@peterhauge/apiops-cli 0.3.0-alpha.0 → 0.4.0-alpha.0

package/dist/services/secret-redaction-guard.d.ts

@@ -0,0 +1,40 @@
+/**
+ * Secret redaction pre-flight guard
+ *
+ * Scans the set of artifacts that are about to be published for leftover
+ * redaction markers ('*** REDACTED ***'). Any finding aborts the entire
+ * publish before a single PUT is issued (for both real and dry-run modes),
+ * so a partially-published service can never result from placeholder secrets.
+ *
+ * Detection mirrors the per-resource publish guards:
+ *   - Policies: build the publish payload, apply overrides, then check the
+ *     merged `properties.value` for the marker (an override may legitimately
+ *     replace the value with clean content).
+ *   - Named values: read the resource, apply overrides; KeyVault-backed values
+ *     have their `value` stripped before publish and are therefore ignored;
+ *     otherwise a `secret === true` value that exactly equals the marker is a
+ *     finding.
+ */
+import type { IArtifactStore } from '../clients/iartifact-store.js';
+import type { PublishConfig } from '../models/config.js';
+import type { ResourceDescriptor } from '../models/types.js';
+/**
+ * A single artifact that still contains a redaction marker after overrides.
+ */
+export interface RedactionMarkerFinding {
+    /** The descriptor for the offending artifact. */
+    descriptor: ResourceDescriptor;
+    /** Human-readable resource label (e.g. `apis/echo/policies/policy`). */
+    label: string;
+    /** Where the marker was found (e.g. `policy.xml`, `properties.value`). */
+    location: string;
+}
+/**
+ * Scan the supplied descriptors for leftover redaction markers in the content
+ * that would actually be published (i.e. after overrides are applied).
+ *
+ * Returns every finding so the caller can report all offenders at once rather
+ * than failing on the first one.
+ */
+export declare function scanForRedactionMarkers(store: IArtifactStore, config: PublishConfig, descriptors: ResourceDescriptor[]): Promise<RedactionMarkerFinding[]>;
+//# sourceMappingURL=secret-redaction-guard.d.ts.map

package/dist/services/secret-redaction-guard.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-redaction-guard.d.ts","sourceRoot":"","sources":["../../src/services/secret-redaction-guard.ts"],"names":[],"mappings":"AAEA;;;;;;;;;;;;;;;;GAgBG;AAEH,OAAO,KAAK,EAAE,cAAc,EAAE,MAAM,+BAA+B,CAAC;AACpE,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,qBAAqB,CAAC;AACzD,OAAO,KAAK,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAO7D;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,iDAAiD;IACjD,UAAU,EAAE,kBAAkB,CAAC;IAC/B,wEAAwE;IACxE,KAAK,EAAE,MAAM,CAAC;IACd,0EAA0E;IAC1E,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;GAMG;AACH,wBAAsB,uBAAuB,CAC3C,KAAK,EAAE,cAAc,EACrB,MAAM,EAAE,aAAa,EACrB,WAAW,EAAE,kBAAkB,EAAE,GAChC,OAAO,CAAC,sBAAsB,EAAE,CAAC,CAcnC"}

package/dist/services/secret-redaction-guard.js

@@ -0,0 +1,92 @@
+// Copyright (c) Microsoft Corporation.
+// Licensed under the MIT license.
+/**
+ * Secret redaction pre-flight guard
+ *
+ * Scans the set of artifacts that are about to be published for leftover
+ * redaction markers ('*** REDACTED ***'). Any finding aborts the entire
+ * publish before a single PUT is issued (for both real and dry-run modes),
+ * so a partially-published service can never result from placeholder secrets.
+ *
+ * Detection mirrors the per-resource publish guards:
+ *   - Policies: build the publish payload, apply overrides, then check the
+ *     merged `properties.value` for the marker (an override may legitimately
+ *     replace the value with clean content).
+ *   - Named values: read the resource, apply overrides; KeyVault-backed values
+ *     have their `value` stripped before publish and are therefore ignored;
+ *     otherwise a `secret === true` value that exactly equals the marker is a
+ *     finding.
+ */
+import { ResourceType } from '../models/resource-types.js';
+import { applyOverrides } from './override-merger.js';
+import { POLICY_TYPES } from './resource-publisher.js';
+import { REDACTION_MARKER } from './secret-redactor.js';
+import { buildResourceLabel } from '../lib/resource-uri.js';
+/**
+ * Scan the supplied descriptors for leftover redaction markers in the content
+ * that would actually be published (i.e. after overrides are applied).
+ *
+ * Returns every finding so the caller can report all offenders at once rather
+ * than failing on the first one.
+ */
+export async function scanForRedactionMarkers(store, config, descriptors) {
+    const findings = [];
+    for (const descriptor of descriptors) {
+        if (POLICY_TYPES.has(descriptor.type)) {
+            const finding = await scanPolicy(store, config, descriptor);
+            if (finding)
+                findings.push(finding);
+        }
+        else if (descriptor.type === ResourceType.NamedValue) {
+            const finding = await scanNamedValue(store, config, descriptor);
+            if (finding)
+                findings.push(finding);
+        }
+    }
+    return findings;
+}
+async function scanPolicy(store, config, descriptor) {
+    const policyContent = await store.readContent(config.sourceDir, descriptor, 'policy');
+    if (!policyContent) {
+        return undefined;
+    }
+    const payload = {
+        properties: {
+            value: policyContent.content,
+            format: 'rawxml',
+        },
+    };
+    const merged = applyOverrides(descriptor, payload, config.overrides);
+    const mergedProps = merged.properties;
+    const mergedValue = mergedProps?.value;
+    if (typeof mergedValue === 'string' && mergedValue.includes(REDACTION_MARKER)) {
+        return {
+            descriptor,
+            label: buildResourceLabel(descriptor),
+            location: 'policy.xml',
+        };
+    }
+    return undefined;
+}
+async function scanNamedValue(store, config, descriptor) {
+    const json = await store.readResource(config.sourceDir, descriptor);
+    if (!json) {
+        return undefined;
+    }
+    const merged = applyOverrides(descriptor, json, config.overrides);
+    const props = merged.properties;
+    // KeyVault-backed named values have `properties.value` stripped before publish,
+    // so any marker still present in the file is never sent to APIM.
+    if (props?.keyVault != null) {
+        return undefined;
+    }
+    if (props?.secret === true && props.value === REDACTION_MARKER) {
+        return {
+            descriptor,
+            label: buildResourceLabel(descriptor),
+            location: 'properties.value',
+        };
+    }
+    return undefined;
+}
+//# sourceMappingURL=secret-redaction-guard.js.map

