fix: validate token source values in publish workflow template

Author: EMaher

src/templates/github-actions/publish-workflow.ts

@@ -49,16 +49,51 @@ ${autoDeployComment}
           tenant-id: \${{ secrets.AZURE_TENANT_ID }}
           subscription-id: \${{ secrets.AZURE_SUBSCRIPTION_ID }}
 
+      - name: Validate token source values (${env})
+        env:
+          AVAILABLE_SECRETS_JSON: \${{ toJSON(secrets) }}
+        run: |
+          missing=0
+          tokens=$(grep -o '{#\\[[^]]*\\]#}' configuration.${env}.yaml | sed -E 's/^\\{#\\[([^]]+)\\]#\\}$/\\1/' | sort -u || true)
+
+          if [ -z "$tokens" ]; then
+            echo "No tokens found in configuration.${env}.yaml"
+            exit 0
+          fi
+
+          while IFS= read -r token; do
+            if [ -z "$token" ]; then
+              continue
+            fi
+
+            if ! echo "$token" | grep -Eq '^[A-Za-z_][A-Za-z0-9_]*$'; then
+              echo "::error::Token '$token' is not a valid environment variable name. Use letters, numbers, and underscores only."
+              missing=1
+              continue
+            fi
+
+            value=$(jq -r --arg token "$token" '.[$token] // empty' <<< "$AVAILABLE_SECRETS_JSON")
+            if [ -z "$value" ]; then
+              echo "::error::Missing secret for token '$token'"
+              missing=1
+              continue
+            fi
+
+            printf '%s=%s\\n' "$token" "$value" >> "$GITHUB_ENV"
+          done <<< "$tokens"
+
+          if [ "$missing" -ne 0 ]; then
+            exit 1
+          fi
+
       - name: Substitute tokens in configuration.${env}.yaml
         uses: cschleiden/replace-tokens@v1.3
         with:
           tokenPrefix: '{#['
           tokenSuffix: ']#}'
           files: '["configuration.${env}.yaml"]'
-          # Example token mapping for ${env} (uncomment and customize when needed):
-          # env:
-          #   MY_SECRET: \${{ secrets.MY_SECRET_${envUpper} }}
-          #   ANOTHER_TOKEN: \${{ secrets.ANOTHER_TOKEN_${envUpper} }}
+          # Token values are injected in the previous step based on token names.
+          # Ensure tokens in configuration.${env}.yaml match secret names exactly.
 
       - name: Validate token substitution (${env})
         run: |

tests/unit/templates/github-actions/publish-workflow.test.ts

@@ -241,6 +241,11 @@ describe('github-actions/publish-workflow', () => {
         artifactDir: './apim-artifacts',
         environments: ['dev', 'prod'],
       });
+      expect(workflow).toContain('Validate token source values (dev)');
+      expect(workflow).toContain('Validate token source values (prod)');
+      expect(workflow).toContain('AVAILABLE_SECRETS_JSON: ${{ toJSON(secrets) }}');
+      expect(workflow).toContain("echo \"::error::Missing secret for token '$token'\"");
+      expect(workflow).toContain("printf '%s=%s\\n' \"$token\" \"$value\" >> \"$GITHUB_ENV\"");
       expect(workflow).toContain('Validate token substitution (dev)');
       expect(workflow).toContain('Validate token substitution (prod)');
       expect(workflow).toContain("grep -q '{#\\[' configuration.dev.yaml");
@@ -252,11 +257,13 @@ describe('github-actions/publish-workflow', () => {
         artifactDir: './apim-artifacts',
         environments: ['dev'],
       });
+      const validateSourcesIdx = workflow.indexOf('Validate token source values (dev)');
       const substituteIdx = workflow.indexOf('cschleiden/replace-tokens');
-      const validateIdx = workflow.indexOf('Validate token substitution (dev)');
+      const validateSubstitutionIdx = workflow.indexOf('Validate token substitution (dev)');
       const publishIdx = workflow.indexOf('npx apiops publish');
-      expect(substituteIdx).toBeLessThan(validateIdx);
-      expect(validateIdx).toBeLessThan(publishIdx);
+      expect(validateSourcesIdx).toBeLessThan(substituteIdx);
+      expect(substituteIdx).toBeLessThan(validateSubstitutionIdx);
+      expect(validateSubstitutionIdx).toBeLessThan(publishIdx);
     });
   });
 });