@peterhauge/apiops-cli 0.1.3-alpha.0

package/dist/templates/configs/filter-config.js

@@ -0,0 +1,51 @@
+/**
+ * T047: Sample filter configuration template
+ * Generates a sample configuration.extract.yaml file
+ */
+export function generateFilterConfig() {
+    return `# APIM Extract Filter Configuration
+# Customize this file to control which resources are extracted
+
+# Extract only specific APIs by name
+# apiNames:
+#   - echo-api
+#   - petstore-api
+
+# Extract only specific products
+# productNames:
+#   - starter
+#   - unlimited
+
+# Extract only specific backends
+# backendNames:
+#   - backend-api
+#   - legacy-backend
+
+# Extract only specific named values
+# namedValueNames:
+#   - api-key
+#   - connection-string
+
+# Extract only specific loggers
+# loggerNames:
+#   - appinsights-logger
+
+# Extract only specific diagnostics
+# diagnosticNames:
+#   - applicationinsights
+
+# Extract only specific tags
+# tagNames:
+#   - production
+#   - external
+
+# Extract only specific policy fragments
+# policyFragmentNames:
+#   - rate-limit-fragment
+#   - cors-fragment
+
+# Uncomment to extract ALL resources (default behavior if no filters specified)
+# Leave all sections commented to extract everything
+`;
+}
+//# sourceMappingURL=filter-config.js.map

package/dist/templates/configs/filter-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"filter-config.js","sourceRoot":"","sources":["../../../src/templates/configs/filter-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,UAAU,oBAAoB;IAClC,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA2CR,CAAC;AACF,CAAC"}

package/dist/templates/configs/override-config.d.ts

@@ -0,0 +1,6 @@
+/**
+ * T047: Sample override configuration template per environment
+ * Generates environment-specific configuration.{env}.yaml files
+ */
+export declare function generateOverrideConfig(environment: string): string;
+//# sourceMappingURL=override-config.d.ts.map

package/dist/templates/configs/override-config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"override-config.d.ts","sourceRoot":"","sources":["../../../src/templates/configs/override-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,wBAAgB,sBAAsB,CAAC,WAAW,EAAE,MAAM,GAAG,MAAM,CAuClE"}

package/dist/templates/configs/override-config.js

@@ -0,0 +1,45 @@
+/**
+ * T047: Sample override configuration template per environment
+ * Generates environment-specific configuration.{env}.yaml files
+ */
+export function generateOverrideConfig(environment) {
+    return `# APIM Override Configuration for ${environment} environment
+# Customize resource properties for this specific environment
+
+# Override named values (e.g., API keys, connection strings)
+# namedValues:
+#   api-key:
+#     value: "${environment}-api-key-value"
+#   connection-string:
+#     value: "Server=${environment}-db.example.com;Database=mydb"
+#   secret-from-keyvault:
+#     keyVault:
+#       secretIdentifier: "https://${environment}-kv.vault.azure.net/secrets/my-secret"
+#       identityClientId: "00000000-0000-0000-0000-000000000000"
+
+# Override backend URLs per environment
+# backends:
+#   backend-api:
+#     url: "https://${environment}-api.example.com"
+#   legacy-backend:
+#     url: "https://${environment}-legacy.example.com"
+
+# Override API service URLs
+# apis:
+#   echo-api:
+#     serviceUrl: "https://${environment}-echo.example.com"
+#   petstore-api:
+#     serviceUrl: "https://${environment}-petstore.example.com"
+
+# Override diagnostic logger references
+# diagnostics:
+#   applicationinsights:
+#     loggerId: "appinsights-logger-${environment}"
+
+# Override logger credentials or resource IDs
+# loggers:
+#   appinsights-logger:
+#     resourceId: "/subscriptions/xxxxx/resourceGroups/${environment}-rg/providers/microsoft.insights/components/${environment}-appinsights"
+`;
+}
+//# sourceMappingURL=override-config.js.map

