Azure DevOps Setup & Governance Model (Synkronyx ERO)

1. Project Organization & Scope

All lifecycle phases, planning backlog items, and CI/CD pipelines for the Event Route Optimiser (ERO) are consolidated into a single, unified workspace control plane:

• Organization: synkronyx
• Project: EventRouteOptimiser
• Git Repository: event-route-optimiser (mono-repo structuring edge API, PWA frontend, and Bicep infrastructure)

---

2. DevSecOps Isolation & Service Connections

To enforce strict role-based access control (RBAC) and network boundaries, the Azure DevOps project manages deployments via isolated Service Connections targeting specific subscriptions and resource groups:

Service Connection	Target Azure Subscription	Target Resource Group	Purpose
sc-ero-dev	sub-sknx-ero-nonproduction	rg-sknx-ero-development	Sandboxed development deployments
sc-ero-test	sub-sknx-ero-nonproduction	rg-sknx-ero-test	Automated integration testing & QA
sc-ero-preprod	sub-sknx-ero-nonproduction	rg-sknx-ero-preproduction	Mirror staging environment
sc-ero-prod	sub-sknx-ero-production	rg-sknx-ero-production	High-integrity production systems

---

3. Backlog Traceability & ADO Board Synchronization

Backlog items are tracked hierarchically on the ADO Board (Epics $\rightarrow$ Features $\rightarrow$ User Stories $\rightarrow$ Tasks). The backlog is managed programmatically via the Azure DevOps MCP Server by parsing local specifications (e.g. 05-ado-backlog.md).

Backlog Synchronization Index

• Epic 4: ERO Platform Developer Experience (DX) & Automation (Work Item ID: #8)
  • Feature 4.1: Zero-Friction Local Environment Bootstrapper (Work Item ID: #9)
    • User Story 4.1.1 (Workstations), Story 4.1.2 (IDE Integration), Story 4.1.3 (D1 Database Seeding) with child tasks #11 through #21.
• Epic 5: Identity & Access Management (IAM) (Work Item ID: #22)
  • Feature 5.1: Entra ID (OAuth2) Integration (Work Item ID: #23)
    • User Story 5.1.1 (MSAL PWA Setup), Story 5.1.2 (Edge JWT Middleware) with child tasks #25 through #33.
  • Feature 5.2: Social Identity Federation (CIAM) (Work Item ID: #34)
    • User Story 5.2.1 (Federated Google/Facebook IdPs) with child tasks #36 through #39.

---

4. Environment Parameterization & Deployment Pipelines

CI/CD Pipelines in Azure DevOps will be configured to deploy the Bicep templates.

4.1 Tenant-Level Deployment

The first stage deploys the infra/main.bicep template at the tenant scope. This provisions the management groups and subscription aliases.

az login
az deployment tenant create --location uksouth --template-file infra/main.bicep --parameters infra/parameters/main.bicepparam

4.2 Identity Deployment

The second stage targets the newly created platform subscription to deploy the CIAM tenants.

# The subscription ID can be retrieved from the output of the first deployment
$platformSubId = (az deployment tenant show --name main-bicep-deployment --query properties.outputs.platformSubscriptionId.value -o tsv)

az account set --subscription $platformSubId
az deployment sub create --location uksouth --template-file infra/identity.bicep --parameters infra/parameters/development.bicepparam

4.3 Workload Deployment

Subsequent stages will deploy the actual application workloads into the dev, test, and prod resource groups within their respective subscriptions.

---

5. Security & Secret Configuration

To prevent credential leakage:

1. Environment credential files (settings/.env.*.local) are excluded from Git version control.
2. In Azure DevOps pipelines, secrets are retrieved dynamically at run-time from Azure Key Vault instances housed within the respective subscription boundaries or mapped to ADO Variable Groups.