adolisted

# Azure DevOps Operations Use `az` CLI commands for most operations and bash scripts for complex multi-step orchestration. ## Authentication Credentials come from environment variables exported in the terminal **before** the session starts; they are inherited read-only. This skill only reads them - it never exports or mutates session credentials. Two shapes are supported: - **Single org (default):** the plain triple `ADO_ORG`, `ADO_PROJECT`, `AZURE_DEVOPS_EXT_PAT`. Commands use these directly. - **Named profiles:** one namespaced triple per alias `<X>` - `<X>_ADO_ORG`, `<X>_ADO_PROJECT`, `<X>_ADO_PAT` (e.g. `WORK_ADO_ORG`, `PERSONAL_ADO_ORG`). Any number can be loaded at once; the set of `*_ADO_ORG` vars is the profile registry. When no PAT is exported in either shape, an `az login` session can stand in for it - see "az CLI token fallback" below. Check what is available: ```bash echo "ORG=${ADO_ORG:-MISSING} PROJECT=${ADO_PROJECT:-MISSING} PAT=${AZURE_DEVOPS_EXT_PAT:+set} TOKEN=${ADO_TOKEN:+set}" env | grep -o '^[A-Za-z0-9_]*_ADO_ORG' | sort # named profiles, if any az account show --query user.name -o tsv 2>/dev/null || echo "az: not logged in" ``` ### Selecting a profile With the plain triple (single org), run commands as-is - `$ADO_ORG` / `$ADO_PROJECT` / `$AZURE_DEVOPS_EXT_PAT` are already set. With named profiles, source the helper and bind one. It resolves an alias in this order: an explicit name, then `$ADO_PROFILE`, then the working directory (a clone unde