package/dist/templates/configs/override-config.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"override-config.js","sourceRoot":"","sources":["../../../src/templates/configs/override-config.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,UAAU,sBAAsB,CAAC,WAAmB;IACxD,OAAO,qCAAqC,WAAW;;;;;;gBAMzC,WAAW;;uBAEJ,WAAW;;;qCAGG,WAAW;;;;;;sBAM1B,WAAW;;sBAEX,WAAW;;;;;6BAKJ,WAAW;;6BAEX,WAAW;;;;;sCAKF,WAAW;;;;;yDAKQ,WAAW,+CAA+C,WAAW;CAC7H,CAAC;AACF,CAAC"}

package/dist/templates/configs/package-json.d.ts

@@ -0,0 +1,10 @@
+/**
+ * Generates a package.json for the target repo that references
+ * the apiops CLI tarball via a local file dependency.
+ */
+export interface PackageJsonConfig {
+    /** Relative path from the target repo root to the copied tarball (e.g. '.apiops/apiops-0.1.0.tgz') */
+    tarballRelPath: string;
+}
+export declare function generatePackageJson(config: PackageJsonConfig): string;
+//# sourceMappingURL=package-json.d.ts.map

package/dist/templates/configs/package-json.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-json.d.ts","sourceRoot":"","sources":["../../../src/templates/configs/package-json.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,iBAAiB;IAChC,sGAAsG;IACtG,cAAc,EAAE,MAAM,CAAC;CACxB;AAED,wBAAgB,mBAAmB,CAAC,MAAM,EAAE,iBAAiB,GAAG,MAAM,CAerE"}

package/dist/templates/configs/package-json.js

@@ -0,0 +1,19 @@
+/**
+ * Generates a package.json for the target repo that references
+ * the apiops CLI tarball via a local file dependency.
+ */
+export function generatePackageJson(config) {
+    // Use forward slashes in the file: dependency regardless of OS
+    const posixPath = config.tarballRelPath.replace(/\\/g, '/');
+    const pkg = {
+        name: 'apim-ops-repo',
+        version: '1.0.0',
+        private: true,
+        description: 'Azure API Management configuration-as-code repository',
+        dependencies: {
+            apiops: `file:${posixPath}`,
+        },
+    };
+    return JSON.stringify(pkg, null, 2) + '\n';
+}
+//# sourceMappingURL=package-json.js.map

package/dist/templates/configs/package-json.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"package-json.js","sourceRoot":"","sources":["../../../src/templates/configs/package-json.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAOH,MAAM,UAAU,mBAAmB,CAAC,MAAyB;IAC3D,+DAA+D;IAC/D,MAAM,SAAS,GAAG,MAAM,CAAC,cAAc,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC,CAAC;IAE5D,MAAM,GAAG,GAAG;QACV,IAAI,EAAE,eAAe;QACrB,OAAO,EAAE,OAAO;QAChB,OAAO,EAAE,IAAI;QACb,WAAW,EAAE,uDAAuD;QACpE,YAAY,EAAE;YACZ,MAAM,EAAE,QAAQ,SAAS,EAAE;SAC5B;KACF,CAAC;IAEF,OAAO,IAAI,CAAC,SAAS,CAAC,GAAG,EAAE,IAAI,EAAE,CAAC,CAAC,GAAG,IAAI,CAAC;AAC7C,CAAC"}

package/dist/templates/copilot/identity-setup-prompt.d.ts

@@ -0,0 +1,13 @@
+/**
+ * GitHub Copilot prompt template for automating identity setup.
+ * Generates a .prompt.md file that guides Copilot through:
+ *   1. Gathering Azure & GitHub info from the user
+ *   2. Creating Azure AD app registration + federated credentials
+ *   3. Assigning RBAC roles
+ *   4. Setting GitHub repository secrets
+ */
+export interface IdentitySetupPromptConfig {
+    environments: string[];
+}
+export declare function generateIdentitySetupPrompt(config: IdentitySetupPromptConfig): string;
+//# sourceMappingURL=identity-setup-prompt.d.ts.map