package/dist/services/secret-redaction-guard.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-redaction-guard.js","sourceRoot":"","sources":["../../src/services/secret-redaction-guard.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC;AAClC;;;;;;;;;;;;;;;;GAgBG;AAKH,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAC3D,OAAO,EAAE,cAAc,EAAE,MAAM,sBAAsB,CAAC;AACtD,OAAO,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACvD,OAAO,EAAE,gBAAgB,EAAE,MAAM,sBAAsB,CAAC;AACxD,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAc5D;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,uBAAuB,CAC3C,KAAqB,EACrB,MAAqB,EACrB,WAAiC;IAEjC,MAAM,QAAQ,GAA6B,EAAE,CAAC;IAE9C,KAAK,MAAM,UAAU,IAAI,WAAW,EAAE,CAAC;QACrC,IAAI,YAAY,CAAC,GAAG,CAAC,UAAU,CAAC,IAAI,CAAC,EAAE,CAAC;YACtC,MAAM,OAAO,GAAG,MAAM,UAAU,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;YAC5D,IAAI,OAAO;gBAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;aAAM,IAAI,UAAU,CAAC,IAAI,KAAK,YAAY,CAAC,UAAU,EAAE,CAAC;YACvD,MAAM,OAAO,GAAG,MAAM,cAAc,CAAC,KAAK,EAAE,MAAM,EAAE,UAAU,CAAC,CAAC;YAChE,IAAI,OAAO;gBAAE,QAAQ,CAAC,IAAI,CAAC,OAAO,CAAC,CAAC;QACtC,CAAC;IACH,CAAC;IAED,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,KAAK,UAAU,UAAU,CACvB,KAAqB,EACrB,MAAqB,EACrB,UAA8B;IAE9B,MAAM,aAAa,GAAG,MAAM,KAAK,CAAC,WAAW,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,EAAE,QAAQ,CAAC,CAAC;IACtF,IAAI,CAAC,aAAa,EAAE,CAAC;QACnB,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,OAAO,GAA4B;QACvC,UAAU,EAAE;YACV,KAAK,EAAE,aAAa,CAAC,OAAO;YAC5B,MAAM,EAAE,QAAQ;SACjB;KACF,CAAC;IAEF,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,EAAE,OAAO,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IACrE,MAAM,WAAW,GAAG,MAAM,CAAC,UAAiD,CAAC;IAC7E,MAAM,WAAW,GAAG,WAAW,EAAE,KAAK,CAAC;IAEvC,IAAI,OAAO,WAAW,KAAK,QAAQ,IAAI,WAAW,CAAC,QAAQ,CAAC,gBAAgB,CAAC,EAAE,CAAC;QAC9E,OAAO;YACL,UAAU;YACV,KAAK,EAAE,kBAAkB,CAAC,UAAU,CAAC;YACrC,QAAQ,EAAE,YAAY;SACvB,CAAC;IACJ,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC;AAED,KAAK,UAAU,cAAc,CAC3B,KAAqB,EACrB,MAAqB,EACrB,UAA8B;IAE9B,MAAM,IAAI,GAAG,MAAM,KAAK,CAAC,YAAY,CAAC,MAAM,CAAC,SAAS,EAAE,UAAU,CAAC,CAAC;IACpE,IAAI,CAAC,IAAI,EAAE,CAAC;QACV,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,MAAM,MAAM,GAAG,cAAc,CAAC,UAAU,EAAE,IAAI,EAAE,MAAM,CAAC,SAAS,CAAC,CAAC;IAClE,MAAM,KAAK,GAAG,MAAM,CAAC,UAAiD,CAAC;IAEvE,gFAAgF;IAChF,iEAAiE;IACjE,IAAI,KAAK,EAAE,QAAQ,IAAI,IAAI,EAAE,CAAC;QAC5B,OAAO,SAAS,CAAC;IACnB,CAAC;IAED,IAAI,KAAK,EAAE,MAAM,KAAK,IAAI,IAAI,KAAK,CAAC,KAAK,KAAK,gBAAgB,EAAE,CAAC;QAC/D,OAAO;YACL,UAAU;YACV,KAAK,EAAE,kBAAkB,CAAC,UAAU,CAAC;YACrC,QAAQ,EAAE,kBAAkB;SAC7B,CAAC;IACJ,CAAC;IAED,OAAO,SAAS,CAAC;AACnB,CAAC"}

package/dist/services/secret-redactor.d.ts

@@ -6,6 +6,9 @@
 import { ResourceDescriptor } from '../models/types.js';
 /** Marker used to replace secret values in extracted artifacts */
 export declare const REDACTION_MARKER = "*** REDACTED ***";
+export interface PolicySecretFinding {
+    location: string;
+}
 /**
  * Redact secret values from a resource's JSON payload.
  *
@@ -17,4 +20,19 @@ export declare const REDACTION_MARKER = "*** REDACTED ***";
  * @returns JSON with secrets redacted
  */
 export declare function redactSecrets(descriptor: ResourceDescriptor, json: Record<string, unknown>): Record<string, unknown>;
+/**
+ * Redact inline literal secrets in policy XML content.
+ */
+export declare function redactPolicySecrets(policyContent: string): {
+    redactedContent: string;
+    findings: PolicySecretFinding[];
+};
+/**
+ * Redact inline literal secrets in policy XML content and emit a warning log
+ * for every finding. This is the entry point services should use so that
+ * redaction and warning always happen together; the underlying
+ * {@link redactPolicySecrets} (pure, exported) and `warnPolicySecretRedactions`
+ * (private) helpers stay separate for testability.
+ */
+export declare function redactAndWarnPolicySecrets(descriptor: ResourceDescriptor, policyContent: string): string;
 //# sourceMappingURL=secret-redactor.d.ts.map

