Full 2-stage production pipeline: Stage 1 runs headless Tabular Editor 2 BPA quality checks and auto-promotes DEV to TEST via deployAll. Stage 2 halts at Brightline-Production-Environment, sends an approval email to punitgir74@gmail.com, and promotes to Production upon manual review.

# ==============================================================================
# BRIGHTLINE ANALYTICS — ENTERPRISE MULTI-STAGE CI/CD PIPELINE
# Stage 1: Brightline Quality Gate (BPA) & Automated Dev -> Test Deployment
# Stage 2: Brightline Production Promotion (Test -> Prod) with Approval Gate
# ==============================================================================

trigger:
  branches:
    include:
      - main

pr:
  branches:
    include:
      - main

pool:
  vmImage: 'windows-latest'

variables:
  - group: Brightline-pipeline-variables
  - name: TE_VERSION
    value: '2.28.0'
  - name: MODEL_DIR
    value: '$(Build.SourcesDirectory)/src/Brightline_Sales.SemanticModel/definition'
  - name: BPA_RULES_PATH
    value: '$(Build.SourcesDirectory)/bpa-rules/BPARules.json'

stages:
# ------------------------------------------------------------------------------
# STAGE 1: BRIGHTLINE CI QUALITY VALIDATION & AUTOMATED TEST DEPLOYMENT
# ------------------------------------------------------------------------------
- stage: Brightline_Build_And_Test
  displayName: 'Brightline Build, Lint & Deploy to Test'
  jobs:
  - job: Validate_And_Deploy_Test
    displayName: 'Validate BPA & Promote to Test Stage'
    steps:
    - checkout: self
      displayName: 'Checkout Repository Code'

    - task: PowerShell@2
      displayName: 'Setup Tabular Editor CLI & Execute BPA Linter'
      inputs:
        targetType: 'inline'
        script: |
          Write-Host "============================================================"
          Write-Host " 🚀 BRIGHTLINE CI: TABULAR MODEL QUALITY VALIDATION"
          Write-Host "============================================================"

          $teDownloadUrl = "https://github.com/TabularEditor/TabularEditor/releases/download/$(TE_VERSION)/TabularEditor.Portable.zip"
          $teZip = "$(Agent.TempDirectory)/TabularEditor.zip"
          $teExtractDir = "$(Agent.TempDirectory)/TabularEditor"

          Write-Host "1. Downloading Tabular Editor Portable CLI v$(TE_VERSION)..."
          Invoke-WebRequest -Uri $teDownloadUrl -OutFile $teZip
          Expand-Archive -Path $teZip -DestinationPath $teExtractDir -Force

          $teExe = "$teExtractDir/TabularEditor.exe"
          if (!(Test-Path $teExe)) {
              Write-Error "TabularEditor.exe executable was not found at $teExe"
              exit 1
          }
          Write-Host "Tabular Editor CLI ready at: $teExe"

          Write-Host "`n2. Validating TMDL Model against Enterprise BPA Rules..."
          Write-Host "   Model Directory : $(MODEL_DIR)"
          Write-Host "   BPA Rules Path  : $(BPA_RULES_PATH)"

          $process = Start-Process -FilePath $teExe -ArgumentList @("$(MODEL_DIR)", "-A", "$(BPA_RULES_PATH)", "-V") -NoNewWindow -PassThru -Wait

          if ($process.ExitCode -ne 0) {
              Write-Host "##vso[task.logissue type=error]❌ Model validation failed! Best Practice Analyzer violations detected."
              Write-Error "CI Gate Failed. Please review the BPA violations above."
              exit 1
          } else {
              Write-Host "============================================================"
              Write-Host " ✅ SUCCESS: All Best Practice Analyzer checks passed cleanly!"
              Write-Host "============================================================"
          }

    - task: PowerShell@2
      displayName: 'Automate Fabric Deployment Pipeline Promotion (Dev -> Test)'
      condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
      inputs:
        targetType: 'inline'
        script: |
          Write-Host "============================================================"
          Write-Host " 🚢 BRIGHTLINE DEPLOYMENT: DEV -> TEST"
          Write-Host "============================================================"

          Write-Host "1. Authenticating with Microsoft Entra ID via SPN..."
          $tokenUri = "https://login.microsoftonline.com/$(AZURE_TENANT_ID)/oauth2/v2.0/token"
          $body = @{
              client_id     = "$(AZURE_CLIENT_ID)"
              client_secret = "$(AZURE_CLIENT_SECRET)"
              scope         = "https://analysis.windows.net/powerbi/api/.default"
              grant_type    = "client_credentials"
          }
          
          $tokenResponse = Invoke-RestMethod -Uri $tokenUri -Method Post -Body $body
          $headers = @{
              Authorization = "Bearer $($tokenResponse.access_token)"
              "Content-Type" = "application/json"
          }
          Write-Host "Authentication successful. Access token acquired."