package/dist/templates/copilot/identity-setup-prompt.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-setup-prompt.d.ts","sourceRoot":"","sources":["../../../src/templates/copilot/identity-setup-prompt.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,MAAM,WAAW,yBAAyB;IACxC,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,wBAAgB,2BAA2B,CAAC,MAAM,EAAE,yBAAyB,GAAG,MAAM,CAgSrF"}

package/dist/templates/copilot/identity-setup-prompt.js

@@ -0,0 +1,279 @@
+/**
+ * GitHub Copilot prompt template for automating identity setup.
+ * Generates a .prompt.md file that guides Copilot through:
+ *   1. Gathering Azure & GitHub info from the user
+ *   2. Creating Azure AD app registration + federated credentials
+ *   3. Assigning RBAC roles
+ *   4. Setting GitHub repository secrets
+ */
+export function generateIdentitySetupPrompt(config) {
+    const envSecrets = config.environments.map((env) => `- \`AZURE_SUBSCRIPTION_ID\` — Azure subscription ID for **${env}** environment
+- \`APIM_RESOURCE_GROUP_${env.toUpperCase()}\` — Resource group containing the **${env}** APIM instance
+- \`APIM_SERVICE_NAME_${env.toUpperCase()}\` — APIM service name for **${env}**`).join('\n');
+    const envFedCreds = config.environments.map((env) => `### ${env} environment
+
+**On macOS/Linux (Bash):**
+\`\`\`bash
+az ad app federated-credential create \\
+  --id "$APP_ID" \\
+  --parameters '{
+    "name": "github-env-${env}",
+    "issuer": "https://token.actions.githubusercontent.com",
+    "subject": "repo:'"\${GITHUB_ORG}"'/'"\${GITHUB_REPO}"':environment:${env}",
+    "audiences": ["api://AzureADTokenExchange"]
+  }'
+\`\`\`
+
+**On Windows (PowerShell):**
+\`\`\`powershell
+az ad app federated-credential create \`
+  --id $APP_ID \`
+  --parameters '{\\"name\\":\\"github-env-${env}\\",\\"issuer\\":\\"https://token.actions.githubusercontent.com\\",\\"subject\\":\\"repo:'\${GITHUB_ORG}'/'\${GITHUB_REPO}':environment:${env}\\",\\"audiences\\":[\\"api://AzureADTokenExchange\\"]}'
+\`\`\``).join('\n\n');
+    const ghSecretEnvCmds = config.environments.map((env) => `# ${env} environment secrets
+gh secret set AZURE_SUBSCRIPTION_ID --body "\${AZURE_SUBSCRIPTION_ID_${env.toUpperCase()}}" --env ${env}
+gh secret set APIM_RESOURCE_GROUP_${env.toUpperCase()} --body "\${APIM_RG_${env.toUpperCase()}}" --env ${env}
+gh secret set APIM_SERVICE_NAME_${env.toUpperCase()} --body "\${APIM_NAME_${env.toUpperCase()}}" --env ${env}`).join('\n\n');
+    return `# Setup GitHub Actions Identity for APIOps
+
+> **How to use:** Open this file in VS Code with GitHub Copilot and ask
+> Copilot to help you run through the steps. Copilot will prompt you for
+> the required values and generate the exact CLI commands for your environment.
+
+## Goal
+
+Configure Azure AD federated credentials and GitHub repository secrets so the
+APIOps extract and publish workflows can authenticate to Azure using OIDC
+(no stored client secrets needed).
+
+---
+
+## Step 0 — Tool Authentication Check
+
+**Copilot: Before proceeding, verify that all required tools are installed and authenticated.**
+
+Run these checks and present results in a table:
+
+### Check Azure CLI
+\`\`\`bash
+az version
+az account show --query "{Subscription:name, Account:user.name, TenantId:tenantId}" -o json
+\`\`\`
+
+### Check GitHub CLI
+\`\`\`bash
+gh auth status
+\`\`\`
+
+### Present Status Table
+
+Present the results to the user in this format:
+
+\`\`\`
+🔐 Tool Authentication Status:
+
+| Tool | Status | Account/User | Subscription/Org | Tenant/Details |
+|------|--------|--------------|------------------|----------------|
+| Azure CLI | ✅ Logged in | user@example.com | my-subscription | abc-123-... |
+| GitHub CLI | ✅ Logged in | username | github.com | — |
+\`\`\`
+
+**Status indicators:**
