Setting up Resources and Pipelines
for Rio Evo

Use Devin to create a new branch for your repository. Provide the repo name and a suitable branch name.

Devin prompt: "Create me a new branch for the following repo. Service.Allergies" — branch name: ADO/2529301/create-environments

Branch selection dropdown showing the newly created branch alongside existing branches

Switch to your new branch in Azure Repos and press Clone.

Azure Repos — switch to your branch and click the Clone button (top right)

In the Clone Repository dialog, select Clone in VS Code.

Clone Repository dialog — use the SSH URL and click "Clone in VS Code"

When prompted, select your destination folder (e.g. your RioEvo folder).

VS Code folder selection — navigate to your RioEvo folder and click "Select as Repository Destination"

Once cloned, confirm VS Code is on the correct repo and branch. Check the breadcrumb at the top of the explorer.

VS Code breadcrumb confirming: Services.Allergies › ADO/2529301/create-environments

Download New-TerraformService.ps1 from the TerraformScript Repos location and place it into the root of your cloned repository folder.

File explorer showing the cloned repo structure — New-TerraformService.ps1 placed in the root alongside other config files

Open a terminal in VS Code and run the PowerShell script:

Error: "File cannot be loaded. The file is not digitally signed. You cannot run this script on the current system."

Run this command first, then try again:

Running Set-ExecutionPolicy Bypass, then re-running the script

The script will prompt for a ServiceName. Enter your service name (e.g. allergies).

Script prompts: "Supply values for the following parameters: ServiceName:"

Enter your service name — in this example: allergies

The script will scaffold the Terraform files and confirm completion:

Scaffold complete — all Terraform files, backend configs, variables, and pipeline YAML files are generated

Check the generated files carefully. Pay particular attention to the tfbackend files — the script sometimes adds an extra 's' to the service name which is incorrect.

Check dev.tfbackend (and test/prod): the key value may incorrectly read are-allergiess-dev-ukw.tfstate — remove the extra 's'

frontend/azure/build-and-deploy.yml — comment out the Deploy Test section:

build-and-deploy.yml — Deploy Test stage commented out (lines 94–120 shown commented with #)

terraform/azure/deploy-terraform.yml — comment out the Test Plan and Test Apply sections:

deploy-terraform.yml — Test Plan and subsequent stages commented out

Commit all staged changes to your branch. Do not commit the PowerShell script (New-TerraformService.ps1) — leave it out of the commit.

Stage all generated files (11 files) with commit message e.g. "internal: adding scripts for setup #2529301" — ensure New-TerraformService.ps1 is NOT staged

After committing, sync the branch by pressing the sync button at the bottom of VS Code.

Press the sync button (↑↓) in the VS Code status bar to push your commit to the remote branch

Access HSC – Shared Micro Services › Pipelines › All › Terraform › Rio Evo

Navigate to the Terraform > Rio Evo folder in Pipelines. Create a new folder for your product (e.g. Allergies).

Navigate to Terraform › Rio Evo in the Pipelines folder tree

Create a new folder named after your product (e.g. "Allergies") under \Terraform\Rio Evo\

The new Allergies folder is empty — click "Create a new pipeline here"

Follow the pipeline creation wizard:

Step 1 — Connect: Select Azure Repos Git

Select "Azure Repos Git (YAML)" as the source

Step 2 — Select: Search for and select your repository

Search for your repo (e.g. "aller") and select it from the results

Step 3 — Configure: Select Existing Azure Pipelines YAML file

Choose "Existing Azure Pipelines YAML file" at the bottom of the Configure list

Step 4 — Select branch and path: Choose your working branch, then select the YAML file path

Select your branch (e.g. ADO/2529301/create-environments) from the Branch dropdown

Select /terraform/azure/deploy-terraform.yml from the Path dropdown

Press the dropdown arrow next to Run and select Save (do not run yet).

Click the arrow next to "Run" and select "Save" to save without running

Before running the pipeline, confirm the resource group doesn't already exist. Go to Azure Resource Manager and filter by your service name and the HSC - RioReimagined - Dev subscription.

Filter by your service name (e.g. "aller") and the Dev subscription — confirm "No resource groups match your filters"

Run the pipeline for the first time with Plan Only (skip Apply) ticked to verify what will be created without making any changes.

Select your branch in the pipeline version selector:

Select your working branch (e.g. ADO/2529301/create-environments) as the pipeline version

Ensure Plan Only (skip Apply) is ticked, then press Run:

Set Target Environment to dev and tick Plan Only (skip Apply) for the first run

On the first run you will need to grant permissions. Click View when the permission warning appears:

Permission warning: "This pipeline needs permission to access 2 resources before this run can continue to Dev - Plan" — click View

Permit all listed resources:

Click Permit for both: Repository (Rio.SharedResources) and Variable group (are-terraform)

Wait for the pipeline to complete. Check the Terraform Plan step to review what resources will be created:

Dev - Plan stage completed successfully — all steps including Terraform Plan show green ticks

Review the Terraform Plan output to confirm the correct resource group name:

Terraform Plan output — confirm the resource_group_name matches your expected naming convention (e.g. are-allergies-dev-ukw-rg-01)

Run the pipeline again, this time with Plan Only (skip Apply) unticked to actually create the resources.

Uncheck "Plan Only (skip Apply)" — this will run the full Terraform Apply after the Plan

The Dev - Apply stage will require another permission grant. Watch for the warning and click View:

Dev - Plan completes, then Dev - Apply waits for permission — click View to grant access

The Terraform Apply (Dev) job is waiting — grant permission to proceed. The Apply step may take several minutes to complete.

