@postman-cse/onboarding-azure-spec-discovery 1.0.1 → 1.2.0

package/README.md

@@ -7,11 +7,11 @@ Zero-config discovery and export of API specs from Azure services using only you
 The action resolves the best specification source for the current repository in this order:
 
 1. **Repo spec** — an OpenAPI/Swagger file already committed to the repository wins outright; Azure is never called.
-2. **Azure API Management (APIM)** — the current HTTP revision of an APIM API, exported as OpenAPI 3.0 JSON through the ARM export protocol.
+2. **Azure API Management (APIM)** — current HTTP APIs as OpenAPI, SOAP APIs as native WSDL, and GraphQL APIs as native SDL plus a partial derived OpenAPI `/graphql` POST shell.
 3. **App Service API definition** — a site whose `apiDefinition.url` points at a reachable OpenAPI document.
 4. **Local Azure IaC** — OpenAPI content embedded in ARM/Bicep templates or referenced by `azure.yaml` in the repository.
 
-When several Azure candidates match, a four-tier narrowing pipeline (IaC fingerprint, resource-group correlation, `postman:*` tag prefilter, naming heuristic) orders them, and genuinely ambiguous results surface as a ranked GitHub Step Summary table instead of a guess.
+When several Azure candidates match, a four-tier narrowing pipeline (IaC fingerprint, resource-group correlation, repo-tag prefilter, naming heuristic) orders them, and genuinely ambiguous results surface as a ranked GitHub Step Summary table instead of a guess. The tag prefilter selects outright when exactly one candidate carries a select-grade repo tag for the calling repository: canonical `postman:repo=<org>/<repo>`, the Fox-style `GithubOrg`/`GithubRepo` pair, or any extra keys supplied via the CLI-only `--repo-tag-keys-json` flag. Tag names and values compare case-insensitively (a trailing `.git` is tolerated), and when enumerated candidates carry no matching tags a single targeted Resource Graph tag lookup runs as a fallback — so a gateway tagged with its owning repo resolves automatically, per service repo, with zero further configuration.
 
 ## Auth and Postman handoff
 
@@ -65,6 +65,16 @@ jobs:
     resource-group: payments-rg
 ```
 
+### discover-estate mode
+
+Enumerates repo-associated Azure resources across the whole subscription — one Resource Graph sweep over `Resources` and `ResourceContainers` for repo tags (`postman:repo`, `github:repository`, `GithubOrg`/`GithubRepo`, `repo`, `repository`), deduped to an org/repo roster written as `repos.json` and emitted on `repos-json`/`repo-count`. Association only: no spec export, no PRs, no GitHub writes.
+
+```yaml
+- uses: postman-cs/postman-azure-spec-discovery-action@v1
+  with:
+    mode: discover-estate
+```
+
 ### Chaining into Postman API onboarding
 
 ```yaml
@@ -92,7 +102,7 @@ The CLI exposes every action input as a `--kebab-case` flag plus CLI-only flags
 <!-- inputs-table:start -->
 | Name | Description | Required | Default |
 | --- | --- | --- | --- |
-| `mode` | Discovery mode: resolve-one selects the single best service for this repository; discover-many exports every exportable candidate. | no | `resolve-one` |
+| `mode` | Discovery mode: resolve-one selects the single best service for this repository; discover-many exports every exportable candidate; discover-estate enumerates repo-associated Azure resources across the subscription without exporting specs. | no | `resolve-one` |
 | `subscription-id` | Optional Azure subscription ID used as the discovery enumeration root. When omitted, the single enabled subscription visible to the credential is used; multiple enabled subscriptions require this input. | no | n/a |
 | `resource-group` | Optional resource group that scopes discovery to one group instead of the whole subscription. | no | n/a |
 | `api-id` | Optional full APIM API ARM resource ID for this service. Use this to bypass broader subscription discovery. | no | n/a |
@@ -108,7 +118,7 @@ The CLI exposes every action input as a `--kebab-case` flag plus CLI-only flags
 | --- | --- |
 | `resolution-json` | JSON resolution result describing status, source type, confidence, and evidence. |
 | `resolution-status` | Resolution status: resolved or unresolved. |
-| `source-type` | Resolved source type: repo-spec, apim-export, app-service-api-definition, iac-embedded, manual-review, or discover-many. |
+| `source-type` | Resolved source type: repo-spec, apim-export, app-service-api-definition, iac-embedded, custom-api-swagger, logic-apps-workflow, template-spec-embedded, event-grid-webhook, service-bus-topic, function-bindings-trigger, manual-review, or discover-many. |
 | `mapping-confidence` | Numeric confidence score for the selected service candidate. |
 | `spec-path` | Path to the resolved or generated specification when available. |
 | `api-id` | Full APIM API ARM resource ID for APIM resolutions; empty for App Service or IaC-local resolutions. |
@@ -117,8 +127,8 @@ The CLI exposes every action input as a `--kebab-case` flag plus CLI-only flags
 | `service-count` | discover-many output: number of exported services. |
 | `export-summary-json` | JSON summary of attempted, exported, failed, and skipped candidates. |
 | `candidates-json` | Ranked ambiguous candidates as JSON when resolution is unresolved with at least two candidates; empty otherwise. |
-| `provider-type` | Provider that produced the resolved spec: apim, app-service, or iac-local. |
-| `spec-format` | Format of the resolved spec: openapi-yaml or openapi-json. |
+| `provider-type` | Provider that produced the resolved spec: apim, app-service, iac-local, custom-apis, logic-apps, template-specs, event-grid, service-bus, or function-bindings. |
+| `spec-format` | Format of the resolved spec: openapi-yaml, openapi-json, wsdl, or graphql-sdl. |
 | `contract-origin` | Compatibility output; always empty in v1. |
 | `contract-metadata-path` | Compatibility output; always empty in v1. |
 | `variant-count` | Compatibility output; always empty in v1. |
@@ -128,17 +138,25 @@ The CLI exposes every action input as a `--kebab-case` flag plus CLI-only flags
 | `derived-openapi-format` | Serialization format of the derived OpenAPI document: openapi-json. |
 | `derived-openapi-evidence-json` | JSON array of evidence strings describing how the derived OpenAPI document was produced. |
 | `narrowing-strategy` | Narrowing tier that produced the candidate ordering: iac-fingerprint, rg-correlation, tag-prefilter, naming-heuristic, or none. |
+| `repos-json` | discover-estate output: JSON array of deduped org/repo associations discovered from repo tags across the subscription; empty otherwise. |
+| `repo-count` | discover-estate output: number of deduped org/repo associations; empty otherwise. |
 <!-- outputs-table:end -->
 