+- ✅ Logged in — tool is authenticated and ready
+- ❌ Not logged in — tool needs authentication
+- ⚠️ Not installed — tool is missing entirely
+
+### Fix Missing Authentication
+
+**If Azure CLI is not logged in:**
+> "Azure CLI is required for this setup. Run \`az login\` to authenticate, then I'll continue."
+
+**If GitHub CLI is not logged in:**
+> "GitHub CLI is required for configuring repository secrets. Run \`gh auth login\` to authenticate."
+
+**If any required tool is not installed:**
+- Azure CLI: Install from https://aka.ms/installazurecli
+- GitHub CLI: Install from https://cli.github.com
+
+Once both tools are authenticated, ask the user to confirm:
+> "Does this authentication look correct? (yes / need to switch accounts)"
+
+If the user needs to switch accounts, help them with:
+- Azure CLI: \`az account set --subscription <id>\` or \`az login --tenant <tenant-id>\`
+- GitHub CLI: \`gh auth logout\` then \`gh auth login\`
+
+Once confirmed, proceed to Step 1.
+
+---
+
+## Step 1 — Gather Information
+
+Copilot, please ask the user for the following values before proceeding. Store
+each answer for use in later steps.
+
+| Variable | Description | Example |
+|----------|-------------|---------|
+${config.environments.map((env) => `| \`AZURE_SUBSCRIPTION_ID_${env.toUpperCase()}\` | Azure subscription ID for **${env}** environment | \`xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx\` |`).join('\n')}
+| \`AZURE_TENANT_ID\` | Azure AD tenant ID (same for all environments) | \`xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx\` |
+| \`GITHUB_ORG\` | GitHub organization or user that owns the repo | \`my-org\` |
+| \`GITHUB_REPO\` | GitHub repository name | \`apim-artifacts\` |
+| \`APP_NAME\` | Display name for the Azure AD application | \`apiops-github-sp\` |
+${config.environments.map((env) => `| \`APIM_RG_${env.toUpperCase()}\` | Resource group for **${env}** APIM instance | \`rg-apim-${env}\` |
+| \`APIM_NAME_${env.toUpperCase()}\` | APIM service name for **${env}** | \`apim-${env}\` |`).join('\n')}
+
+---
+
+## Step 2 — Create Azure AD Application & Service Principal
+
+> ⚠️ **Error Handling:** If any command fails, stop immediately and show the user the full error output verbatim. Do NOT retry silently. Common issues include insufficient permissions (requires Application Administrator or Global Administrator role in Azure AD).
+
+**On macOS/Linux (Bash):**
+\`\`\`bash
+# Create the Azure AD application
+APP_ID=$(az ad app create \\
+  --display-name "\${APP_NAME}" \\
+  --query appId -o tsv)
+
+# Create the service principal for the application
+az ad sp create --id "$APP_ID"
+
+echo "Application (client) ID: $APP_ID"
+echo "Tenant ID: $(az account show --query tenantId -o tsv)"
+\`\`\`
+
+**On Windows (PowerShell):**
+\`\`\`powershell
+# Create the Azure AD application
+$APP_ID = az ad app create \`
+  --display-name "\${APP_NAME}" \`
+  --query appId -o tsv
+
+# Create the service principal for the application
+az ad sp create --id $APP_ID
+
+Write-Host "Application (client) ID: $APP_ID"
+Write-Host "Tenant ID: $(az account show --query tenantId -o tsv)"
+\`\`\`
+
+---
+
+## Step 3 — Assign RBAC Roles
+
+Grant the service principal the required permissions:
+1. **Reader** role on each resource group (to read resource groups and resources)
+2. **API Management Service Contributor** on each APIM instance (to manage APIM resources)
+
+> **Note:** Each environment can be in a different Azure subscription. The service principal will be granted access to all environments.
+
+### Grant Reader role on each resource group
+
+${config.environments.map((env) => `\`\`\`bash
+# Reader role for ${env} resource group
+az role assignment create \\
+  --assignee "$APP_ID" \\
+  --role "Reader" \\