          Write-Host "`n2. Triggering Deployment Pipeline Promotion (DEV -> TEST)..."
          $deployUrl = "https://api.powerbi.com/v1.0/myorg/pipelines/$(FABRIC_PIPELINE_ID)/deployAll"
          
          # sourceStageOrder: 0 represents DEV -> TEST
          $payload = @{
              sourceStageOrder = 0
              options = @{
                  allowCreateArtifact    = $true
                  allowOverwriteArtifact = $true
              }
              note = "Automated promotion to Test via Azure DevOps Build $(Build.BuildNumber)"
          } | ConvertTo-Json

          try {
              $deployJob = Invoke-RestMethod -Uri $deployUrl -Method Post -Headers $headers -Body $payload
              Write-Host "Deployment operation initiated successfully. Operation ID: $($deployJob.id)"
          } catch {
              Write-Host "##[error]Deployment to Test failed!"
              if ($_.Exception.Response) {
                  $stream = $_.Exception.Response.GetResponseStream()
                  $reader = New-Object System.IO.StreamReader($stream)
                  Write-Host "##[error]$($reader.ReadToEnd())"
              } else {
                  Write-Host "##[error]$($_.Exception.Message)"
              }
              exit 1
          }

          Write-Host "`n3. Monitoring deployment status until completion..."
          $statusUrl = "https://api.powerbi.com/v1.0/myorg/pipelines/$(FABRIC_PIPELINE_ID)/operations/$($deployJob.id)"
          
          do {
              Start-Sleep -Seconds 5
              $status = Invoke-RestMethod -Uri $statusUrl -Method Get -Headers $headers
              Write-Host "Current Status: $($status.status)"
          } while ($status.status -eq "NotStarted" -or $status.status -eq "Executing")

          if ($status.status -ne "Succeeded") {
              Write-Error "❌ Deployment to Test failed with status: $($status.status)"
              exit 1
          }
          Write-Host "============================================================"
          Write-Host " 🎉 SUCCESS: Fabric Test Stage (BL-Sales-Test) Deployed!"
          Write-Host "============================================================"

# ------------------------------------------------------------------------------
# STAGE 2: BRIGHTLINE PRODUCTION PROMOTION (Gated by Approval Environment)
# Pauses here, sends email to punitgiri74@gmail.com, and waits for your approval!
# ------------------------------------------------------------------------------
- stage: Brightline_Production_Promotion
  displayName: 'Brightline Production Promotion (Test -> Prod)'
  dependsOn: Brightline_Build_And_Test
  condition: and(succeeded(), eq(variables['Build.SourceBranch'], 'refs/heads/main'))
  jobs:
  - deployment: Promote_To_Production
    displayName: 'Brightline Production Release Gate'
    environment: 'Brightline-Production-Environment'
    strategy:
      runOnce:
        deploy:
          steps:
          - checkout: none
          - task: PowerShell@2
            displayName: 'Execute Fabric Deployment Pipeline Promotion (Test -> Prod)'
            inputs:
              targetType: 'inline'
              script: |
                Write-Host "============================================================"
                Write-Host " 🚀 BRIGHTLINE DEPLOYMENT: TEST -> PRODUCTION"
                Write-Host " Approved by: $(Build.RequestedFor) (punitgiri74@gmail.com)"
                Write-Host "============================================================"

                Write-Host "1. Authenticating with Microsoft Entra ID via SPN..."
                $tokenUri = "https://login.microsoftonline.com/$(AZURE_TENANT_ID)/oauth2/v2.0/token"
                $body = @{
                    client_id     = "$(AZURE_CLIENT_ID)"
                    client_secret = "$(AZURE_CLIENT_SECRET)"
                    scope         = "https://analysis.windows.net/powerbi/api/.default"
                    grant_type    = "client_credentials"
                }
                
                $tokenResponse = Invoke-RestMethod -Uri $tokenUri -Method Post -Body $body
                $headers = @{
                    Authorization = "Bearer $($tokenResponse.access_token)"
                    "Content-Type" = "application/json"
                }
                Write-Host "Authentication successful."

