@peterhauge/apiops-cli 0.2.0-alpha.0 → 0.3.0-alpha.0

package/dist/templates/github-actions/publish-workflow.js

@@ -1,7 +1,7 @@
 // Copyright (c) Microsoft Corporation.
 // Licensed under the MIT license.
 /**
- * T044: GitHub Actions publish workflow template
+ * GitHub Actions publish workflow template
  * Push-to-main trigger with commit ID choice, environment selection, and multi-env stages
  */
 export function generatePublishWorkflow(config) {
@@ -9,113 +9,156 @@ export function generatePublishWorkflow(config) {
     const envJobs = config.environments.map((env, idx) => {
         const envUpper = env.toUpperCase();
         const autoDeployComment = idx === 0
-            ? `    # To enable automatic deployment on push to main, uncomment the condition below:
+            ? `    # To enable automatic deployment on push to main, uncomment the condition below:
     # if: github.event.inputs.ENVIRONMENT == '${env}' || github.event_name == 'push'`
-            : `    # To enable automatic deployment on push to main, uncomment the condition below:
-    # if: github.event.inputs.ENVIRONMENT == '${env}' || github.event_name == 'push'
+            : `    # To enable automatic deployment on push to main, uncomment the condition below:
+    # if: github.event.inputs.ENVIRONMENT == '${env}' || github.event_name == 'push'
     # And change needs to: needs: [get-commit, publish-${config.environments[idx - 1]}]`;
-        return `  publish-${env}:
-${autoDeployComment}
-    if: github.event.inputs.ENVIRONMENT == '${env}'
-    runs-on: ubuntu-latest
-    environment: ${env}
-    needs: get-commit
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 2
-
-      - name: Setup Node.js
-        uses: actions/setup-node@v4
-        with:
-          node-version: '22'
-
-      - name: Install dependencies
-        run: npm install
-
-      - name: Azure Login (Federated Credential)
-        uses: azure/login@v2
-        with:
-          client-id: \${{ secrets.AZURE_CLIENT_ID }}
-          tenant-id: \${{ secrets.AZURE_TENANT_ID }}
-          subscription-id: \${{ secrets.AZURE_SUBSCRIPTION_ID }}
-
-      - name: Substitute tokens in configuration.${env}.yaml
-        uses: cschleiden/replace-tokens@v1.3
-        with:
-          tokenPrefix: '{#['
-          tokenSuffix: ']#}'
-          files: '["configuration.${env}.yaml"]'
-          # Example token mapping for ${env} (uncomment and customize when needed):
-          # env:
-          #   MY_SECRET: \${{ secrets.MY_SECRET_${envUpper} }}
-          #   ANOTHER_TOKEN: \${{ secrets.ANOTHER_TOKEN_${envUpper} }}
-
-      - name: Publish to ${env} (incremental - last commit only)
-        if: \${{ github.event.inputs.COMMIT_ID_CHOICE != 'publish-all-artifacts-in-repo' }}
-        run: |
-          npx apiops publish \\
-            --subscription-id \${{ secrets.AZURE_SUBSCRIPTION_ID }} \\
-            --resource-group \${{ secrets.APIM_RESOURCE_GROUP_${envUpper} }} \\
-            --service-name \${{ secrets.APIM_SERVICE_NAME_${envUpper} }} \\
-            --source ${config.artifactDir} \\
-            --overrides configuration.${env}.yaml \\
-            --commit-id \${{ needs.get-commit.outputs.commit_id }}
-
-      - name: Publish to ${env} (all artifacts)
-        if: \${{ github.event.inputs.COMMIT_ID_CHOICE == 'publish-all-artifacts-in-repo' }}
-        run: |
-          npx apiops publish \\
-            --subscription-id \${{ secrets.AZURE_SUBSCRIPTION_ID }} \\
-            --resource-group \${{ secrets.APIM_RESOURCE_GROUP_${envUpper} }} \\
-            --service-name \${{ secrets.APIM_SERVICE_NAME_${envUpper} }} \\
-            --source ${config.artifactDir} \\
-            --overrides configuration.${env}.yaml
+        return `  publish-${env}:
+${autoDeployComment}
+    if: github.event.inputs.ENVIRONMENT == '${env}'
+    runs-on: ubuntu-latest
+    environment: ${env}
+    needs: get-commit
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 2
+
+      - name: Setup Node.js
+        uses: actions/setup-node@v4
+        with:
+          node-version: '22'
+
+      - name: Install dependencies
+        run: npm install
+
+      - name: Azure Login (Federated Credential)
+        uses: azure/login@v2
+        with:
+          client-id: \${{ secrets.AZURE_CLIENT_ID }}
+          tenant-id: \${{ secrets.AZURE_TENANT_ID }}
+          subscription-id: \${{ secrets.AZURE_SUBSCRIPTION_ID }}
+
+      - name: Validate token source values (${env})
+        env:
+          AVAILABLE_SECRETS_JSON: \${{ toJSON(secrets) }}
+        run: |
+          missing=0
+          tokens=$(grep -o '{#\\[[^]]*\\]#}' configuration.${env}.yaml | sed -E 's/^\\{#\\[([^]]+)\\]#\\}$/\\1/' | sort -u || true)
+
+          if [ -z "$tokens" ]; then
+            echo "No tokens found in configuration.${env}.yaml"
+            exit 0
+          fi
+
+          while IFS= read -r token; do
+            if [ -z "$token" ]; then
+              continue
+            fi
+
+            if ! echo "$token" | grep -Eq '^[A-Za-z_][A-Za-z0-9_]*$'; then
+              echo "::error::Token '$token' is not a valid environment variable name. Use letters, numbers, and underscores only."