+  --scope "/subscriptions/\${AZURE_SUBSCRIPTION_ID_${env.toUpperCase()}}/resourceGroups/\${APIM_RG_${env.toUpperCase()}}"
+\`\`\``).join('\n\n')}
+
+### Grant API Management Service Contributor on each APIM instance
+
+${config.environments.map((env) => `\`\`\`bash
+# Assign role for ${env} environment
+az role assignment create \\
+  --assignee "$APP_ID" \\
+  --role "API Management Service Contributor" \\
+  --scope "/subscriptions/\${AZURE_SUBSCRIPTION_ID_${env.toUpperCase()}}/resourceGroups/\${APIM_RG_${env.toUpperCase()}}/providers/Microsoft.ApiManagement/service/\${APIM_NAME_${env.toUpperCase()}}"
+\`\`\``).join('\n\n')}
+
+---
+
+## Step 4 — Create Federated Credentials for GitHub OIDC
+
+> ⚠️ **Platform Note:** The JSON parameters for federated credentials require different escaping on Windows PowerShell vs macOS/Linux Bash. Use the appropriate command block for your platform.
+
+### Main branch (for push-triggered publish workflow)
+
+**On macOS/Linux (Bash):**
+\`\`\`bash
+az ad app federated-credential create \\
+  --id "$APP_ID" \\
+  --parameters '{
+    "name": "github-main-branch",
+    "issuer": "https://token.actions.githubusercontent.com",
+    "subject": "repo:'"\${GITHUB_ORG}"'/'"\${GITHUB_REPO}"':ref:refs/heads/main",
+    "audiences": ["api://AzureADTokenExchange"]
+  }'
+\`\`\`
+
+**On Windows (PowerShell):**
+\`\`\`powershell
+az ad app federated-credential create \`
+  --id $APP_ID \`
+  --parameters '{\\"name\\":\\"github-main-branch\\",\\"issuer\\":\\"https://token.actions.githubusercontent.com\\",\\"subject\\":\\"repo:'\${GITHUB_ORG}'/'\${GITHUB_REPO}':ref:refs/heads/main\\",\\"audiences\\":[\\"api://AzureADTokenExchange\\"]}'
+\`\`\`
+
+${envFedCreds}
+
+---
+
+## Step 5 — Create GitHub Environments
+
+\`\`\`bash
+${config.environments.map((env) => `# Create the ${env} environment (requires GitHub CLI)
+gh api --method PUT "repos/\${GITHUB_ORG}/\${GITHUB_REPO}/environments/${env}"`).join('\n\n')}
+\`\`\`
+
+---
+
+## Step 6 — Set GitHub Repository Secrets
+
+> ⚠️ **Platform Note:** GitHub CLI secret commands work identically on all platforms, but variable syntax differs between Bash and PowerShell.
+
+**On macOS/Linux (Bash):**
+\`\`\`bash
+# Repository-level secrets (shared across all workflows)
+gh secret set AZURE_CLIENT_ID --body "$APP_ID"
+gh secret set AZURE_TENANT_ID --body "\${AZURE_TENANT_ID}"
+
+${ghSecretEnvCmds}
+\`\`\`
+
+**On Windows (PowerShell):**
+\`\`\`powershell
+# Repository-level secrets (shared across all workflows)
+gh secret set AZURE_CLIENT_ID --body $APP_ID
+gh secret set AZURE_TENANT_ID --body "\${AZURE_TENANT_ID}"
+
+${ghSecretEnvCmds}
+\`\`\`
+
+---
+
+## Step 7 — Verify
+
+> ⚠️ **Important:** If any verification step fails, show the user the full error output and help troubleshoot before proceeding. Common issues include RBAC permissions not yet propagated (can take 5-10 minutes) or missing secrets.
+
+1. Go to **Actions** → **Run APIM Extractor** → **Run workflow**
+2. Fill in the resource group and service name for your dev environment
+3. Confirm the workflow completes and a pull request is created
+
+If the workflow fails with authentication errors:
+- Check that all secrets are set correctly in GitHub: Settings → Secrets and variables → Actions
+- Verify RBAC role assignments have propagated (wait 5-10 minutes and retry)
+- Confirm the federated credentials were created: \`az ad app federated-credential list --id $APP_ID\`
+
+---
+
+## Secrets Reference
+
+The generated workflows expect these secrets:
+
+### Repository Secrets
+- \`AZURE_CLIENT_ID\` — App registration client ID (shared across all environments)
+- \`AZURE_TENANT_ID\` — Azure AD tenant ID (shared across all environments)
+
+### Per-Environment Secrets
+${envSecrets}
+`;
+}
+//# sourceMappingURL=identity-setup-prompt.js.map

