Skip to content

Prerequisites

Line these up before wiring the pipeline. All use assets you already own.

1. Azure DevOps

  • An Azure DevOps organization + project (you have this).
  • A Code wiki — either convert the existing Project wiki or create a Git repo ops-runbook-wiki and publish it as a Code wiki.
  • Branch policy on main of the wiki repo:
    • Require a pull request (no direct pushes).
    • Require build validation → the wiki-ci pipeline.
    • Require at least 1 reviewer; enable "reviewers from CODEOWNERS/owners".
  • A service account / service principal used by n8n to open PRs. It may push branches and open PRs but must not be allowed to approve or complete them.

2. Identity & secrets

  • Azure Key Vault (existing is fine) holding:
    • AOAI-ENDPOINT, AOAI-KEY (or use Managed Identity — preferred).
    • ADO-PAT (scoped: Code read/write, PR contribute) only if not using workload identity.
    • N8N-WEBHOOK-SECRET (HMAC secret for the inbound webhook).
  • Managed Identity / workload identity for n8n's host with:
    • Cognitive Services OpenAI User on the Azure OpenAI resource.
    • Access policy / RBAC to read the Key Vault secrets.

No secrets in workflows or repos

n8n reads secrets from its credential store (backed by Key Vault). Nothing sensitive is committed to Git or pasted into workflow JSON.

3. Azure OpenAI

  • A deployment for drafting — gpt-4o-mini is the cheap default.
  • (Optional) a stronger deployment (gpt-4o) for hard cases.
  • (Phase 2) an embedding deployment (text-embedding-3-large) for RAG.
  • Confirm the model is available in your region/cloud (China 21Vianet is separate).

4. n8n (self-hosted)

  • Reachable webhook URL (internal ingress is fine; ADO service hooks must be able to POST to it).
  • Credentials configured: Azure OpenAI, Azure DevOps, (Phase 2) Teams.
  • Queue mode if volume grows; a single instance is fine for four projects.

5. Teams (optional, Phase 2 / drift report)

  • An Incoming Webhook on the channel that should receive the nightly drift report.

Quick verification

# AOAI reachable with your creds (from the n8n host)
curl "$AOAI_ENDPOINT/openai/deployments/gpt-4o-mini/chat/completions?api-version=2024-10-21" \
  -H "api-key: $AOAI_KEY" -H "Content-Type: application/json" \
  -d '{"messages":[{"role":"user","content":"ping"}],"max_tokens":5}'

# ADO API reachable with the service account
curl -u ":$ADO_PAT" \
  "https://dev.azure.com/<org>/<project>/_apis/git/repositories?api-version=7.1"