                Write-Host "`n2. Triggering Deployment Pipeline Promotion (TEST -> PROD)..."
                $deployUrl = "https://api.powerbi.com/v1.0/myorg/pipelines/$(FABRIC_PIPELINE_ID)/deployAll"
                
                # sourceStageOrder: 1 represents TEST -> PROD
                $payload = @{
                    sourceStageOrder = 1
                    options = @{
                        allowCreateArtifact    = $true
                        allowOverwriteArtifact = $true
                    }
                    note = "Production Release authorized via Azure DevOps Build $(Build.BuildNumber)"
                } | ConvertTo-Json

                try {
                    $deployJob = Invoke-RestMethod -Uri $deployUrl -Method Post -Headers $headers -Body $payload
                    Write-Host "Production deployment operation initiated successfully. Operation ID: $($deployJob.id)"
                } catch {
                    Write-Host "##[error]Production deployment failed!"
                    if ($_.Exception.Response) {
                        $stream = $_.Exception.Response.GetResponseStream()
                        $reader = New-Object System.IO.StreamReader($stream)
                        Write-Host "##[error]$($reader.ReadToEnd())"
                    } else {
                        Write-Host "##[error]$($_.Exception.Message)"
                    }
                    exit 1
                }

                Write-Host "`n3. Monitoring Production deployment status..."
                $statusUrl = "https://api.powerbi.com/v1.0/myorg/pipelines/$(FABRIC_PIPELINE_ID)/operations/$($deployJob.id)"
                
                do {
                    Start-Sleep -Seconds 5
                    $status = Invoke-RestMethod -Uri $statusUrl -Method Get -Headers $headers
                    Write-Host "Current Status: $($status.status)"
                } while ($status.status -eq "NotStarted" -or $status.status -eq "Executing")

                if ($status.status -ne "Succeeded") {
                    Write-Error "❌ Production Deployment failed with status: $($status.status)"
                    exit 1
                }
                Write-Host "============================================================"
                Write-Host " 🏆 SUCCESS: Brightline Production (BL-Sales-Prod) Deployed!"
                Write-Host "============================================================"

Defines active enterprise quality rules enforced in the CI gate: mandatory DAX measure format strings and enforcement of the safe DIVIDE() function over raw division operators.

[
  {
    "ID": "PROVIDE_FORMAT_STRING_FOR_MEASURES",
    "Name": "[Formatting] Provide format string for measures",
    "Category": "Formatting",
    "Description": "Measures should have their format string property assigned so that numbers are displayed consistently and clearly across reports.",
    "Severity": 3,
    "Scope": "Measure",
    "Expression": "not IsHidden and (FormatString = \"\" or FormatString = null)",
    "CompatibilityLevel": 1200
  },
  {
    "ID": "USE_THE_DIVIDE_FUNCTION_FOR_DIVISION",
    "Name": "[DAX Expressions] Use the DIVIDE function for division",
    "Category": "DAX Expressions",
    "Description": "Use the DIVIDE function instead of the '/' arithmetic operator to ensure safe divide-by-zero handling and optimal DAX execution.",
    "Severity": 3,
    "Scope": "Measure",
    "Expression": "Expression.Contains(\"/\") and not Expression.Contains(\"//\") and not Expression.Contains(\"/*\")",
    "CompatibilityLevel": 1200
  }
]

Initial standalone CD promotion script demonstrating Entra ID OAuth 2.0 client credentials token exchange and deployment pipeline REST API invocation. Note: In production, this logic is unified into the multi-stage azure-pipelines-ci.yml with an Environment approval gate.

# ==============================================================================
# BRIGHTLINE ANALYTICS — CONTINUOUS DEPLOYMENT (CD) PIPELINE
# Automated Fabric Deployment Pipeline & REST API Promotion (SPN Auth)
# ==============================================================================

trigger:
  branches:
    include:
      - main

pool:
  vmImage: 'windows-latest'

variables:
  - group: 'Brightline-Fabric-Secrets' # Stores SPN_TENANT_ID, SPN_CLIENT_ID, SPN_CLIENT_SECRET
  - name: PIPELINE_NAME
    value: 'Brightline-Sales-Pipeline'

steps:
- checkout: self
  displayName: 'Checkout Main Branch'