package/dist/templates/copilot/identity-setup-prompt.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"identity-setup-prompt.js","sourceRoot":"","sources":["../../../src/templates/copilot/identity-setup-prompt.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAMH,MAAM,UAAU,2BAA2B,CAAC,MAAiC;IAC3E,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CACjD,6DAA6D,GAAG;0BAC1C,GAAG,CAAC,WAAW,EAAE,wCAAwC,GAAG;wBAC9D,GAAG,CAAC,WAAW,EAAE,gCAAgC,GAAG,IAAI,CAC7E,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEb,MAAM,WAAW,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAClD,OAAO,GAAG;;;;;;;0BAOY,GAAG;;0EAE6C,GAAG;;;;;;;;;4CASjC,GAAG,2IAA2I,GAAG;OACtL,CACJ,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEf,MAAM,eAAe,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CACtD,KAAK,GAAG;uEAC2D,GAAG,CAAC,WAAW,EAAE,YAAY,GAAG;oCACnE,GAAG,CAAC,WAAW,EAAE,uBAAuB,GAAG,CAAC,WAAW,EAAE,YAAY,GAAG;kCAC1E,GAAG,CAAC,WAAW,EAAE,yBAAyB,GAAG,CAAC,WAAW,EAAE,YAAY,GAAG,EAAE,CAC3G,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC;IAEf,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA+EP,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAC9B,6BAA6B,GAAG,CAAC,WAAW,EAAE,oCAAoC,GAAG,6DAA6D,CACnJ,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;EAKZ,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAC9B,eAAe,GAAG,CAAC,WAAW,EAAE,6BAA6B,GAAG,gCAAgC,GAAG;gBACvF,GAAG,CAAC,WAAW,EAAE,gCAAgC,GAAG,eAAe,GAAG,MAAM,CACzF,CAAC,IAAI,CAAC,IAAI,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EAgDZ,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAC9B;oBACgB,GAAG;;;;qDAI8B,GAAG,CAAC,WAAW,EAAE,+BAA+B,GAAG,CAAC,WAAW,EAAE;OAC/G,CACJ,CAAC,IAAI,CAAC,MAAM,CAAC;;;;EAId,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAC9B;oBACgB,GAAG;;;;qDAI8B,GAAG,CAAC,WAAW,EAAE,+BAA+B,GAAG,CAAC,WAAW,EAAE,4DAA4D,GAAG,CAAC,WAAW,EAAE;OAC5L,CACJ,CAAC,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6Bd,WAAW;;;;;;;EAOX,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAC9B,gBAAgB,GAAG;yEACkD,GAAG,GAAG,CAC5E,CAAC,IAAI,CAAC,MAAM,CAAC;;;;;;;;;;;;;;;EAed,eAAe;;;;;;;;;EASf,eAAe;;;;;;;;;;;;;;;;;;;;;;;;;;;;;EA6Bf,UAAU;CACX,CAAC;AACF,CAAC"}