package/dist/services/secret-redactor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-redactor.d.ts","sourceRoot":"","sources":["../../src/services/secret-redactor.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AAGH,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAIxD,kEAAkE;AAClE,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAEnD;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,UAAU,EAAE,kBAAkB,EAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA4BzB"}
+{"version":3,"file":"secret-redactor.d.ts","sourceRoot":"","sources":["../../src/services/secret-redactor.ts"],"names":[],"mappings":"AAEA;;;;GAIG;AAGH,OAAO,EAAE,kBAAkB,EAAE,MAAM,oBAAoB,CAAC;AAKxD,kEAAkE;AAClE,eAAO,MAAM,gBAAgB,qBAAqB,CAAC;AAoBnD,MAAM,WAAW,mBAAmB;IAClC,QAAQ,EAAE,MAAM,CAAC;CAClB;AAED;;;;;;;;;GASG;AACH,wBAAgB,aAAa,CAC3B,UAAU,EAAE,kBAAkB,EAC9B,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAC5B,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CA4BzB;AAqCD;;GAEG;AACH,wBAAgB,mBAAmB,CACjC,aAAa,EAAE,MAAM,GACpB;IAAE,eAAe,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,mBAAmB,EAAE,CAAA;CAAE,CAgI9D;AAED;;;;;;GAMG;AACH,wBAAgB,0BAA0B,CACxC,UAAU,EAAE,kBAAkB,EAC9B,aAAa,EAAE,MAAM,GACpB,MAAM,CAIR"}

package/dist/services/secret-redactor.js

@@ -8,8 +8,27 @@
 import { ResourceType } from '../models/resource-types.js';
 import { logger } from '../lib/logger.js';
 import { getNamePart } from '../lib/resource-path.js';
+import { buildResourceLabel } from '../lib/resource-uri.js';
 /** Marker used to replace secret values in extracted artifacts */
 export const REDACTION_MARKER = '*** REDACTED ***';
+const NAMED_VALUE_REFERENCE_PATTERN = /^\s*\{\{[^{}]+\}\}\s*$/;
+// Headers where inline literal values are typically secrets and should be
+// redacted when present in policy XML. Extend this allow-list when APIM adds
+// new secret-bearing header conventions.
+const SECRET_HEADER_NAMES = new Set([
+    'authorization',
+    'ocp-apim-subscription-key',
+    'x-functions-key',
+    'api-key',
+]);
+// Query parameters commonly used to carry secrets/tokens in APIM policies.
+// Keep focused on secret-bearing names to avoid over-redacting non-secrets.
+const SECRET_QUERY_PARAMETER_NAMES = new Set([
+    'code',
+    'sig',
+    'subscription-key',
+]);
+const BEARER_TOKEN_PATTERN = /^(\s*Bearer)(\s+)(.*?)(\s*)$/i;
 /**
  * Redact secret values from a resource's JSON payload.
  *
@@ -44,4 +63,157 @@ export function redactSecrets(descriptor, json) {
     logger.debug(`Redacted secret value for named value "${getNamePart(descriptor.nameParts, 0)}"`);
     return redacted;
 }
+function isApimNamedValueReference(value) {
+    return NAMED_VALUE_REFERENCE_PATTERN.test(value);
+}
+function shouldRedactLiteral(value) {
+    const trimmed = value.trim();
+    if (!trimmed || trimmed === REDACTION_MARKER) {
+        return false;
+    }
+    return !isApimNamedValueReference(trimmed);
+}
+function redactAuthorizationHeaderValue(value) {
+    const bearerMatch = BEARER_TOKEN_PATTERN.exec(value);
+    if (bearerMatch) {
+        const [, scheme, spacing, tokenValue, suffix] = bearerMatch;
+        if (!shouldRedactLiteral(tokenValue)) {
+            return { redactedValue: value, wasRedacted: false };
+        }
+        return {
+            redactedValue: `${scheme}${spacing}${REDACTION_MARKER}${suffix}`,
+            wasRedacted: true,
+        };
+    }
+    if (!shouldRedactLiteral(value)) {
+        return { redactedValue: value, wasRedacted: false };
+    }
+    return { redactedValue: REDACTION_MARKER, wasRedacted: true };
+}
+/**
+ * Redact inline literal secrets in policy XML content.
+ */
+export function redactPolicySecrets(policyContent) {
+    const findings = [];
+    const addFinding = (location) => {
+        findings.push({ location });
+    };
+    let redacted = policyContent;
+    redacted = redacted.replace(/<set-header\b[\s\S]*?<\/set-header>/gi, (setHeaderBlock) => {
+        const nameMatch = /\bname\s*=\s*["']([^"']+)["']/i.exec(setHeaderBlock);
+        const headerName = nameMatch?.[1]?.toLowerCase();
+        if (!headerName || !SECRET_HEADER_NAMES.has(headerName)) {
+            return setHeaderBlock;
+        }
+        return setHeaderBlock.replace(/(<value\b[^>]*>)([\s\S]*?)(<\/value>)/gi, (_full, openTag, value, closeTag) => {
+            const shouldRedactHeaderValue = shouldRedactLiteral(value);
+            const { redactedValue, wasRedacted } = headerName === 'authorization'
+                ? redactAuthorizationHeaderValue(value)
+                : {
+                    redactedValue: shouldRedactHeaderValue ? REDACTION_MARKER : value,
+                    wasRedacted: shouldRedactHeaderValue,
+                };
+            if (!wasRedacted) {
+                return `${openTag}${value}${closeTag}`;
+            }
+            addFinding(`set-header[${headerName}]`);
+            return `${openTag}${redactedValue}${closeTag}`;
+        });