+              missing=1
+              continue
+            fi
+
+            value=$(jq -r --arg token "$token" '.[$token] // empty' <<< "$AVAILABLE_SECRETS_JSON")
+            if [ -z "$value" ]; then
+              echo "::error::Missing secret for token '$token'"
+              missing=1
+              continue
+            fi
+
+            printf '%s=%s\\n' "$token" "$value" >> "$GITHUB_ENV"
+          done <<< "$tokens"
+
+          if [ "$missing" -ne 0 ]; then
+            exit 1
+          fi
+
+      - name: Substitute tokens in configuration.${env}.yaml
+        uses: cschleiden/replace-tokens@v1.3
+        with:
+          tokenPrefix: '{#['
+          tokenSuffix: ']#}'
+          files: '["configuration.${env}.yaml"]'
+          # Token values are injected in the previous step based on token names.
+          # Ensure tokens in configuration.${env}.yaml match secret names exactly.
+
+      - name: Validate token substitution (${env})
+        run: |
+          if grep -q '{#\\[' configuration.${env}.yaml; then
+            echo "Unresolved tokens remain in configuration.${env}.yaml"
+            grep -o '{#\\[[^]]*\\]#}' configuration.${env}.yaml | sort -u
+            exit 1
+          fi
+
+      - name: Publish to ${env} (incremental - last commit only)
+        if: \${{ github.event.inputs.COMMIT_ID_CHOICE != 'publish-all-artifacts-in-repo' }}
+        run: |
+          npx apiops publish \\
+            --subscription-id \${{ secrets.AZURE_SUBSCRIPTION_ID }} \\
+            --resource-group \${{ secrets.APIM_RESOURCE_GROUP_${envUpper} }} \\
+            --service-name \${{ secrets.APIM_SERVICE_NAME_${envUpper} }} \\
+            --source ${config.artifactDir} \\
+            --overrides configuration.${env}.yaml \\
+            --commit-id \${{ needs.get-commit.outputs.commit_id }}
+
+      - name: Publish to ${env} (all artifacts)
+        if: \${{ github.event.inputs.COMMIT_ID_CHOICE == 'publish-all-artifacts-in-repo' }}
+        run: |
+          npx apiops publish \\
+            --subscription-id \${{ secrets.AZURE_SUBSCRIPTION_ID }} \\
+            --resource-group \${{ secrets.APIM_RESOURCE_GROUP_${envUpper} }} \\
+            --service-name \${{ secrets.APIM_SERVICE_NAME_${envUpper} }} \\
+            --source ${config.artifactDir} \\
+            --overrides configuration.${env}.yaml
 `;
     }).join('\n');
-    return `name: Run APIM Publisher
-
-on:
-  push:
-    branches:
-      - main
-    paths:
-      - '${config.artifactDir}/**'
-      - 'configuration.*.yaml'
-  workflow_dispatch:
-    inputs:
-      COMMIT_ID_CHOICE:
-        description: 'Choose "publish-all-artifacts-in-repo" only when you want to force republishing all artifacts (e.g. after build failure). Otherwise stick with the default behavior of "publish-artifacts-in-last-commit"'
-        required: true
-        type: choice
-        default: publish-artifacts-in-last-commit
-        options:
-          - publish-artifacts-in-last-commit
-          - publish-all-artifacts-in-repo
-      ENVIRONMENT:
-        description: 'Choose which environment to publish to'
-        required: true
-        type: choice
-        default: ${config.environments[0]}
-        options:
-${envChoices}
-
-permissions:
-  id-token: write
-  contents: read
-
-jobs:
-  get-commit:
-    runs-on: ubuntu-latest
-    outputs:
-      commit_id: \${{ steps.commit.outputs.commit_id }}
-    steps:
-      - name: Set the Commit Id
-        id: commit
-        run: echo "commit_id=\${GITHUB_SHA}" >> $GITHUB_OUTPUT
-
-${envJobs}
+    return `name: Run APIM Publisher