package/dist/templates/github-actions/extract-workflow.d.ts

@@ -0,0 +1,9 @@
+/**
+ * T043: GitHub Actions extract workflow template
+ * Generates extract workflow with manual trigger, configuration choice, and auto-PR creation
+ */
+export interface ExtractWorkflowConfig {
+    artifactDir: string;
+}
+export declare function generateExtractWorkflow(config: ExtractWorkflowConfig): string;
+//# sourceMappingURL=extract-workflow.d.ts.map

package/dist/templates/github-actions/extract-workflow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extract-workflow.d.ts","sourceRoot":"","sources":["../../../src/templates/github-actions/extract-workflow.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,qBAAqB,GAAG,MAAM,CAwH7E"}

package/dist/templates/github-actions/extract-workflow.js

@@ -0,0 +1,126 @@
+/**
+ * T043: GitHub Actions extract workflow template
+ * Generates extract workflow with manual trigger, configuration choice, and auto-PR creation
+ */
+export function generateExtractWorkflow(config) {
+    return `name: Run APIM Extractor
+
+on:
+  workflow_dispatch:
+    inputs:
+      ENVIRONMENT:
+        description: 'Choose which environment to extract from'
+        required: true
+        type: choice
+        default: dev
+        options:
+          - dev
+          - prod
+      CONFIGURATION_YAML_PATH:
+        description: 'Choose whether to extract all APIs or use the extraction configuration file'
+        required: true
+        type: choice
+        options:
+          - Extract All APIs
+          - configuration.extract.yaml
+
+permissions:
+  id-token: write
+  contents: write
+  pull-requests: write
+
+jobs:
+  extract:
+    runs-on: ubuntu-latest
+    environment: \${{ github.event.inputs.ENVIRONMENT }}
+    env:
+      APIM_RESOURCE_GROUP: \${{ (github.event.inputs.ENVIRONMENT == 'dev' && secrets.APIM_RESOURCE_GROUP_DEV) || (github.event.inputs.ENVIRONMENT == 'prod' && secrets.APIM_RESOURCE_GROUP_PROD) }}
+      APIM_SERVICE_NAME: \${{ (github.event.inputs.ENVIRONMENT == 'dev' && secrets.APIM_SERVICE_NAME_DEV) || (github.event.inputs.ENVIRONMENT == 'prod' && secrets.APIM_SERVICE_NAME_PROD) }}
+    steps:
+      - name: Validate required secrets
+        run: |
+          if [ -z "\${{ env.APIM_RESOURCE_GROUP }}" ]; then
+            echo "::error::APIM_RESOURCE_GROUP secret is not set for environment '\${{ github.event.inputs.ENVIRONMENT }}'"
+            echo "Please configure APIM_RESOURCE_GROUP_\${{ github.event.inputs.ENVIRONMENT == 'dev' && 'DEV' || 'PROD' }} secret in the \${{ github.event.inputs.ENVIRONMENT }} environment"
+            exit 1
+          fi
+          if [ -z "\${{ env.APIM_SERVICE_NAME }}" ]; then
+            echo "::error::APIM_SERVICE_NAME secret is not set for environment '\${{ github.event.inputs.ENVIRONMENT }}'"
+            echo "Please configure APIM_SERVICE_NAME_\${{ github.event.inputs.ENVIRONMENT == 'dev' && 'DEV' || 'PROD' }} secret in the \${{ github.event.inputs.ENVIRONMENT }} environment"
+            exit 1
+          fi
+          echo "✓ All required secrets are configured"
+          echo "  Environment: \${{ github.event.inputs.ENVIRONMENT }}"
+          echo "  Resource Group: \${{ env.APIM_RESOURCE_GROUP }}"
+          echo "  Service Name: \${{ env.APIM_SERVICE_NAME }}"
+
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: Install dependencies
+        run: npm install
+
+      - name: Azure Login (Federated Credential)
+        uses: azure/login@v2
+        with:
+          client-id: \${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: \${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: \${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
+      - name: Run APIM Extract (All APIs)
+        if: \${{ github.event.inputs.CONFIGURATION_YAML_PATH == 'Extract All APIs' }}
+        run: |
+          npx apiops extract \\
+            --subscription-id \${{ secrets.AZURE_SUBSCRIPTION_ID }} \\
+            --resource-group \${{ env.APIM_RESOURCE_GROUP }} \\
+            --service-name \${{ env.APIM_SERVICE_NAME }} \\
+            --output ${config.artifactDir}
+
+      - name: Run APIM Extract (With Configuration)
+        if: \${{ github.event.inputs.CONFIGURATION_YAML_PATH != 'Extract All APIs' }}
+        run: |
+          npx apiops extract \\
+            --subscription-id \${{ secrets.AZURE_SUBSCRIPTION_ID }} \\
+            --resource-group \${{ env.APIM_RESOURCE_GROUP }} \\
+            --service-name \${{ env.APIM_SERVICE_NAME }} \\
+            --output ${config.artifactDir} \\
+            --filter configuration.extract.yaml
+
+      - name: Upload artifacts
+        uses: actions/upload-artifact@v4
+        with:
+          name: apim-artifacts
+          path: ${config.artifactDir}
+          retention-days: 30
+
+  create-pull-request:
+    needs: extract
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Download artifacts
+        uses: actions/download-artifact@v4
+        with:
+          name: apim-artifacts
+          path: ${config.artifactDir}
+
+      - name: Create pull request
+        uses: peter-evans/create-pull-request@v6
+        with:
+          token: \${{ secrets.GITHUB_TOKEN }}
+          commit-message: "chore: update APIM artifacts from extract"
+          title: "APIM Extract - Update artifacts"
+          body: >
+            This PR is auto-generated by the APIM extract workflow.
+          labels: extract, automated pr
+          branch: apim-extract-\${{ github.run_id }}
+`;
+}
+//# sourceMappingURL=extract-workflow.js.map