+    });
+    redacted = redacted.replace(/<set-query-parameter\b[\s\S]*?<\/set-query-parameter>/gi, (setQueryBlock) => {
+        const nameMatch = /\bname\s*=\s*["']([^"']+)["']/i.exec(setQueryBlock);
+        const parameterName = nameMatch?.[1]?.toLowerCase();
+        if (!parameterName || !SECRET_QUERY_PARAMETER_NAMES.has(parameterName)) {
+            return setQueryBlock;
+        }
+        return setQueryBlock.replace(/(<value\b[^>]*>)([\s\S]*?)(<\/value>)/gi, (_full, openTag, value, closeTag) => {
+            if (!shouldRedactLiteral(value)) {
+                return `${openTag}${value}${closeTag}`;
+            }
+            addFinding(`set-query-parameter[${parameterName}]`);
+            return `${openTag}${REDACTION_MARKER}${closeTag}`;
+        });
+    });
+    redacted = redacted.replace(/<authentication-basic\b[^>]*>/gi, (tag) => {
+        return tag.replace(/(\bpassword\s*=\s*["'])([^"']*)(["'])/i, (_full, prefix, value, suffix) => {
+            if (!shouldRedactLiteral(value)) {
+                return `${prefix}${value}${suffix}`;
+            }
+            addFinding('authentication-basic@password');
+            return `${prefix}${REDACTION_MARKER}${suffix}`;
+        });
+    });
+    redacted = redacted.replace(/<authentication-certificate\b[^>]*>/gi, (tag) => {
+        return tag.replace(/(\bbody\s*=\s*["'])([^"']*)(["'])/i, (_full, prefix, value, suffix) => {
+            if (!shouldRedactLiteral(value)) {
+                return `${prefix}${value}${suffix}`;
+            }
+            addFinding('authentication-certificate@body');
+            return `${prefix}${REDACTION_MARKER}${suffix}`;
+        });
+    });
+    redacted = redacted.replace(/<authentication-certificate\b[\s\S]*?<\/authentication-certificate>/gi, (certificateBlock) => {
+        return certificateBlock.replace(/(<certificate\b[^>]*>)([\s\S]*?)(<\/certificate>)/gi, (_full, openTag, value, closeTag) => {
+            if (!shouldRedactLiteral(value)) {
+                return `${openTag}${value}${closeTag}`;
+            }
+            addFinding('authentication-certificate/certificate');
+            return `${openTag}${REDACTION_MARKER}${closeTag}`;
+        });
+    });
+    for (const keySection of ['issuer-signing-keys', 'decryption-keys']) {
+        const sectionRegex = new RegExp(`<${keySection}\\b[\\s\\S]*?<\\/${keySection}>`, 'gi');
+        redacted = redacted.replace(sectionRegex, (sectionBlock) => {
+            return sectionBlock.replace(/(<key\b[^>]*>)([\s\S]*?)(<\/key>)/gi, (_full, openTag, value, closeTag) => {
+                if (!shouldRedactLiteral(value)) {
+                    return `${openTag}${value}${closeTag}`;
+                }
+                addFinding(`validate-jwt ${keySection}/key`);
+                return `${openTag}${REDACTION_MARKER}${closeTag}`;
+            });
+        });
+    }
+    // AccountKey/SharedAccessKey fragments are used by storage/service-bus style
+    // connection strings. App Insights connection strings use InstrumentationKey
+    // and therefore do not match this pattern (allow-listed by design).
+    // Value exclusions:
+    // - ';' stops at the next connection-string key/value delimiter
+    // - whitespace/newlines avoid over-capturing adjacent text
+    // - '<' and '"' avoid crossing into XML tags/attributes
+    redacted = redacted.replace(/(AccountKey|SharedAccessKey)\s*=\s*([^;\r\n<"\s]+)/gi, (_full, key, value) => {
+        if (!shouldRedactLiteral(value)) {
+            return `${key}=${value}`;
+        }
+        addFinding(`connection-string[${key}]`);
+        return `${key}=${REDACTION_MARKER}`;
+    });
+    return {
+        redactedContent: redacted,
+        findings,
+    };
+}
+/**
+ * Redact inline literal secrets in policy XML content and emit a warning log
+ * for every finding. This is the entry point services should use so that
+ * redaction and warning always happen together; the underlying
+ * {@link redactPolicySecrets} (pure, exported) and `warnPolicySecretRedactions`
+ * (private) helpers stay separate for testability.
+ */
+export function redactAndWarnPolicySecrets(descriptor, policyContent) {
+    const { redactedContent, findings } = redactPolicySecrets(policyContent);
+    warnPolicySecretRedactions(descriptor, findings);
+    return redactedContent;
+}
+/**
+ * Emit warning logs for policy secret redaction findings.
+ */
+function warnPolicySecretRedactions(descriptor, findings) {
+    const label = buildResourceLabel(descriptor);
+    for (const finding of findings) {
+        logger.warn(`Found and redacted inline secret in ${label} (${finding.location}). ` +
+            `Publish will fail while '${REDACTION_MARKER}' remains. ` +
+            'Update the policy to use a named value: ' +
+            'https://learn.microsoft.com/en-us/azure/api-management/api-management-howto-properties');
+    }
+}
 //# sourceMappingURL=secret-redactor.js.map