Return to Azure Resource Manager and filter again to confirm the resource group and all resources have been created.

Resource group are-allergies-dev-ukw-rg-01 now appears in the HSC - RioReimagined - Dev subscription

Open the resource group to confirm all expected resources are present:

All resources created: Key Vault (UK West), Application Insights (UK West), Container App (UK West), Managed Identity (UK West), Static Web App (West Europe)

Access HSC – Shared Micro Services › Pipelines › All › Deployments › Rio Evo

Navigate to Deployments > Rio Evo. Create a new folder for your product.

Create a new folder named after your product under \Deployments\Rio Evo\

The new Allergies folder is empty — click "Create a new pipeline here"

Follow the same pipeline creation wizard as Step 7 (Azure Repos Git → select repo → Existing YAML file → select branch). For the YAML path, select:

Select /frontend/azure/build-and-deploy.yml from the Path dropdown

Press the dropdown arrow next to Run and select Save.

After saving, click Edit on the pipeline:

Click the Edit button (top right) to open the pipeline editor

Click the three-dot menu (⋯) and select Triggers:

Open the ⋯ menu and select Triggers

Under Continuous integration, tick Override the YAML continuous integration trigger and select Disable continuous integration:

Override the YAML CI trigger and set to Disable continuous integration

Rename the pipeline by clicking the pencil icon next to the pipeline name. Add SWA Deploy to the name:

Click the pencil icon next to the pipeline name to rename it

Rename to e.g. Services.Allergies SWA Deploy, then click Save & queue › Save

Access HSC – Shared Micro Services › Pipelines › All › Deployments › Rio Evo › Allergies

The Allergies folder already exists from the previous step. Right-click it and select New pipeline:

Right-click the Allergies folder and select New pipeline

Follow the same wizard (Azure Repos Git → select repo → Existing YAML file → select branch). For the YAML path, you need /backend/{name}-service/azure/deploy-pipelines.yml. This likely won't appear in the dropdown list and must be entered manually.

The deploy-pipelines.yml file may not appear in the list — you'll need to enter the path manually

In VS Code, check if the file exists under backend/allergies-service/azure/:

Check the backend/allergies-service folder — if the azure subfolder or pipeline files don't exist, copy them from another product

If the files don't exist, copy them from another product and edit any references for your service. The azure folder should contain:

The azure folder should contain: analysis-pipelines.yml, build-pipelines.yml, and deploy-pipelines.yml

Commit and sync the pipeline files to your branch:

Commit the 3 pipeline files: "internal: adding pipeline files #2529301"

Back in Azure DevOps, right-click deploy-pipelines.yml in VS Code and select Copy Relative Path:

Right-click deploy-pipelines.yml and select Copy Relative Path

Paste the path into the YAML file selector in Azure DevOps:

Paste the relative path: backend/allergies-service/azure/deploy-pipelines.yml

Press the dropdown arrow next to Run and select Save. The pipeline breadcrumb should show:

Pipeline saved as: Allergies › Services.Allergies API Deploy

Follow the same process as Step 13: Edit → Triggers → Override YAML CI trigger → Disable continuous integration → Rename → Save.

After saving both the SWA Deploy and API Deploy pipelines, you should see both listed under the Allergies folder:

Both deployment pipelines created: Services.Allergies API Deploy and Services.Allergies SWA Deploy — both showing "No runs yet"

Access HSC – Shared Micro Services › Pipelines › All › Builds › Rio Evo

Navigate to Builds > Rio Evo. Create a new folder for your product.

Create a new folder named after your product under \Builds\Rio Evo\

Follow the same wizard. For the YAML path, you need /backend/{name}-service/azure/build-pipelines.yml. Right-click the file in VS Code and select Copy Relative Path:

Right-click build-pipelines.yml and select Copy Relative Path

Paste the path into the YAML file selector:

Paste the relative path: backend/allergies-service/azure/build-pipelines.yml

Press Save. The pipeline breadcrumb should show:

Pipeline saved as: Allergies › Services.Allergies Build

Follow the same process: Edit → Triggers → Override YAML CI trigger → Disable continuous integration → Rename to Services.Allergies Build.

Next, go to the Variables tab and add a pipeline variable:

Click the Variables tab, then click + Add to add a new pipeline variable

Add the following variable:

Then save using Save & queue → Save:

Confirm the AzureSubscription variable is set to HSC RIOREIMG DEV, then click Save

Run the Build pipeline from your branch. Leave the runtests and runMigrations parameters unchecked for the initial run.

Select your branch and leave runtests / runMigrations unchecked, then click Run

As with previous pipelines, watch for permission warnings and grant access when prompted:

Permission needed — click View and grant access to continue the Build and Publish Services stage

Once the Build stage completes, the Deploy to Dev stage will appear and may also require permission:

Build stage completes (58s, 1 artifact produced) — grant permission for the Deploy to Dev stage

Run the SWA Deploy pipeline from your branch. As with previous pipelines, watch for approval/permit warnings. While only DEV is enabled, it should not prompt to select an environment.

Before running the API pipeline, use Devin to set the correct target port on both the Docker configuration and the Container App ingress settings. This prevents the container from failing to start due to port mismatches.

Send this prompt to Devin (adapted for your repo, branch, and port): set target_port = 8080, external_enabled = true, allow_insecure_connections = false in the ingress block

Run the API Deploy pipeline from your branch. Leave the artifact as the default on the first run. Watch for permission warnings as with previous pipelines.

Run the API pipeline — the Build artifact (e.g. 0.2.1-2529301-create-environments.3) will be pre-selected. Leave as default for the first run.

At this stage the setup should be complete. Here is a summary of everything that has been done: