azure-lean-stack-skills
SolidAzure apps that cost nothing when nobody's using them. A Claude Code skill pack — 14 composable skills, 37+ documented gotchas, branch-per-env CI/CD.
Install
Plugins install via a marketplace, in two steps.
This plugin isn't listed in a marketplace we've indexed. Install it directly from its GitHub repository — the README has the setup steps.
View on GitHubBundles
Everything this plugin ships — skills, agents, commands, hooks, and MCP servers it bundles.
Skills (17)
adding-azure-communication-services-email
Adds transactional email to an Azure web app via Azure Communication Services (ACS) Email — verification emails, password resets, notifications. Encodes the three ACS quirks that consistently break Bicep deploys (location:'global' literal, dataLocation in plain English not Azure region IDs, declare-order to avoid circular dependency), and the safeSend() wrapper that prevents email failures from crashing HTTP handlers. Use when adding email sending to a project, fixing ACS Bicep deployment errors, or migrating off SendGrid/Mailgun.
applying-azure-cost-guardrails
Applies Azure cost guardrails to a deployment — consumption-priced SKUs, Container Apps that really scale to zero (cooldownPeriod, wake vectors, CI resurrection), SQL Serverless vs flat Basic, Log Analytics dailyQuotaGb cap, Storage lifecycle rules, free tiers, and the Azure-native backstop (Consumption budget + stuck-warm Replicas alert). Ships three audit scripts (Bicep SKUs, app-source anti-patterns, live replica sweep) and a costGuardrails.bicep template. Use when designing infrastructure to stay near zero cost when idle, auditing a deployment whose bill has grown, retiring a resource, or proving a cost fix in billing.
configuring-azure-oidc-for-github-actions
Sets up branch-scoped Azure OIDC for GitHub Actions — creates service principals, federated credentials bound to each branch's refs/heads/{branch}, generates SQL passwords, and sets GitHub secrets. Use when bootstrapping CI/CD, onboarding a new environment branch, or fixing AADSTS70021 subject mismatches.
curating-azure-deployment-learnings
Captures Azure deployment learnings from real projects in a structured format and promotes recurring ones into the diagnosing-azure-deployment-failures gotcha catalogue. Provides scripts to capture a new learning (with project, severity, frontmatter), diff against existing gotchas, and propose promotions with commit-ready text. Use when a deployment problem was solved and the fix should be captured so it doesn't have to be rediscovered, or when reviewing accumulated learnings to find patterns worth promoting.
deploying-azure-container-apps
Deploys Docker containers to Azure Container Apps with scale-to-zero that actually scales to zero — cooldownPeriod kept at 300s, KEDA cron warm windows instead of minReplicas 1, Jobs for anything async, and the retirement checklist that stops CI resurrecting a deleted app. Covers multi-container sidecars, shared managed environments, Container Apps Jobs, the az rest PATCH escape hatch for CLI flags that silently no-op, and the job-start env-override trap. Use when SWA + FC1 don't fit — long-running servers, WebSocket/SSE, Next.js with middleware, custom runtimes, scheduled or queue-driven background jobs.
deploying-azure-static-web-apps
Deploys React + Azure Functions apps to Azure Static Web Apps with managed API functions, including the CommonJS / index.ts import / route-registration gotchas that make new functions 404 silently. Provides the SWA Bicep module, staticwebapp.config.json routing + security headers, and the API entrypoint convention. Use when scaffolding a SWA-based project, adding a new API function, or fixing a deployed function that returns 404 even though it compiled successfully.
deploying-fc1-flex-consumption-functions
Deploys standalone Azure Function Apps on Flex Consumption (FC1) for workloads SWA managed functions can't handle — timer triggers, queue triggers, AI workloads, long-running operations, or when you need managed identity / Key Vault references (SWA managed functions support neither). Provisions via Bicep or ARM REST because az CLI flags silently fall back to the retiring Linux Consumption (Y1) plan. Includes the forbidden-app-settings list, the az-CLI zip deploy (Azure/functions-action is a single point of failure), instance sizing, and managed-identity storage auth. Use when adding a non-HTTP trigger, exceeding the 30s SWA limit, or fixing a Function App that landed on the wrong plan.
developing-azure-apps-locally
Runs an Azure Lean Stack app fully offline on localhost — API + SQL Server + blob storage — with no Azure dependency, as the "try" tier of the local→test→prod flow on the main branch. Provides a docker-compose stack (SQL Server 2022 + Azurite), a one-command bootstrap, mock-mode for unset service keys, and an optional seed-from-test path. Use when setting up local development, running the app offline before deploying, adding a local database/blob emulator, or onboarding a developer to the repo.
