Add GitHub workflows to trigger Azure DevOps builds from a branch with access restriction

[Copilot]

Adds two GitHub Actions workflows that trigger Azure DevOps pipeline runs via the REST API, with access control enforced at the workflow level.

Workflows added

• trigger-azure-ci.yml — Fires on push/pull_request to main. Queues the Azure DevOps CI pipeline, forwarding GitHubRunId, GitHubRef, and GitHubSHA as pipeline parameters.

• trigger-azure-cd.yml — workflow_dispatch only. Accepts a single branch input and queues a build for that branch in Azure DevOps. Targets environment: protected, which gates execution behind required-reviewer approval configured in Settings → Environments.

Access restriction mechanism

The manual trigger workflow uses a GitHub Environment with protection rules — the job is paused until an approved reviewer clicks Approve and deploy. No code change required to add/remove approvers; it's managed entirely in repo settings.

One-time GitHub setup required

Resource	Location
Secret: AZURE_DEVOPS_TOKEN (PAT, Build: Read & execute)	Settings → Secrets → Actions
Variable: AZURE_CI_PIPELINE_ID	Settings → Variables → Actions
Variable: AZURE_PIPELINE_ID	Settings → Variables → Actions
Environment: protected with required reviewers	Settings → Environments

Security

User-controlled values (github.head_ref, inputs.branch) are mapped to env vars before shell execution to prevent script injection. permissions: {} is set on both jobs (least-privilege GITHUB_TOKEN).

Todos

• I have tested on an Android device.
• I have tested on an iOS device.
• I have supported accessibility

Original prompt

Is there a way to add github workflows that trigger azure builds? And can we restrict access to the workflows?

---

💡 You can make Copilot smarter by setting up custom instructions, customizing its development environment and configuring Model Context Protocol (MCP) servers. Learn more Copilot coding agent tips in the docs.

[haavamoa]

@copilot i dont need it to be continous delivery focused, just a way for us to start a build from a branch targetting a build in azure

[Copilot]

@copilot i dont need it to be continous delivery focused, just a way for us to start a build from a branch targetting a build in azure

Simplified in 3a64113. The workflow now has a single branch input — just pick a branch and it queues a build against the configured Azure DevOps pipeline. All the task/dry-run options have been removed.