adolisted

# Azure DevOps Operations Use `az` CLI commands for most operations and bash scripts for complex multi-step orchestration. ## Authentication Credentials come from environment variables exported in the terminal **before** the session starts; they are inherited read-only. This skill only reads them - it never exports or mutates session credentials. The expected shape is the plain triple `ADO_ORG`, `ADO_PROJECT`, `AZURE_DEVOPS_EXT_PAT` - commands use these directly. When nothing is exported, two more sources can stand in: a [sequester](https://github.com/pszypowicz/sequester) secrets profile read per command block (see "Sequester profiles" below), or an `az login` session (see "az CLI token fallback" below). Check what is available: ```bash echo "ORG=${ADO_ORG:-MISSING} PROJECT=${ADO_PROJECT:-MISSING} PAT=${AZURE_DEVOPS_EXT_PAT:+set} TOKEN=${ADO_TOKEN:+set}" command -v sequester >/dev/null && sequester secret list # sequester profiles (names only, no prompt) az account show --query user.name -o tsv 2>/dev/null || echo "az: not logged in" ``` ### Sequester profiles (nothing exported) When no credential env vars are inherited and the `sequester` CLI is on PATH, read the PAT from a sequester secrets profile per command block. The convention is one profile per org, named as the org URL segment (the `<org>` in `https://dev.azure.com/<org>`), holding a single `AZURE_DEVOPS_EXT_PAT` - PATs are org-scoped, so the org identifies both the profile and the token. `sequester secret