diagnosing-azure-deployment-failures
Matches Azure deploy / CI / runtime failures against 56 documented gotchas with verified fixes (BCP258, AADSTS70021, sqlcmd-not-found, FC1-CLI-silent-fallback, functions-action outage, Kudu quick-succession abort, ACS dataLocation quirks, SSE timeouts, Container Apps idle-burn, SWA Authorization-header overwrite, and more). Delegates to Microsoft's azure-diagnostics for live log/metric queries. Use when a deploy fails, a deployed app misbehaves, a bill jumps, or a CI step errors.
instrumenting-azure-app-insights
Provisions workspace-based Azure Application Insights with a dailyQuotaGb cost cap and optional metric alerts (5xx spikes, server exceptions) on an Action Group. Outputs the connection string for app settings wiring (APPLICATIONINSIGHTS_CONNECTION_STRING). Use when adding observability to a project, replacing classic non-workspace App Insights (which is retiring), or setting up failure alerts that email an on-call owner.
managing-azure-sql-migrations
Manages versioned, idempotent Azure SQL migrations that run on every deployment via sqlcmd in GitHub Actions. Provides the migration-history tracking table, the guard-clause template every migration uses, and the workflow step that installs sqlcmd on ubuntu-24.04, manages the SQL firewall with trap cleanup, and runs all files in alphabetical order. Use when adding a new SQL migration, setting up the migration system on a new project, or fixing CI failures like "sqlcmd not found", "gpg cannot open /dev/tty", or "Multiple files found matching pattern *.sql".
optimizing-azure-blob-storage-cost
Configures Azure Blob Storage with lifecycle rules that auto-delete stale temp blobs and tier production data through Hot → Cool → Cold without rehydration latency. Provides CORS rules tuned for SPA + SAS uploads/Range reads, public-read branding container alongside private app containers, and SKU/redundancy guidance to keep cost minimal. Use when adding blob storage for uploads, designing storage for a media-heavy app, or auditing an existing storage account for cost waste.
Show all 17 bundled skills Showing all 17 bundled skills
orchestrating-azure-deployments
Routes Azure web app work (scaffold, deploy, troubleshoot, evolve) to the right Azure Lean Stack sub-skill. Built around branch-per-environment CI/CD where each git branch maps to one isolated Azure resource group via OIDC. Use when building or deploying a new Azure app, setting up GitHub Actions for Azure, troubleshooting a failed deploy, or adding FC1 / Container Apps / Logic Apps / multi-tenant patterns.
scaffolding-azure-bicep-infrastructure
Generates a subscription-scoped Bicep stack + GitHub Actions workflows for an Azure web app, with opt-in module toggles (SQL, Storage, Observability) and the {org}-{project}-{component}-{env} naming formula. Use when bootstrapping a new Azure project's IaC, adding a Bicep module, or refactoring into the modular-toggle pattern.
scaffolding-multi-tenant-azure-apps
Scaffolds a multi-tenant Azure app where each tenant gets its own resource group on a shared subscription, with one Bicep main.bicep driven by a single tenant parameter that cascades through every resource name. The default tenant keeps the original (single-tenant) names byte-identical so the pattern works for the first deployment with no migration. Use when onboarding the second tenant onto an app that started single-tenant, designing a multi-school/multi-clinic/multi-org SaaS, or refactoring shared resources to be per-tenant.
scheduling-with-azure-logic-apps-consumption
Creates Azure Logic Apps on the Consumption tier for recurring HTTP triggers and lightweight Power-Automate-style flows. Costs ~$0.22/month for a 5-minute recurrence (~8,640 actions at $0.000025 each). Use when adding a scheduled webhook ping, polling a SharePoint list, ticking a microservice every N minutes, or graduating a Power Automate flow that has hit its limits.
securing-azure-sql-and-storage-with-managed-identity
Moves an Azure Functions app's RUNTIME data-plane auth off the stored SQL password and storage account key onto the compute's system-assigned managed identity — Entra token auth for Azure SQL and user-delegation SAS for Blob Storage. Ships flag-gated (default OFF, old paths byte-identical) so cutover is a no-op until flipped and rollback is one setting. Covers the Entra-admin + MI-DB-user + storage-RBAC one-time setup, the async user-delegation-key priming that SAS signing requires, and the bicep-resets-app-settings durability trap. Use when hardening a deployment off secrets, when a security review flags a stored SQL password / account key, or as the DEFAULT auth for any new Function App + SQL + Blob deployment.
Quality Score: 71/100
Details
- Author
- alexpizarro
- Repository
- alexpizarro/azure-lean-stack-skills
- Created
- 6 months ago
- Last Updated
- 1 weeks ago
- Language
- Bicep
- License
- MIT