package/dist/services/secret-redactor.js.map

@@ -1 +1 @@
-{"version":3,"file":"secret-redactor.js","sourceRoot":"","sources":["../../src/services/secret-redactor.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC;AAClC;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAE3D,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AAEtD,kEAAkE;AAClE,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AAEnD;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,UAA8B,EAC9B,IAA6B;IAE7B,IAAI,UAAU,CAAC,IAAI,KAAK,YAAY,CAAC,UAAU,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAAiD,CAAC;IAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6CAA6C;IAC7C,IAAI,UAAU,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,uEAAuE;IACvE,IAAI,UAAU,CAAC,QAAQ,KAAK,SAAS,IAAI,UAAU,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtE,MAAM,CAAC,KAAK,CAAC,gBAAgB,WAAW,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,4CAA4C,CAAC,CAAC;QAC/G,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4CAA4C;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAA4B,CAAC;IAC7E,MAAM,aAAa,GAAG,QAAQ,CAAC,UAAqC,CAAC;IACrE,aAAa,CAAC,KAAK,GAAG,gBAAgB,CAAC;IAEvC,MAAM,CAAC,KAAK,CAAC,0CAA0C,WAAW,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IAChG,OAAO,QAAQ,CAAC;AAClB,CAAC"}
+{"version":3,"file":"secret-redactor.js","sourceRoot":"","sources":["../../src/services/secret-redactor.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC;AAClC;;;;GAIG;AAEH,OAAO,EAAE,YAAY,EAAE,MAAM,6BAA6B,CAAC;AAE3D,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,WAAW,EAAE,MAAM,yBAAyB,CAAC;AACtD,OAAO,EAAE,kBAAkB,EAAE,MAAM,wBAAwB,CAAC;AAE5D,kEAAkE;AAClE,MAAM,CAAC,MAAM,gBAAgB,GAAG,kBAAkB,CAAC;AACnD,MAAM,6BAA6B,GAAG,wBAAwB,CAAC;AAC/D,0EAA0E;AAC1E,6EAA6E;AAC7E,yCAAyC;AACzC,MAAM,mBAAmB,GAAG,IAAI,GAAG,CAAC;IAClC,eAAe;IACf,2BAA2B;IAC3B,iBAAiB;IACjB,SAAS;CACV,CAAC,CAAC;AACH,2EAA2E;AAC3E,4EAA4E;AAC5E,MAAM,4BAA4B,GAAG,IAAI,GAAG,CAAC;IAC3C,MAAM;IACN,KAAK;IACL,kBAAkB;CACnB,CAAC,CAAC;AACH,MAAM,oBAAoB,GAAG,+BAA+B,CAAC;AAM7D;;;;;;;;;GASG;AACH,MAAM,UAAU,aAAa,CAC3B,UAA8B,EAC9B,IAA6B;IAE7B,IAAI,UAAU,CAAC,IAAI,KAAK,YAAY,CAAC,UAAU,EAAE,CAAC;QAChD,OAAO,IAAI,CAAC;IACd,CAAC;IAED,MAAM,UAAU,GAAG,IAAI,CAAC,UAAiD,CAAC;IAC1E,IAAI,CAAC,UAAU,EAAE,CAAC;QAChB,OAAO,IAAI,CAAC;IACd,CAAC;IAED,6CAA6C;IAC7C,IAAI,UAAU,CAAC,MAAM,KAAK,IAAI,EAAE,CAAC;QAC/B,OAAO,IAAI,CAAC;IACd,CAAC;IAED,uEAAuE;IACvE,IAAI,UAAU,CAAC,QAAQ,KAAK,SAAS,IAAI,UAAU,CAAC,QAAQ,KAAK,IAAI,EAAE,CAAC;QACtE,MAAM,CAAC,KAAK,CAAC,gBAAgB,WAAW,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,4CAA4C,CAAC,CAAC;QAC/G,OAAO,IAAI,CAAC;IACd,CAAC;IAED,4CAA4C;IAC5C,MAAM,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAA4B,CAAC;IAC7E,MAAM,aAAa,GAAG,QAAQ,CAAC,UAAqC,CAAC;IACrE,aAAa,CAAC,KAAK,GAAG,gBAAgB,CAAC;IAEvC,MAAM,CAAC,KAAK,CAAC,0CAA0C,WAAW,CAAC,UAAU,CAAC,SAAS,EAAE,CAAC,CAAC,GAAG,CAAC,CAAC;IAChG,OAAO,QAAQ,CAAC;AAClB,CAAC;AAED,SAAS,yBAAyB,CAAC,KAAa;IAC9C,OAAO,6BAA6B,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACnD,CAAC;AAED,SAAS,mBAAmB,CAAC,KAAa;IACxC,MAAM,OAAO,GAAG,KAAK,CAAC,IAAI,EAAE,CAAC;IAC7B,IAAI,CAAC,OAAO,IAAI,OAAO,KAAK,gBAAgB,EAAE,CAAC;QAC7C,OAAO,KAAK,CAAC;IACf,CAAC;IACD,OAAO,CAAC,yBAAyB,CAAC,OAAO,CAAC,CAAC;AAC7C,CAAC;AAED,SAAS,8BAA8B,CACrC,KAAa;IAEb,MAAM,WAAW,GAAG,oBAAoB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;IACrD,IAAI,WAAW,EAAE,CAAC;QAChB,MAAM,CAAC,EAAE,MAAM,EAAE,OAAO,EAAE,UAAU,EAAE,MAAM,CAAC,GAAG,WAAW,CAAC;QAC5D,IAAI,CAAC,mBAAmB,CAAC,UAAU,CAAC,EAAE,CAAC;YACrC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;QACtD,CAAC;QAED,OAAO;YACL,aAAa,EAAE,GAAG,MAAM,GAAG,OAAO,GAAG,gBAAgB,GAAG,MAAM,EAAE;YAChE,WAAW,EAAE,IAAI;SAClB,CAAC;IACJ,CAAC;IAED,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;QAChC,OAAO,EAAE,aAAa,EAAE,KAAK,EAAE,WAAW,EAAE,KAAK,EAAE,CAAC;IACtD,CAAC;IAED,OAAO,EAAE,aAAa,EAAE,gBAAgB,EAAE,WAAW,EAAE,IAAI,EAAE,CAAC;AAChE,CAAC;AAED;;GAEG;AACH,MAAM,UAAU,mBAAmB,CACjC,aAAqB;IAErB,MAAM,QAAQ,GAA0B,EAAE,CAAC;IAC3C,MAAM,UAAU,GAAG,CAAC,QAAgB,EAAQ,EAAE;QAC5C,QAAQ,CAAC,IAAI,CAAC,EAAE,QAAQ,EAAE,CAAC,CAAC;IAC9B,CAAC,CAAC;IAEF,IAAI,QAAQ,GAAG,aAAa,CAAC;IAE7B,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,uCAAuC,EAAE,CAAC,cAAc,EAAE,EAAE;QACtF,MAAM,SAAS,GAAG,gCAAgC,CAAC,IAAI,CAAC,cAAc,CAAC