azure-deployment-preflightlisted

# Azure Deployment Preflight ## Purpose and boundary Validate an Azure deployment plan before it changes infrastructure. The default output is a read-only preflight report covering Bicep syntax, parameters, target scope, identity, permissions, what-if changes, warnings, and rollback considerations. Never run `az deployment ... create`, `azd up`, `azd provision`, resource mutation commands, or destructive recovery under this Skill. Use synthetic or redacted parameter values when possible. Do not print client secrets, access tokens, connection strings, private network data, or full sensitive parameter contents. If a required target or authorization is missing, report a blocked/partial preflight instead of guessing or asking the tool to create the missing resource group. ## Step 1: detect project and target Read repository instructions, then locate `azure.yaml`, `infra/`, `deploy/`, `.bicep`, `.bicepparam`, and `*.parameters.json` files. For each candidate, map: - azd versus direct Azure CLI workflow; - Bicep entry point and module graph; - matching parameter file and environment overlays; - `targetScope`: resource group, subscription, management group, or tenant; - subscription, resource group, location, environment, and deployment name; - referenced modules, providers, existing resources, identities, and sensitive parameters. Prefer an explicitly named file and environment. If multiple entry points or parameter sets exist, validate each only when its scope is clear and