package/dist/templates/github-actions/extract-workflow.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"extract-workflow.js","sourceRoot":"","sources":["../../../src/templates/github-actions/extract-workflow.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAMH,MAAM,UAAU,uBAAuB,CAAC,MAA6B;IACnE,OAAO;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;uBA4Ec,MAAM,CAAC,WAAW;;;;;;;;;uBASlB,MAAM,CAAC,WAAW;;;;;;;kBAOvB,MAAM,CAAC,WAAW;;;;;;;;;;;;;;kBAclB,MAAM,CAAC,WAAW;;;;;;;;;;;;CAYnC,CAAC;AACF,CAAC"}

package/dist/templates/github-actions/publish-workflow.d.ts

@@ -0,0 +1,10 @@
+/**
+ * T044: GitHub Actions publish workflow template
+ * Push-to-main trigger with commit ID choice, environment selection, and multi-env stages
+ */
+export interface PublishWorkflowConfig {
+    artifactDir: string;
+    environments: string[];
+}
+export declare function generatePublishWorkflow(config: PublishWorkflowConfig): string;
+//# sourceMappingURL=publish-workflow.d.ts.map

package/dist/templates/github-actions/publish-workflow.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"publish-workflow.d.ts","sourceRoot":"","sources":["../../../src/templates/github-actions/publish-workflow.ts"],"names":[],"mappings":"AAAA;;;GAGG;AAEH,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,qBAAqB,GAAG,MAAM,CAsG7E"}