,CAAC;QACxE,MAAM,UAAU,GAAG,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACjD,IAAI,CAAC,UAAU,IAAI,CAAC,mBAAmB,CAAC,GAAG,CAAC,UAAU,CAAC,EAAE,CAAC;YACxD,OAAO,cAAc,CAAC;QACxB,CAAC;QAED,OAAO,cAAc,CAAC,OAAO,CAC3B,yCAAyC,EACzC,CAAC,KAAK,EAAE,OAAe,EAAE,KAAa,EAAE,QAAgB,EAAE,EAAE;YAC1D,MAAM,uBAAuB,GAAG,mBAAmB,CAAC,KAAK,CAAC,CAAC;YAC3D,MAAM,EAAE,aAAa,EAAE,WAAW,EAAE,GAAG,UAAU,KAAK,eAAe;gBACnE,CAAC,CAAC,8BAA8B,CAAC,KAAK,CAAC;gBACvC,CAAC,CAAC;oBACE,aAAa,EAAE,uBAAuB,CAAC,CAAC,CAAC,gBAAgB,CAAC,CAAC,CAAC,KAAK;oBACjE,WAAW,EAAE,uBAAuB;iBACrC,CAAC;YACN,IAAI,CAAC,WAAW,EAAE,CAAC;gBACjB,OAAO,GAAG,OAAO,GAAG,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzC,CAAC;YAED,UAAU,CAAC,cAAc,UAAU,GAAG,CAAC,CAAC;YACxC,OAAO,GAAG,OAAO,GAAG,aAAa,GAAG,QAAQ,EAAE,CAAC;QACjD,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,yDAAyD,EAAE,CAAC,aAAa,EAAE,EAAE;QACvG,MAAM,SAAS,GAAG,gCAAgC,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC;QACvE,MAAM,aAAa,GAAG,SAAS,EAAE,CAAC,CAAC,CAAC,EAAE,WAAW,EAAE,CAAC;QACpD,IAAI,CAAC,aAAa,IAAI,CAAC,4BAA4B,CAAC,GAAG,CAAC,aAAa,CAAC,EAAE,CAAC;YACvE,OAAO,aAAa,CAAC;QACvB,CAAC;QAED,OAAO,aAAa,CAAC,OAAO,CAC1B,yCAAyC,EACzC,CAAC,KAAK,EAAE,OAAe,EAAE,KAAa,EAAE,QAAgB,EAAE,EAAE;YAC1D,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,OAAO,GAAG,OAAO,GAAG,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzC,CAAC;YAED,UAAU,CAAC,uBAAuB,aAAa,GAAG,CAAC,CAAC;YACpD,OAAO,GAAG,OAAO,GAAG,gBAAgB,GAAG,QAAQ,EAAE,CAAC;QACpD,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,iCAAiC,EAAE,CAAC,GAAG,EAAE,EAAE;QACrE,OAAO,GAAG,CAAC,OAAO,CAAC,wCAAwC,EAAE,CAAC,KAAK,EAAE,MAAc,EAAE,KAAa,EAAE,MAAc,EAAE,EAAE;YACpH,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,EAAE,CAAC;YACtC,CAAC;YAED,UAAU,CAAC,+BAA+B,CAAC,CAAC;YAC5C,OAAO,GAAG,MAAM,GAAG,gBAAgB,GAAG,MAAM,EAAE,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,uCAAuC,EAAE,CAAC,GAAG,EAAE,EAAE;QAC3E,OAAO,GAAG,CAAC,OAAO,CAAC,oCAAoC,EAAE,CAAC,KAAK,EAAE,MAAc,EAAE,KAAa,EAAE,MAAc,EAAE,EAAE;YAChH,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,OAAO,GAAG,MAAM,GAAG,KAAK,GAAG,MAAM,EAAE,CAAC;YACtC,CAAC;YAED,UAAU,CAAC,iCAAiC,CAAC,CAAC;YAC9C,OAAO,GAAG,MAAM,GAAG,gBAAgB,GAAG,MAAM,EAAE,CAAC;QACjD,CAAC,CAAC,CAAC;IACL,CAAC,CAAC,CAAC;IAEH,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,uEAAuE,EAAE,CAAC,gBAAgB,EAAE,EAAE;QACxH,OAAO,gBAAgB,CAAC,OAAO,CAC7B,qDAAqD,EACrD,CAAC,KAAK,EAAE,OAAe,EAAE,KAAa,EAAE,QAAgB,EAAE,EAAE;YAC1D,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;gBAChC,OAAO,GAAG,OAAO,GAAG,KAAK,GAAG,QAAQ,EAAE,CAAC;YACzC,CAAC;YAED,UAAU,CAAC,wCAAwC,CAAC,CAAC;YACrD,OAAO,GAAG,OAAO,GAAG,gBAAgB,GAAG,QAAQ,EAAE,CAAC;QACpD,CAAC,CACF,CAAC;IACJ,CAAC,CAAC,CAAC;IAEH,KAAK,MAAM,UAAU,IAAI,CAAC,qBAAqB,EAAE,iBAAiB,CAAC,EAAE,CAAC;QACpE,MAAM,YAAY,GAAG,IAAI,MAAM,CAAC,IAAI,UAAU,oBAAoB,UAAU,GAAG,EAAE,IAAI,CAAC,CAAC;QACvF,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,YAAY,EAAE,CAAC,YAAY,EAAE,EAAE;YACzD,OAAO,YAAY,CAAC,OAAO,CACzB,qCAAqC,EACrC,CAAC,KAAK,EAAE,OAAe,EAAE,KAAa,EAAE,QAAgB,EAAE,EAAE;gBAC1D,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;oBAChC,OAAO,GAAG,OAAO,GAAG,KAAK,GAAG,QAAQ,EAAE,CAAC;gBACzC,CAAC;gBAED,UAAU,CAAC,gBAAgB,UAAU,MAAM,CAAC,CAAC;gBAC7C,OAAO,GAAG,OAAO,GAAG,gBAAgB,GAAG,QAAQ,EAAE,CAAC;YACpD,CAAC,CACF,CAAC;QACJ,CAAC,CAAC,CAAC;IACL,CAAC;IAED,6EAA6E;IAC7E,6EAA6E;IAC7E,oEAAoE;IACpE,oBAAoB;IACpB,gEAAgE;IAChE,2DAA2D;IAC3D,wDAAwD;IACxD,QAAQ,GAAG,QAAQ,CAAC,OAAO,CAAC,sDAAsD,EAAE,CAAC,KAAK,EAAE,GAAW,EAAE,KAAa,EAAE,EAAE;QACxH,IAAI,CAAC,mBAAmB,CAAC,KAAK,CAAC,EAAE,CAAC;YAChC,OAAO,GAAG,GAAG,IAAI,KAAK,EAAE,CAAC;QAC3B,CAAC;QAED,UAAU,CAAC,qBAAqB,GAAG,GAAG,CAAC,CAAC;QACxC,OAAO,GAAG,GAAG,IAAI,gBAAgB,EAAE,CAAC;IACtC,CAAC,CAAC,CAAC;IAEH,OAAO;QACL,eAAe,EAAE,QAAQ;QACzB,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,0BAA0B,CACxC,UAA8B,EAC9B,aAAqB;IAErB,MAAM,EAAE,eAAe,EAAE,QAAQ,EAAE,GAAG,mBAAmB,CAAC,aAAa,CAAC,CAAC;IACzE,0BAA0B,CAAC,UAAU,EAAE,QAAQ,CAAC,CAAC;IACjD,OAAO,eAAe,CAAC;AACzB,CAAC;AAED;;GAEG;AACH,SAAS,0BAA0B,CACjC,UAA8B,EAC9B,QAA+B;IAE/B,MAAM,KAAK,GAAG,kBAAkB,CAAC,UAAU,CAAC,CAAC;IAC7C,KAAK,MAAM,OAAO,IAAI,QAAQ,EAAE,CAAC;QAC/B,MAAM,CAAC,IAAI,CACT,uCAAuC,KAAK,KAAK,OAAO,CAAC,QAAQ,KAAK;YACtE,4BAA4B,gBAAgB,aAAa;YACzD,0CAA0C;YAC1C,wFAAwF,CACzF,CAAC;IACJ,CAAC;AACH,CAAC"}

