is this a real dry run\", \"plan-only vs apply\", \"workflow 01 dry-run\", \"pipeline 02 test\", or \"TEST_ONLY\". Do NOT use to actually deploy a stage or to triage a failed run (see sdaf-control-plane-bootstrap \u002F sdaf-workload-zone \u002F sdaf-sap-system \u002F sdaf-failure-triage).\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1543,1546,1547,1548,1551],{"name":1544,"slug":1545,"type":14},"Automation","automation",{"name":11,"slug":8,"type":14},{"name":19,"slug":20,"type":14},{"name":1549,"slug":1550,"type":14},"CI\u002FCD","ci-cd",{"name":1552,"slug":1553,"type":14},"GitHub Actions","github-actions","2026-09-02T07:48:08.951811",{"slug":1556,"name":1556,"fn":1557,"description":1558,"org":1559,"tags":1560,"stars":1445,"repoUrl":1446,"updatedAt":1567},"sdaf-quality-assurance","validate deployed SDAF SAP systems","Validate a deployed SDAF SAP system through the SDAF-owned QA entry points: the local quality-assurance menu and the documented Azure DevOps pipeline 13 path. Choose configuration checks vs functional tests, apply `TEST_GROUPS` \u002F `TEST_CASES` safely, interpret `quality_assurance\u002F` and `logs\u002F`, and enforce the documented boundary that the GitHub Actions wrapper is still pending. Use when a user says \"run quality assurance\", \"run configuration checks\", \"pipeline 13 QA\", \"offline HA validation\", or \"why does the report say No test results found\". Do NOT use to deploy the SAP system or generate `sap-parameters.yaml` \u002F `\u003CSID>_hosts.yaml` (see `sdaf-sap-system`), or for a generic failed-run report with no QA-stage context (see `sdaf-failure-triage`).\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1561,1562,1563,1566],{"name":1544,"slug":1545,"type":14},{"name":11,"slug":8,"type":14},{"name":1564,"slug":1565,"type":14},"Quality Assurance","quality-assurance",{"name":22,"slug":23,"type":14},"2026-09-02T07:46:49.932123",145,{"items":1570,"total":1588},[1571,1578],{"slug":4,"name":4,"fn":5,"description":6,"org":1572,"tags":1573,"stars":24,"repoUrl":25,"updatedAt":26},{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1574,1575,1576,1577],{"name":11,"slug":8,"type":14},{"name":19,"slug":20,"type":14},{"name":16,"slug":17,"type":14},{"name":22,"slug":23,"type":14},{"slug":295,"name":295,"fn":1579,"description":1580,"org":1581,"tags":1582,"stars":24,"repoUrl":25,"updatedAt":1587},"bootstrap SDAF projects on Azure DevOps","Set up SDAF on Azure DevOps end-to-end: create the Azure DevOps project,\nconfiguration repository, pipelines, cleanup task, agent pool, control-plane\nmanaged identity, service connections, variable groups, optional Web App,\nand onboard each SDAF workload zone. Drives the documented\nNew-SDAFUserAssignedIdentity + New-SDAFADOProject + New-SDAFADOWorkloadZone\npath from docs\u002F02-00-bootstrap.md, docs\u002F02-10-configure-devops-project.md,\nand docs\u002F02-20-configure-workload-zone-artifacts.md. Use when an operator\nsays: \"set up SDAF on Azure DevOps\", \"bootstrap the ADO project\", \"onboard\na workload zone\", \"create a new SDAF DevOps project\", \"add SDAF-\u003Cenv>\nvariable group and service connection\". NOT for what an individual pipeline\ndoes or when to run it (see sdaf-ado-pipeline-catalogue), and not for the\nGitHub Actions surface.\n",{"slug":8,"name":9,"logoUrl":10,"githubOrg":11},[1583,1584,1585,1586],{"name":1544,"slug":1545,"type":14},{"name":11,"slug":8,"type":14},{"name":19,"slug":20,"type":14},{"name":22,"slug":23,"type":14},"2026-09-02T07:46:51.024319",2]