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - '${config.artifactDir}/**'
+      - 'configuration.*.yaml'
+  workflow_dispatch:
+    inputs:
+      COMMIT_ID_CHOICE:
+        description: 'Choose "publish-all-artifacts-in-repo" only when you want to force republishing all artifacts (e.g. after build failure). Otherwise stick with the default behavior of "publish-artifacts-in-last-commit"'
+        required: true
+        type: choice
+        default: publish-artifacts-in-last-commit
+        options:
+          - publish-artifacts-in-last-commit
+          - publish-all-artifacts-in-repo
+      ENVIRONMENT:
+        description: 'Choose which environment to publish to'
+        required: true
+        type: choice
+        default: ${config.environments[0]}
+        options:
+${envChoices}
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  get-commit:
+    runs-on: ubuntu-latest
+    outputs:
+      commit_id: \${{ steps.commit.outputs.commit_id }}
+    steps:
+      - name: Set the Commit Id
+        id: commit
+        run: echo "commit_id=\${GITHUB_SHA}" >> $GITHUB_OUTPUT
+
+${envJobs}
 `;
 }
 //# sourceMappingURL=publish-workflow.js.map

package/dist/templates/github-actions/publish-workflow.js.map

@@ -1 +1 @@
-{"version":3,"file":"publish-workflow.js","sourceRoot":"","sources":["../../../src/templates/github-actions/publish-workflow.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC;AAClC;;;GAGG;AAOH,MAAM,UAAU,uBAAuB,CAAC,MAA6B;IACnE,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAErF,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACnD,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,iBAAiB,GAAG,GAAG,KAAK,CAAC;YACjC,CAAC,CAAC;gDACwC,GAAG,kCAAkC;YAC/E,CAAC,CAAC;gDACwC,GAAG;yDACM,MAAM,CAAC,YAAY,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;QAErF,OAAO,aAAa,GAAG;EACzB,iBAAiB;8CAC2B,GAAG;;mBAE9B,GAAG;;;;;;;;;;;;;;;;;;;;;;;mDAuB6B,GAAG;;;;;oCAKlB,GAAG;wCACC,GAAG;;kDAEO,QAAQ;0DACA,QAAQ;;2BAEvC,GAAG;;;;;gEAKkC,QAAQ;4DACZ,QAAQ;uBAC7C,MAAM,CAAC,WAAW;wCACD,GAAG;;;2BAGhB,GAAG;;;;;gEAKkC,QAAQ;4DACZ,QAAQ;uBAC7C,MAAM,CAAC,WAAW;wCACD,GAAG;CAC1C,CAAC;IACA,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;;;;;;;WAOE,MAAM,CAAC,WAAW;;;;;;;;;;;;;;;;mBAgBV,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;;EAEvC,UAAU;;;;;;;;;;;;;;;;EAgBV,OAAO;CACR,CAAC;AACF,CAAC"}
+{"version":3,"file":"publish-workflow.js","sourceRoot":"","sources":["../../../src/templates/github-actions/publish-workflow.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC;AAClC;;;GAGG;AAOH,MAAM,UAAU,uBAAuB,CAAC,MAA6B;IACnE,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,eAAe,GAAG,EAAE,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAErF,MAAM,OAAO,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,GAAG,EAAE,EAAE;QACnD,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QACnC,MAAM,iBAAiB,GAAG,GAAG,KAAK,CAAC;YACjC,CAAC,CAAC;gDACwC,GAAG,kCAAkC;YAC/E,CAAC,CAAC;gDACwC,GAAG;yDACM,MAAM,CAAC,YAAY,CAAC,GAAG,GAAG,CAAC,CAAC,GAAG,CAAC;QAErF,OAAO,aAAa,GAAG;EACzB,iBAAiB;8CAC2B,GAAG;;mBAE9B,GAAG;;;;;;;;;;;;;;;;;;;;;;;8CAuBwB,GAAG;;;;;6DAKY,GAAG;;;qDAGX,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mDA6BL,GAAG;;;;;oCAKlB,GAAG;;6CAEM,GAAG;;6CAEH,GAAG;;6CAEH,GAAG;8DACc,GAAG;sDACX,GAAG;;;;2BAI9B,GAAG;;;;;gEAKkC,QAAQ;4DACZ,QAAQ;uBAC7C,MAAM,CAAC,WAAW;wCACD,GAAG;;;2BAGhB,GAAG;;;;;gEAKkC,QAAQ;4DACZ,QAAQ;uBAC7C,MAAM,CAAC,WAAW;wCACD,GAAG;CAC1C,CAAC;IACA,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;;;;;;;WAOE,MAAM,CAAC,WAAW;;;;;;;;;;;;;;;;mBAgBV,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC;;EAEvC,UAAU;;;;;;;;;;;;;;;;EAgBV,OAAO;CACR,CAAC;AACF,CAAC"}