package/dist/templates/azure-devops/publish-pipeline.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"publish-pipeline.d.ts","sourceRoot":"","sources":["../../../src/templates/azure-devops/publish-pipeline.ts"],"names":[],"mappings":"AAEA;;;GAGG;AAEH,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,qBAAqB,GAAG,MAAM,CA4H7E"}
+{"version":3,"file":"publish-pipeline.d.ts","sourceRoot":"","sources":["../../../src/templates/azure-devops/publish-pipeline.ts"],"names":[],"mappings":"AAEA;;;GAGG;AAEH,MAAM,WAAW,qBAAqB;IACpC,WAAW,EAAE,MAAM,CAAC;IACpB,YAAY,EAAE,MAAM,EAAE,CAAC;CACxB;AAED,wBAAgB,uBAAuB,CAAC,MAAM,EAAE,qBAAqB,GAAG,MAAM,CA6J7E"}

package/dist/templates/azure-devops/publish-pipeline.js

@@ -7,17 +7,18 @@
 export function generatePublishPipeline(config) {
     const defaultEnvironment = config.environments[0] ?? 'dev';
     const envValues = config.environments.map((env) => `      - '${env}'`).join('\n');
-    const stages = config.environments.map((env) => {
-        const envUpper = env.toUpperCase();
-        return `- stage: Publish_${env}
-  displayName: 'Publish to ${env}'
-  condition: eq('\${{ parameters.ENVIRONMENT }}', '${env}')
+    // A single parameterized stage drives all environments. The ENVIRONMENT
+    // parameter is resolved at template (compile) time, so it can select the
+    // variable group, deployment environment, config file, and env-suffixed
+    // variable names (via upper()) without duplicating the stage per environment.
+    const stage = `- stage: Publish
+  displayName: 'Publish to \${{ parameters.ENVIRONMENT }}'
   variables:
-    - group: apim-${env}
+    - group: apim-\${{ parameters.ENVIRONMENT }}
   jobs:
     - deployment: Deploy
-      displayName: 'Deploy to ${env}'
-      environment: ${env}
+      displayName: 'Deploy to \${{ parameters.ENVIRONMENT }}'
+      environment: \${{ parameters.ENVIRONMENT }}
       pool:
         vmImage: 'ubuntu-latest'
       strategy:
@@ -46,54 +47,87 @@ export function generatePublishPipeline(config) {
                 displayName: 'Install dependencies'
 
               - task: replacetokens@6
-                displayName: 'Substitute tokens in configuration.${env}.yaml'
+                displayName: 'Substitute tokens in configuration.\${{ parameters.ENVIRONMENT }}.yaml'
                 inputs:
-                  sources: 'configuration.${env}.yaml'
+                  sources: 'configuration.\${{ parameters.ENVIRONMENT }}.yaml'
                   tokenPattern: 'custom'
                   tokenPrefix: '{#['
                   tokenSuffix: ']#}'
                   missingVarAction: 'keep'
+                  missingVarLog: 'error'
 
               - script: |
-                  if grep -q '{#\\[' configuration.${env}.yaml; then
-                    echo "Unresolved tokens remain in configuration.${env}.yaml"
-                    grep -o '{#\\[[^]]*\\]#}' configuration.${env}.yaml | sort -u
+                  if grep -q '{#\\[' configuration.\${{ parameters.ENVIRONMENT }}.yaml; then
+                    echo "Unresolved tokens remain in configuration.\${{ parameters.ENVIRONMENT }}.yaml"
+                    grep -o '{#\\[[^]]*\\]#}' configuration.\${{ parameters.ENVIRONMENT }}.yaml | sort -u
                     exit 1
                   fi
-                displayName: 'Validate token substitution (${env})'
+                displayName: 'Validate token substitution'
 
               - task: AzureCLI@2
-                displayName: 'Publish to ${env} (incremental - last commit only)'
-                condition: ne('\${{ parameters.COMMIT_ID_CHOICE }}', 'publish-all-artifacts-in-repo')
+                displayName: 'Dry-run validation (incremental)'
+                condition: and(succeeded(), ne('\${{ parameters.COMMIT_ID_CHOICE }}', 'publish-all-artifacts-in-repo'))
                 inputs:
-                  azureSubscription: 'AZURE_SERVICE_CONNECTION_${envUpper}'
+                  azureSubscription: 'AZURE_SERVICE_CONNECTION_\${{ upper(parameters.ENVIRONMENT) }}'
                   scriptType: 'bash'
                   scriptLocation: 'inlineScript'
                   inlineScript: |
                     npx apiops publish \\
-                      --resource-group $(APIM_RESOURCE_GROUP_${envUpper}) \\
-                      --service-name $(APIM_SERVICE_NAME_${envUpper}) \\
+                      --resource-group $(APIM_RESOURCE_GROUP_\${{ upper(parameters.ENVIRONMENT) }}) \\
+                      --service-name $(APIM_SERVICE_NAME_\${{ upper(parameters.ENVIRONMENT) }}) \\
                       --source ${config.artifactDir} \\
-                      --overrides configuration.${env}.yaml \\
+                      --overrides configuration.\${{ parameters.ENVIRONMENT }}.yaml \\
+                      --commit-id $(Build.SourceVersion) \\
+                      --subscription-id $(AZURE_SUBSCRIPTION_ID) \\
+                      --dry-run
+
+              - task: AzureCLI@2
+                displayName: 'Dry-run validation (all artifacts)'
+                condition: and(succeeded(), eq('\${{ parameters.COMMIT_ID_CHOICE }}', 'publish-all-artifacts-in-repo'))
+                inputs:
+                  azureSubscription: 'AZURE_SERVICE_CONNECTION_\${{ upper(parameters.ENVIRONMENT) }}'
+                  scriptType: 'bash'
+                  scriptLocation: 'inlineScript'
+                  inlineScript: |
+                    npx apiops publish \\
+                      --resource-group $(APIM_RESOURCE_GROUP_\${{ upper(parameters.ENVIRONMENT) }}) \\
+                      --service-name $(APIM_SERVICE_NAME_\${{ upper(parameters.ENVIRONMENT) }}) \\
+                      --source ${config.artifactDir} \\
+                      --overrides configuration.\${{ parameters.ENVIRONMENT }}.yaml \\
+                      --subscription-id $(AZURE_SUBSCRIPTION_ID) \\
+                      --dry-run
+
+              - task: AzureCLI@2
+                displayName: 'Publish (incremental - last commit only)'
+                condition: and(succeeded(), ne('\${{ parameters.COMMIT_ID_CHOICE }}', 'publish-all-artifacts-in-repo'))
+                inputs:
+                  azureSubscription: 'AZURE_SERVICE_CONNECTION_\${{ upper(parameters.ENVIRONMENT) }}'
+                  scriptType: 'bash'
+                  scriptLocation: 'inlineScript'
+                  inlineScript: |
+                    npx apiops publish \\
+                      --resource-group $(APIM_RESOURCE_GROUP_\${{ upper(parameters.ENVIRONMENT) }}) \\
+                      --service-name $(APIM_SERVICE_NAME_\${{ upper(parameters.ENVIRONMENT) }}) \\
+                      --source ${config.artifactDir} \\
+                      --overrides configuration.\${{ parameters.ENVIRONMENT }}.yaml \\
                       --commit-id $(Build.SourceVersion) \\
                       --subscription-id $(AZURE_SUBSCRIPTION_ID)
 
