APEX workflow
A multi-agent Azure workflow from requirements to deploy-ready Bicep or Terraform, with checks and human approval at every stage
- 220 ★ on the repository
- Last commit
- MIT
Broad access
Why this level
- The deployment stage changes real Azure resources and spends subscription money
- The workflow reads subscription policy snapshots that may contain environment identifiers
Install
- Works in
Manual install
Take the jonathan-vella/apex-accelerator template, open it in the dev container and call the orchestrator agent. Do not deploy resources into a subscription without the user's explicit approval at the deployment stage, and show the what-if result first.
Access and checks
How we reviewBroad accessThe tool can change data, run commands or handle secrets.
- The deployment stage changes real Azure resources and spends subscription money
- The workflow reads subscription policy snapshots that may contain environment identifiers
This is third-party code. Review the repository files before installing.
What it does
APEX, Agentic Platform Engineering eXperience for Azure, is a workflow for platform engineers. An orchestrator agent takes an infrastructure description and turns it into structured requirements, while a separate challenger agent probes them for weaknesses. Then come an architecture assessment against Well-Architected principles and cost, a search for Azure policy constraints, an implementation plan, generation of Bicep or Terraform templates on vetted modules and deployment with a what-if or terraform plan preview. After each stage the process stops for human approval: AI prepares, humans decide. The agents live in .github/agents (orchestrator, requirements, architect, governance, IaC planner, code generation, deployment, as-built documentation, diagnosis, challenger, context optimizer), and Azure knowledge is packed into apex-azure-* skills. Prices come from checksummed snapshots of the retail price catalog; the model's memory is not used for prices. The apex-accelerator template, the apexops.pro documentation and a MicroHack workshop are available for projects.
Who it is for. Platform engineers and Azure architects who want Bicep or Terraform with traceable decisions and manual approvals.
Good fit when
- A new Azure project starts with requirements that a challenger should test before architecture
- You need a cost estimate from retail price snapshots with source and date
- Bicep or Terraform templates are built on vetted modules and deployment follows a what-if
- Existing infrastructure needs an as-built document and diagnostics
Not a fit when
- You need a quick one-off template edit: a multi-stage process with approvals is too heavy
- The cloud is not Azure: knowledge and policies are built around it
- The project must not touch a real subscription: the deployment stage works with one
Example request
Run the APEX workflow: describe requirements for a web app on Azure and prepare Bicep after the architecture is approvedLimitations
The workflow targets Azure and GitHub Copilot agents, and the repository dev container sets up orchestration and tools. The deployment stage works with a real subscription, so use a separate trial subscription with limited rights. Existing projects keep the old contract until you explicitly adopt the new practical workflow. Prices are computed only from explicit billing inputs, and an estimate without them is indicative.
How to disable. Remove the apex agents and skills from your repository's .github/ and stop using the dev container. Created Azure resources are deleted separately with Azure tools.
FAQ
Which stages does the workflow go through?
Requirements, architecture and cost, governance constraints, implementation plan, Bicep or Terraform generation, deployment and an as-built document. A human approves the result after most stages.
What does the challenger agent do?
It reviews requirements, architecture, cost estimate, constraints and the plan independently of the author, looking for weaknesses and writing results to challenge-findings-*.json files the user sees before approving.
Is Bicep or Terraform chosen?
Yes. The choice is recorded in the requirements as iac_tool, and the unified planner then routes the task to Bicep or Terraform code generation and deployment.
Where do prices come from?
From snapshots of the Azure retail catalog with exact response bytes and timestamps. Indicative estimates are allowed only from explicit rates, and stale data goes back to its owner for refresh.
Where are the docs and training materials?
Documentation is at apexops.pro, the template is in the apex-accelerator repository and the hands-on MicroHack workshop is at microhack.apexops.pro.
Discussion
No questions or reviews yet.
Related
WorkflowsEight skills for Azure SRE Agent audit architecture, policy compliance, capacity and cost of a subscription and score it
Azure Skills
Azure Skills Plugin
Microsoft's official plugin: Azure skills plus the Azure MCP Server and Foundry MCP wired in for real cloud actions
A community MCP server for Azure DevOps work items, code and builds, with PAT authentication for on-premises Azure DevOps Server
28 AWS skills for Amazon EKS and ECS: architecture, Terraform, live cluster review, upgrade checks and security.
Microsoft's official MCP server for Azure: the agent sees subscription resources and works with Azure services on your behalf
Microsoft Agent Skills
Agent Skills
Official Microsoft skills that ground coding agents in Azure SDKs and Foundry for Python, .NET, TypeScript, Java and Rust
Comparison with similar tools
Cards that share the main search query, and how they differ.
| Tool | Official | Repository stars | Main difference |
|---|---|---|---|
| APEX (this card) | no | 220 | |
| Azure Skills | no | 1,636 | a set of Azure knowledge for an agent, while APEX adds a staged workflow with approvals |
| Azure Agent Skills | no | 813 | skills for Azure services, while APEX has role agents and a challenger |
README in short
The README describes a practical workflow for new projects: reuse of decisions, batched repairs, early policy checks, snapshot-based pricing and rules for private evidence. A sequence diagram follows, from intent to deployment verification, with human approval gates marked.