 ## Supported providers
 
 | Provider | Source | Exported format |
 | --- | --- | --- |
-| `apim` | Azure API Management current HTTP API revision (ARM export + SAS link) | OpenAPI 3.0 JSON |
+| `apim` | Azure API Management current HTTP, SOAP, or GraphQL API revision | OpenAPI JSON; native WSDL; native GraphQL SDL + partial OpenAPI 3.0.3 derivation |
 | `app-service` | App Service `siteConfig.apiDefinition.url` document | OpenAPI JSON or YAML |
+| `custom-apis` | Logic Apps custom connector inline swagger (`Microsoft.Web/customApis`) | Swagger/OpenAPI JSON |
+| `logic-apps` | Consumption Logic App HTTP Request triggers (`Microsoft.Logic/workflows`) | Partial OpenAPI 3.0 JSON (synthesized) |
+| `template-specs` | Template Spec version embedded APIM inline documents (`Microsoft.Resources/templateSpecs/versions`) | OpenAPI/Swagger JSON (partial) |
+| `event-grid` | Event Grid topic/domain/system-topic webhook subscriptions (synthesized delivery contract) | OpenAPI 3.0 JSON (partial) |
+| `service-bus` | Service Bus topic/subscription/rule metadata (synthesized publish contract) | OpenAPI 3.0 JSON (partial) |
+| `function-bindings` | Azure Functions trigger bindings (`sites/functions` config.bindings) | OpenAPI 3.0 JSON (partial) |
 | `iac-local` | OpenAPI embedded in repo ARM/Bicep templates or referenced by `azure.yaml` | OpenAPI JSON or YAML |
 
-Non-HTTP APIM API types (SOAP, GraphQL, WebSocket, gRPC, OData) are surfaced as visible-unsupported candidates and routed to manual review; they are never exported in v1. Service- and workspace-scoped APIM APIs are both enumerated. Azure API Center, Functions, Container Apps, and management-group enumeration are out of scope for v1.
+APIM SOAP and GraphQL APIs are exportable; WebSocket, gRPC, and OData remain visible-unsupported candidates routed to manual review. Service- and workspace-scoped APIM APIs are both enumerated. Custom connectors without an inline swagger document stay visible as manual-review candidates. Azure API Center, Container Apps, and management-group enumeration are out of scope for now.
 
 ## How it works
 

package/action.yml

@@ -6,7 +6,7 @@ branding:
   color: orange
 inputs:
   mode:
-    description: 'Discovery mode: resolve-one selects the single best service for this repository; discover-many exports every exportable candidate.'
+    description: 'Discovery mode: resolve-one selects the single best service for this repository; discover-many exports every exportable candidate; discover-estate enumerates repo-associated Azure resources across the subscription without exporting specs.'
     required: false
     default: resolve-one
   subscription-id:
@@ -39,7 +39,7 @@ outputs:
   resolution-status:
     description: 'Resolution status: resolved or unresolved.'
   source-type:
-    description: 'Resolved source type: repo-spec, apim-export, app-service-api-definition, iac-embedded, manual-review, or discover-many.'
+    description: 'Resolved source type: repo-spec, apim-export, app-service-api-definition, iac-embedded, custom-api-swagger, logic-apps-workflow, template-spec-embedded, event-grid-webhook, service-bus-topic, function-bindings-trigger, manual-review, or discover-many.'
   mapping-confidence:
     description: Numeric confidence score for the selected service candidate.
   spec-path:
@@ -57,9 +57,9 @@ outputs:
   candidates-json:
     description: Ranked ambiguous candidates as JSON when resolution is unresolved with at least two candidates; empty otherwise.
   provider-type:
-    description: 'Provider that produced the resolved spec: apim, app-service, or iac-local.'
+    description: 'Provider that produced the resolved spec: apim, app-service, iac-local, custom-apis, logic-apps, template-specs, event-grid, service-bus, or function-bindings.'
   spec-format:
-    description: 'Format of the resolved spec: openapi-yaml or openapi-json.'
+    description: 'Format of the resolved spec: openapi-yaml, openapi-json, wsdl, or graphql-sdl.'
   contract-origin:
     description: Compatibility output; always empty in v1.
   contract-metadata-path:
@@ -78,6 +78,10 @@ outputs:
     description: JSON array of evidence strings describing how the derived OpenAPI document was produced.
   narrowing-strategy:
     description: 'Narrowing tier that produced the candidate ordering: iac-fingerprint, rg-correlation, tag-prefilter, naming-heuristic, or none.'
+  repos-json:
+    description: 'discover-estate output: JSON array of deduped org/repo associations discovered from repo tags across the subscription; empty otherwise.'
+  repo-count:
+    description: 'discover-estate output: number of deduped org/repo associations; empty otherwise.'
 runs:
   using: node24
   main: dist/index.cjs