               - task: AzureCLI@2
-                displayName: 'Publish to ${env} (all artifacts)'
-                condition: eq('\${{ parameters.COMMIT_ID_CHOICE }}', 'publish-all-artifacts-in-repo')
+                displayName: 'Publish (all artifacts)'
+                condition: and(succeeded(), eq('\${{ parameters.COMMIT_ID_CHOICE }}', 'publish-all-artifacts-in-repo'))
                 inputs:
-                  azureSubscription: 'AZURE_SERVICE_CONNECTION_${envUpper}'
+                  azureSubscription: 'AZURE_SERVICE_CONNECTION_\${{ upper(parameters.ENVIRONMENT) }}'
                   scriptType: 'bash'
                   scriptLocation: 'inlineScript'
                   inlineScript: |
                     npx apiops publish \\
-                      --resource-group $(APIM_RESOURCE_GROUP_${envUpper}) \\
-                      --service-name $(APIM_SERVICE_NAME_${envUpper}) \\
+                      --resource-group $(APIM_RESOURCE_GROUP_\${{ upper(parameters.ENVIRONMENT) }}) \\
+                      --service-name $(APIM_SERVICE_NAME_\${{ upper(parameters.ENVIRONMENT) }}) \\
                       --source ${config.artifactDir} \\
-                      --overrides configuration.${env}.yaml \\
+                      --overrides configuration.\${{ parameters.ENVIRONMENT }}.yaml \\
                       --subscription-id $(AZURE_SUBSCRIPTION_ID)
 `;
-    }).join('\n');
     return `# Azure DevOps Pipeline: Run APIM Publisher
 
 trigger:
@@ -123,7 +157,7 @@ parameters:
 ${envValues}
 
 stages:
-${stages}
+${stage}
 `;
 }
 //# sourceMappingURL=publish-pipeline.js.map

package/dist/templates/azure-devops/publish-pipeline.js.map

@@ -1 +1 @@
-{"version":3,"file":"publish-pipeline.js","sourceRoot":"","sources":["../../../src/templates/azure-devops/publish-pipeline.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC;AAClC;;;GAGG;AAOH,MAAM,UAAU,uBAAuB,CAAC,MAA6B;IACnE,MAAM,kBAAkB,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;IAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAElF,MAAM,MAAM,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE;QAC7C,MAAM,QAAQ,GAAG,GAAG,CAAC,WAAW,EAAE,CAAC;QAEnC,OAAO,oBAAoB,GAAG;6BACL,GAAG;qDACqB,GAAG;;oBAEpC,GAAG;;;gCAGS,GAAG;qBACd,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;mEA6B2C,GAAG;;4CAE1B,GAAG;;;;;;;qDAOM,GAAG;sEACc,GAAG;8DACX,GAAG;;;6DAGJ,GAAG;;;2CAGrB,GAAG;;;iEAGmB,QAAQ;;;;;+DAKV,QAAQ;2DACZ,QAAQ;iCAClC,MAAM,CAAC,WAAW;kDACD,GAAG;;;;;2CAKV,GAAG;;;iEAGmB,QAAQ;;;;;+DAKV,QAAQ;2DACZ,QAAQ;iCAClC,MAAM,CAAC,WAAW;kDACD,GAAG;;CAEpD,CAAC;IACA,CAAC,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAEd,OAAO;;;;;;;;WAQE,MAAM,CAAC,WAAW;;;;;;;;;;;;;;;;gBAgBb,kBAAkB;;EAEhC,SAAS;;;EAGT,MAAM;CACP,CAAC;AACF,CAAC"}
+{"version":3,"file":"publish-pipeline.js","sourceRoot":"","sources":["../../../src/templates/azure-devops/publish-pipeline.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,kCAAkC;AAClC;;;GAGG;AAOH,MAAM,UAAU,uBAAuB,CAAC,MAA6B;IACnE,MAAM,kBAAkB,GAAG,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC;IAC3D,MAAM,SAAS,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,YAAY,GAAG,GAAG,CAAC,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC;IAElF,wEAAwE;IACxE,yEAAyE;IACzE,wEAAwE;IACxE,8EAA8E;IAC9E,MAAM,KAAK,GAAG;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;iCAgEiB,MAAM,CAAC,WAAW;;;;;;;;;;;;;;;;;iCAiBlB,MAAM,CAAC,WAAW;;;;;;;;;;;;;;;;iCAgBlB,MAAM,CAAC,WAAW;;;;;;;;;;;;;;;;iCAgBlB,MAAM,CAAC,WAAW;;;CAGlD,CAAC;IAEA,OAAO;;;;;;;;WAQE,MAAM,CAAC,WAAW;;;;;;;;;;;;;;;;gBAgBb,kBAAkB;;EAEhC,SAAS;;;EAGT,KAAK;CACN,CAAC;AACF,CAAC"}

package/dist/templates/configs/filter-config.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"filter-config.d.ts","sourceRoot":"","sources":["../../../src/templates/configs/filter-config.ts"],"names":[],"mappings":"AAEA;;;GAGG;AAEH,wBAAgB,oBAAoB,IAAI,MAAM,CAuH7C"}
+{"version":3,"file":"filter-config.d.ts","sourceRoot":"","sources":["../../../src/templates/configs/filter-config.ts"],"names":[],"mappings":"AAEA;;;GAGG;AAMH,wBAAgB,oBAAoB,IAAI,MAAM,CAI7C"}