ADO variable groups

Registry of all Azure DevOps Variable Groups across all HCS ADO projects. Variable Groups are linked to kv-hcs-vault-01 — ADO never stores secret values directly.

---

The model

Variable Groups in ADO serve as the bridge between Key Vault and pipelines:

kv-hcs-vault-01  →  ADO Variable Group (KV-linked)  →  Pipeline task
(source of truth)     (maps KV secret names              (reads the value
                       to pipeline variable names)         at runtime)

When a pipeline needs a secret:

1. The pipeline references a Variable Group
2. ADO fetches the current secret value from Key Vault at pipeline runtime
3. The value is injected as an environment variable or pipeline variable
4. The value is never logged, never stored, never visible in pipeline output

---

How to create a new KV-linked variable group

1. In ADO, go to Pipelines → Library → + Variable group
2. Enable Link secrets from an Azure key vault as variables
3. Select:
   • Subscription: be069ae1-fc96-4a07-9f8e-5994d83a817d
   • Key vault name: kv-hcs-vault-01
4. Add the specific secrets the pipeline needs (authorize access when prompted)
5. Name the group following the convention: <project>-<env>-secrets — e.g., platform-prd-secrets
6. Save, then add it to the registry table below
7. In the pipeline YAML, reference it:

   variables:
     - group: platform-prd-secrets

8. Commit the registry update: docs(identity): register variable group <group-name>

---

Registry

Group name	ADO project	Linked vault	Secrets included	Used by pipelines	Notes
platform-prd-secrets	Platform Engineering	kv-hcs-vault-01 (inline until service connection created)	AZURE_STATIC_WEB_APPS_API_TOKEN → hcs-platform-swa-docs-deploy-token	.ado/docs-deploy.yml	Group ID 1. Token stored as secret. Full KV-linkage pending AB#21 (platform MI / service connection).
vp-prd-secrets	Vault Prospector	kv-hcs-vault-01	hcs-platform-github-app-id, hcs-platform-github-app-private-key, hcs-platform-github-org-pat, hcs-vault-prospector-chocolatey-publisher-api-key	.ado/release.yml	Group ID 3. Fully Key Vault-linked through the project-scoped HCS Platform Azure service connection.

---

Variable group access

Before a pipeline can use a Variable Group, it must be authorized:

1. In ADO, go to Pipelines → Library → <group name>
2. Click Pipeline permissions
3. Add the specific pipeline(s) that need access
4. Or use the open access toggle for trusted internal projects (use with care)

---

Adding a secret to an existing variable group

1. Add the secret to kv-hcs-vault-01 first (see secret-inventory.md)
2. In ADO: Pipelines → Library → <group name> → + Add
3. Select the secret from the KV dropdown
4. Update the Secrets included column in the registry table above
5. Commit: docs(identity): add <secret-name> to variable group <group-name>

---

Naming convention

Variable Groups follow the pattern: <project>-<env>-secrets

Component	Values
project	Short identifier for the ADO project or workload (e.g., platform, ranger, scout)
env	dev, stg, prd
suffix	Always -secrets

Examples: platform-prd-secrets, ranger-dev-secrets, scout-prd-secrets