package/package.json

@@ -1,69 +1,69 @@
-{
-  "name": "@peterhauge/apiops-cli",
-  "version": "0.2.0-alpha.0",
-  "description": "CLI tool for Azure API Management configuration-as-code",
-  "type": "module",
-  "private": false,
-  "main": "./dist/index.js",
-  "types": "./dist/index.d.ts",
-  "bin": {
-    "apiops": "dist/cli/index.js"
-  },
-  "files": [
-    "dist"
-  ],
-  "readme": "README.md",
-  "scripts": {
-    "prelint": "node scripts/embed-markdown-templates.mjs",
-    "prebuild": "node scripts/embed-markdown-templates.mjs",
-    "pretest": "node scripts/embed-markdown-templates.mjs",
-    "build": "tsc",
-    "test": "vitest run",
-    "test:watch": "vitest",
-    "lint": "eslint src tests",
-    "start": "tsx src/cli/index.ts"
-  },
-  "engines": {
-    "node": ">=22.0.0"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/Azure/apiops-cli.git"
-  },
-  "keywords": [
-    "azure",
-    "api-management",
-    "apim",
-    "cli",
-    "gitops",
-    "configuration-as-code"
-  ],
-  "author": "",
-  "license": "MIT",
-  "bugs": {
-    "url": "https://github.com/Azure/apiops-cli/issues"
-  },
-  "homepage": "https://github.com/Azure/apiops-cli#readme",
-  "dependencies": {
-    "@azure/identity": "^4.13.1",
-    "any-ascii": "^0.3.3",
-    "commander": "^14.0.3",
-    "he": "^1.2.0",
-    "js-yaml": "^4.1.1",
-    "simple-git": "^3.35.2"
-  },
-  "devDependencies": {
-    "@eslint/js": "^10.0.1",
-    "@types/he": "^1.2.3",
-    "@types/js-yaml": "^4.0.9",
-    "@types/node": "^25.5.2",
-    "@typescript-eslint/eslint-plugin": "^8.58.1",
-    "@typescript-eslint/parser": "^8.58.1",
-    "@vitest/coverage-v8": "^4.1.4",
-    "eslint": "^10.2.0",
-    "tsx": "^4.21.0",
-    "typescript": "^6.0.2",
-    "typescript-eslint": "^8.58.1",
-    "vitest": "^4.1.3"
-  }
-}
+{
+  "name": "@peterhauge/apiops-cli",
+  "version": "0.3.0-alpha.0",
+  "description": "CLI tool for Azure API Management configuration-as-code",
+  "type": "module",
+  "private": false,
+  "main": "./dist/index.js",
+  "types": "./dist/index.d.ts",
+  "bin": {
+    "apiops": "dist/cli/index.js"
+  },
+  "files": [
+    "dist"
+  ],
+  "readme": "README.md",
+  "scripts": {
+    "prelint": "node scripts/embed-markdown-templates.mjs",
+    "prebuild": "node scripts/embed-markdown-templates.mjs",
+    "pretest": "node scripts/embed-markdown-templates.mjs",
+    "build": "tsc",
+    "test": "vitest run",
+    "test:watch": "vitest",
+    "lint": "eslint src tests",
+    "start": "tsx src/cli/index.ts"
+  },
+  "engines": {
+    "node": ">=22.0.0"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/Azure/apiops-cli.git"
+  },
+  "keywords": [
+    "azure",
+    "api-management",
+    "apim",
+    "cli",
+    "gitops",
+    "configuration-as-code"
+  ],
+  "author": "",
+  "license": "MIT",
+  "bugs": {
+    "url": "https://github.com/Azure/apiops-cli/issues"
+  },
+  "homepage": "https://github.com/Azure/apiops-cli#readme",
+  "dependencies": {
+    "@azure/identity": "^4.13.1",
+    "any-ascii": "^0.3.3",
+    "commander": "^14.0.3",
+    "he": "^1.2.0",
+    "js-yaml": "^4.1.1",
+    "simple-git": "^3.35.2"
+  },
+  "devDependencies": {
+    "@eslint/js": "^10.0.1",
+    "@types/he": "^1.2.3",
+    "@types/js-yaml": "^4.0.9",
+    "@types/node": "^25.5.2",
+    "@typescript-eslint/eslint-plugin": "^8.58.1",
+    "@typescript-eslint/parser": "^8.58.1",
+    "@vitest/coverage-v8": "^4.1.4",
+    "eslint": "^10.2.0",
+    "tsx": "^4.21.0",
+    "typescript": "^6.0.2",
+    "typescript-eslint": "^8.58.1",
+    "vitest": "^4.1.3"
+  }
+}