In the world of modern software development, Continuous Integration (CI) and Continuous Deployment (CD) are indispensable. Azure DevOps provides robust pipelines that help teams continuously build, test and deploy software components. A critical aspect of these pipelines is protecting against concurrent access and deciding when a deployment should be released. Ensuring the integrity and quality of code before it reaches production is essential. Let us look at what Exclusive Locks and Approvals mean in the context of Azure DevOps and how they can be used effectively.
Exclusive Locks in Azure DevOps
Exclusive Locks are mechanisms that prevent multiple builds or deployments from running simultaneously when they might affect the same resources. Concurrent access can arise, for example, when several developers merge new features into the shared codebase in quick succession and pipelines are triggered automatically. In such cases, access to shared resources — such as shared infrastructure — must be protected.
Benefits of Exclusive Locks
- Collision avoidance: Setting a lock ensures that only one pipeline can access a specific resource at a time, preventing conflicts and inconsistencies.
- Resource efficiency: Because multiple pipelines cannot claim the same resource simultaneously, efficient use of system resources is promoted.
- Reliability: By preventing concurrent access, potential errors and downtime are minimised. Pipelines must be reliable!
Approvals in Azure DevOps
Approvals are authorisation requirements that ensure certain steps in a pipeline are not executed automatically, but only after manual sign-off by authorised individuals or teams. This is particularly important for critical deployment steps that require additional review.
Benefits of Approvals
- Quality assurance: Before a deployment reaches a production environment, it can be reviewed and approved by responsible team members.
- Security controls: Manual review allows security-relevant aspects to be checked again before deployment.
- Compliance: Organisations can ensure that all deployment steps comply with internal policies and compliance requirements.
Restricting Approvals to Specific Teams and Roles
A particularly powerful feature in Azure DevOps is the ability to restrict approvals to specific teams and roles. This allows fine-grained control over who may approve which actions in the pipeline.
Why this restriction makes sense
- Accountability: Only those with the relevant expertise and responsibility can approve critical steps. This avoids poor decisions and raises the quality of the end product.
- Security: Limiting approval authority to specific roles reduces the risk of unauthorised changes.
- Efficiency: The right people are responsible for the right tasks, which can speed up the release process.
Implementing Exclusive Locks and Approvals
Implementing these mechanisms in Azure DevOps Pipelines is relatively straightforward and can be configured via the pipeline definitions. To do so, an environment is specified in the relevant pipeline — one that was created for the specific deployment, here production:
stages:
- stage: Deploy
jobs:
- deployment: DeployWeb
environment: 'production'
strategy:
runOnce:
deploy:
steps:
- script: echo Deploying...
Once the environment has been created, Approvals and checks can be managed through the Azure DevOps interface via the context menu (three dots in the top right). Here you can configure both Exclusive Locks and Approvals for specific users or groups.
Conclusion
Exclusive Locks and Approvals are essential tools in Azure DevOps that help ensure the integrity and security of CI/CD pipelines. By carefully restricting approval permissions to specific teams and roles, organisations can ensure that only qualified and authorised individuals make critical decisions. These mechanisms contribute significantly to raising the quality and reliability of software deployments and improving the overall efficiency of the development process.
For more information and detailed configuration instructions, visit the Azure DevOps documentation on Approvals & Exclusive Locks.