Azure 54: createprodcr — ADO Change Request work items for prod
easy⏱ 5 mincourseazure
Required fields
A Lythia prod CR must include: ProdChangeType (Standard / Emergency / Major), ProdChangePlanLink (URL to the build's plan artifact), ProdChangePlanName (human-readable summary), QualityEngineer (AAD UPN of the QE who validated UAT), EngineeringManager (UPN of the EM signing off). Missing any of these fails the job before any az call is made.
az boards work-item create \
--type 'Change Request' \
--title "$(Build.DefinitionName) v$(GIT_SEM_VER) -> prod" \
--fields \
Custom.ProdChangeType="Standard" \
Custom.ProdChangePlanLink="$(System.CollectionUri)/.../artifacts?artifactName=plan%2Bprod%2B…" \
Custom.ProdChangePlanName="odyssey-api v1.5.0 — SemVer minor + new Service Bus consumer" \
Custom.QualityEngineer="qe@lithia.com" \
Custom.EngineeringManager="em@lithia.com"
Why a real work item, not a fake form?
Auditors love a Boards work item. It has owners, timestamps, attachments, comments, links to the deploy run. SOX-flavour audit asks 'who approved the prod change at 14:32 on Tuesday' — answer is one click in Boards. A wiki page or email thread can't survive auditor scrutiny.
createProdCR parameter
The wrapper delivery.yml exposes a boolean createProdCR. Service repo's prod.yml sets createProdCR: true. The job only runs in prod's stage AND only after terraformPlan produced changes (exit code 2). For non-prod envs the boolean is ignored and the stage is skipped entirely.
Build the CR payload
Write buildProdCR(input) returning { args: string[], summary: string }. Validate that env === 'prod', all five required fields present, AAD UPNs match *@lithia.com. Throw with a clear message otherwise. Log a valid CR and two invalid attempts.
Link the plan artifact, not the pipeline run
The pipeline run URL is mutable: someone with edit rights can re-run, change variables, etc. The plan artifact is immutable by build number. Auditors care about the bits that ran, not the pipeline that was edited. Always link the artifact.
Quiz: emergency CR
Q: It's 3am, prod is broken, on-call needs to apply a hotfix. Can they skip CR creation? A: No, but they can use ProdChangeType=Emergency. Emergency CRs auto-route to a smaller approver list (oncall manager) and have a 5-minute SLA. The artifact link still goes in. You don't skip the audit trail; you compress it.