Best practices

---

1 - Project organization

1.1 Recommended structure

Organisation: MonEntreprise
├── Projet: Produit-A
│   ├── Repos: frontend, backend, infra
│   ├── Pipelines: CI, CD-Dev, CD-Prod
│   └── Boards: Sprints équipe
├── Projet: Produit-B
│   └── ...
└── Projet: Shared-Templates
    └── Repos: pipeline-templates

1.2 Naming conventions

Type	Convention	Example
Repos	kebab-case	mon-app-frontend
Branches	type/description	feature/add-login
Pipelines	App-Environment	MyApp-CI, MyApp-CD-Prod
Variable Groups	Environment-Service	Prod-Database
Environments	PascalCase	Production, Staging

---

2 - Git Workflow

2.1 Branch Strategy

2.2 Branch Policies

For main:

• Minimum 2 reviewers
• Build validation required
• Linked work items
• Squash merge only

For develop:

• Minimum 1 reviewer
• Build validation
• Resolved comments

2.3 Commit messages

# Format recommandé
type(scope): description

# Exemples
feat(auth): add OAuth2 login
fix(api): resolve timeout issue #123
docs(readme): update installation steps

---

3 - Pipeline Patterns

3.1 Multi-stage pipeline

trigger:
  - main

stages:
  - stage: Build
    jobs:
      - job: Build
        steps:
          - script: npm ci && npm run build

  - stage: Test
    dependsOn: Build
    jobs:
      - job: UnitTests
        steps:
          - script: npm test
      - job: E2ETests
        steps:
          - script: npm run e2e

  - stage: DeployDev
    dependsOn: Test
    jobs:
      - deployment: Deploy
        environment: 'Development'

  - stage: DeployProd
    dependsOn: DeployDev
    condition: eq(variables['Build.SourceBranch'], 'refs/heads/main')
    jobs:
      - deployment: Deploy
        environment: 'Production'

3.2 Template Library

# shared-templates/ci-template.yml
parameters:
  - name: nodeVersion
    default: '18.x'
  - name: workingDirectory
    default: '.'

jobs:
  - job: CI
    pool:
      vmImage: 'ubuntu-latest'
    steps:
      - task: NodeTool@0
        inputs:
          versionSpec: ${{ parameters.nodeVersion }}
      
      - script: npm ci
        workingDirectory: ${{ parameters.workingDirectory }}
      
      - script: npm test
        workingDirectory: ${{ parameters.workingDirectory }}

# Project pipeline
resources:
  repositories:
    - repository: templates
      type: git
      name: Shared-Templates/pipeline-templates

stages:
  - stage: CI
    jobs:
      - template: ci-template.yml@templates
        parameters:
          nodeVersion: '20.x'

3.3 Caching

steps:
  - task: Cache@2
    inputs:
      key: 'npm | "$(Agent.OS)" | package-lock.json'
      restoreKeys: |
        npm | "$(Agent.OS)"
      path: $(npm_config_cache)
    displayName: 'Cache npm'
  
  - script: npm ci

---

4 - Security

4.1 Secrets management

# NE PAS FAIRE
variables:
  password: 'secret123'  # MAUVAIS!

# FAIRE
variables:
  - group: 'Secure-Variables'  # Référencer un variable group

4.2 Service Connection scoping

# Limiter les pipelines autorisés
# Dans les settings de la service connection:
# - Pipeline permissions: Specific pipelines only
# - Approvals: Require approval

4.3 Dependency scanning

steps:
  - task: ComponentGovernanceComponentDetection@0
    inputs:
      scanType: 'Register'
      alertWarningLevel: 'High'
  
  - task: WhiteSource@21
    inputs:
      cwd: '$(System.DefaultWorkingDirectory)'

---

5 - Tests

5.1 The testing pyramid

stages:
  - stage: Test
    jobs:
      # Base: Tests unitaires (rapides, nombreux)
      - job: UnitTests
        steps:
          - script: npm run test:unit
      
      # Milieu: Tests d'intégration
      - job: IntegrationTests
        dependsOn: UnitTests
        steps:
          - script: npm run test:integration
      
      # Sommet: Tests E2E (lents, peu nombreux)
      - job: E2ETests
        dependsOn: IntegrationTests
        steps:
          - script: npm run test:e2e

5.2 Quality gates

steps:
  - task: PublishCodeCoverageResults@1
    inputs:
      codeCoverageTool: 'Cobertura'
      summaryFileLocation: 'coverage/cobertura-coverage.xml'
  
  - script: |
      COVERAGE=$(cat coverage/coverage-summary.json | jq '.total.lines.pct')
      if (( $(echo "$COVERAGE < 80" | bc -l) )); then
        echo "Coverage below 80%: $COVERAGE%"
        exit 1
      fi
    displayName: 'Check coverage threshold'

---

6 - Pipeline monitoring

6.1 Key metrics

Metric	Target
Build duration	< 10 min
Success rate	> 95%
Lead time	< 1 day
Deployment frequency	Daily
MTTR	< 1 hour

6.2 Alerts

# Notification sur échec
resources:
  webhooks:
    - webhook: SlackWebhook
      connection: Slack-Connection

# Post-job notification
- job: Notify
  dependsOn: Deploy
  condition: failed()
  steps:
    - script: |
        curl -X POST $(SLACK_WEBHOOK) -d '{"text":"Build failed!"}'

---

7 - Cost optimization

7.1 Agents

Scenario	Recommendation
Short builds	Microsoft-hosted
Long builds	Self-hosted
Private network	Self-hosted
Frequent builds	Self-hosted + scale set

7.2 Parallel jobs

# Utiliser les parallel jobs efficacement
strategy:
  parallel: 4
  matrix:
    test-1:
      SHARD: 1/4
    test-2:
      SHARD: 2/4
    test-3:
      SHARD: 3/4
    test-4:
      SHARD: 4/4

7.3 Artifact retention

# Configurer la rétention
trigger:
  - main

variables:
  artifactRetentionDays: 30

steps:
  - publish: $(Build.ArtifactStagingDirectory)
    artifact: build
    # Retention configurée au niveau projet

---

8 - Project checklist

Initial setup

• Create the repos with a README
• Configure the branch policies
• Create the CI/CD pipelines
• Configure the variable groups
• Set up the service connections
• Configure the environments

Security

• Audit permissions
• Secrets in Key Vault
• Scoped service connections
• Branch protection enabled

Monitoring

• Dashboard configured
• Alerts on failures
• Metrics tracked

---

Summary

In this chapter, we covered:

• Project organization
• Recommended Git workflows
• Pipeline patterns
• Security best practices
• The testing strategy
• Pipeline monitoring
• Cost optimization

---

Next step

In the next chapter, we will put things into practice with Exercises and Projects.

→ Next chapter: Exercises and Projects

---

← Back to the table of contents