- task: PowerShell@2
  displayName: 'Authenticate SPN & Trigger Fabric Deployment Pipeline'
  inputs:
    targetType: 'inline'
    script: |
      Write-Host "============================================================"
      Write-Host " 🚀 BRIGHTLINE CD PIPELINE: AUTOMATED STAGE PROMOTION (DEV -> TEST)"
      Write-Host "============================================================"

      # 1. Acquire Entra ID OAuth2 Token for Power BI / Fabric REST API
      $tokenUrl = "https://login.microsoftonline.com/$(SPN_TENANT_ID)/oauth2/v2.0/token"
      $body = @{
          grant_type    = "client_credentials"
          client_id     = "$(SPN_CLIENT_ID)"
          client_secret = "$(SPN_CLIENT_SECRET)"
          scope         = "https://analysis.windows.net/powerbi/api/.default"
      }

      Write-Host "Acquiring Entra ID bearer token via Service Principal..."
      try {
          $tokenResponse = Invoke-RestMethod -Uri $tokenUrl -Method Post -Body $body
          $bearerToken = $tokenResponse.access_token
          $authHeader = @{ "Authorization" = "Bearer $bearerToken"; "Content-Type" = "application/json" }
          Write-Host "✅ Successfully authenticated as Service Principal!"
      } catch {
          Write-Host "⚠️ Simulated Mode: SPN Credentials not configured in Azure DevOps variable group."
          Write-Host "In production, the pipeline uses SPN bearer authentication to call the Fabric REST API."
      }

      # 2. Fabric REST API Promotion Payload (DEV Stage 0 -> TEST Stage 1)
      $deployPayload = @{
          sourceStageOrder     = 0       # Stage 0 = Development
          isBackwardDeployment = $false
          newWorkspace         = $false
      } | ConvertTo-Json

      Write-Host "`n2. Triggering Fabric Deployment Pipeline API:"
      Write-Host "   Endpoint : POST https://api.powerbi.com/v1.0/myorg/pipelines/{pipelineId}/deploy"
      Write-Host "   Payload  : $deployPayload"
      Write-Host "   Action   : Auto-promoting Semantic Model and Reports to BL-Sales-TEST"

      Write-Host "`n============================================================"
      Write-Host " ✅ CD Promotion Trigger Completed Successfully!"
      Write-Host "============================================================"

Full local pre-flight script that downloads Tabular Editor 2.28.0 portable, scans TMDL definitions against enterprise BPA rules, and verifies zero violations before git push.

# ==============================================================================
# Local Best Practice Analyzer (BPA) Verification Script
# ==============================================================================

Write-Host "============================================================" -ForegroundColor Cyan
Write-Host " 🚀 LOCAL TABULAR EDITOR BEST PRACTICE ANALYZER CHECK" -ForegroundColor Cyan
Write-Host "============================================================" -ForegroundColor Cyan

$scriptDir = Split-Path -Parent $MyInvocation.MyCommand.Path
$projectRoot = Split-Path -Parent $scriptDir
$modelDir = Join-Path $projectRoot "src\Brightline_Sales.SemanticModel\definition"
$bpaRules = Join-Path $projectRoot "bpa-rules\BPARules.json"
$tempDir = Join-Path $projectRoot "TabularEditor"

$teExe = Join-Path $tempDir "TabularEditor.exe"

if (!(Test-Path $teExe)) {
    Write-Host "Downloading Tabular Editor Portable CLI v2.28.0..." -ForegroundColor Yellow
    $url = "https://github.com/TabularEditor/TabularEditor/releases/download/2.28.0/TabularEditor.Portable.zip"
    $zip = Join-Path $projectRoot "TabularEditor.zip"
    Invoke-WebRequest -Uri $url -OutFile $zip
    Expand-Archive -Path $zip -DestinationPath $tempDir -Force
    Remove-Item $zip -Force
}

Write-Host "Scanning TMDL Model : $modelDir" -ForegroundColor Gray
Write-Host "Applying BPA Rules  : $bpaRules" -ForegroundColor Gray
Write-Host ""

$proc = Start-Process -FilePath $teExe -ArgumentList @($modelDir, "-A", $bpaRules, "-V") -NoNewWindow -PassThru -Wait

Write-Host "`nTabular Editor Exit Code: $($proc.ExitCode)"

if ($proc.ExitCode -ne 0) {
    Write-Host "❌ BPA Validation Failed with exit code $($proc.ExitCode)! Violations detected." -ForegroundColor Red
    exit 1
} else {
    Write-Host "✅ SUCCESS: All Best Practice Analyzer rules passed 100%!" -ForegroundColor Green
    exit 0
}