feat: add token substitution validation step to GitHub Actions publish workflow (#158)

* feat: add token substitution validation step to GitHub Actions publish workflow

Add a validation step after token substitution that checks for unresolved
tokens in the configuration file and fails the workflow with details if any
remain. This matches the existing behavior in the Azure DevOps pipeline.

Closes #156

* Adding skill to clone another repo. Need when testing `apiops init`

* skill for using two repos in Redbox
---------

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Elizabeth Maher <enewman@microsoft.com>

Author: Copilot

.github/skills/codespace-clone-repo/SKILL.md

@@ -0,0 +1,121 @@
+---
+name: "codespace-clone-repo"
+description: "Clone another GitHub repository from a Codespace/dev container using GitHub CLI web login (no PAT), especially when GITHUB_TOKEN defaults interfere with auth. Use when gh auth login fails or when testing apiops init/pipeline changes across repos."
+domain: "developer-workflow"
+confidence: "high"
+source: "manual + repeated Codespaces troubleshooting"
+---
+
+## Context
+
+Use this skill when a user needs to clone another repository from a Codespace or dev container and must avoid PAT-based auth and environment-provided `GITHUB_TOKEN`/`GH_TOKEN` credentials.
+
+This pattern is useful for cross-repo validation such as `apiops init` pipeline testing.
+
+## Fast Path
+
+Run these commands in order:
+
+```bash
+unset GITHUB_TOKEN GH_TOKEN
+
+# Optional but recommended to clear stale account state
+gh auth logout -h github.com
+
+# Web/device login, no PAT
+env -u GITHUB_TOKEN -u GH_TOKEN gh auth login \
+  -h github.com \
+  -p https \
+  -w \
+  --clipboard \
+  --insecure-storage
+
+# Verify auth source is account login, not env token
+env -u GITHUB_TOKEN -u GH_TOKEN gh auth status
+```
+
+Then clone to `/workspaces`:
+
+```bash
+cd /workspaces
+gh clone <owner>/<repo>
+```
+
+After cloning, open workspaces so all repos can be opened:
+
+1. In VS Code, go to **File → Open Folder...**
+2. Navigate to and select `/workspaces`
+3. Click **Open**
+
+VS Code will reload with the cloned repository as your workspace.
+
+## If Login Appears Stuck
+
+If `gh auth login` shows:
+
+- `First copy your one-time code: XXXX-YYYY`
+- `Press Enter to open https://github.com/login/device in your browser...`
+
+Use a second terminal:
+
+```bash
+$BROWSER https://github.com/login/device
+```
+
+Enter the one-time code in the browser and authorize, then return to the original terminal and press Enter if needed.
+
+## Common Failure Modes
+
+- `gh auth status` shows `(GITHUB_TOKEN)`:
+  environment token is still active. Re-run with `env -u GITHUB_TOKEN -u GH_TOKEN`.
+
+- Login exits with code `130`:
+  usually interrupted (`Ctrl+C`) while waiting for device authorization. Restart login and complete browser step.
+
+- Browser does not launch from container:
+  run `$BROWSER https://github.com/login/device` manually from a separate terminal.
+
+- Clone prompts for credentials unexpectedly:
+  verify git protocol is HTTPS in `gh auth status` and re-run `gh auth login -p https` if necessary.
+
+- `git push`/`git fetch` returns `403` even though `gh auth status` looks correct:
+  Codespaces can inject `GITHUB_TOKEN`/`GH_TOKEN` that override account auth for git operations.
+  Use token-sanitized commands and force gh credentials for the operation:
+
+  ```bash
+  env -u GITHUB_TOKEN -u GH_TOKEN git \
+    -c credential.helper= \
+    -c credential.helper='!gh auth git-credential' \
+    push origin <branch>
+  ```
+
+  For fetch/pull, use the same pattern with `fetch` or `pull`.
+
+## Safety Notes
+
+- Never request a PAT for this workflow unless the user explicitly asks for a PAT-based approach.
+- Do not route secrets through chat prompts.
+- Keep authentication interactive in user terminal when account sign-in is required.
+
+## Example End-to-End
+
+```bash
+unset GITHUB_TOKEN GH_TOKEN
+gh auth logout -h github.com
+env -u GITHUB_TOKEN -u GH_TOKEN gh auth login -h github.com -p https -w --clipboard --insecure-storage
+env -u GITHUB_TOKEN -u GH_TOKEN gh auth status
+cd /workspaces
+gh clone <owner>/<repo>
+```
+
+If you later need to push from a Codespace, use:
+
+```bash
+cd /workspaces/<repo>
+env -u GITHUB_TOKEN -u GH_TOKEN git \
+  -c credential.helper= \
+  -c credential.helper='!gh auth git-credential' \
+  push origin <branch>
+```
+
+Then use **File → Open Folder...** to open `/workspaces` in VS Code.

src/templates/github-actions/publish-workflow.ts

@@ -49,16 +49,59 @@ ${autoDeployComment}
           tenant-id: \${{ secrets.AZURE_TENANT_ID }}
           subscription-id: \${{ secrets.AZURE_SUBSCRIPTION_ID }}
 
+      - name: Validate token source values (${env})
+        env:
+          AVAILABLE_SECRETS_JSON: \${{ toJSON(secrets) }}
+        run: |
+          missing=0
+          tokens=$(grep -o '{#\\[[^]]*\\]#}' configuration.${env}.yaml | sed -E 's/^\\{#\\[([^]]+)\\]#\\}$/\\1/' | sort -u || true)
+
+          if [ -z "$tokens" ]; then
+            echo "No tokens found in configuration.${env}.yaml"
+            exit 0
+          fi
+
+          while IFS= read -r token; do
+            if [ -z "$token" ]; then
+              continue
+            fi
+
+            if ! echo "$token" | grep -Eq '^[A-Za-z_][A-Za-z0-9_]*$'; then
+              echo "::error::Token '$token' is not a valid environment variable name. Use letters, numbers, and underscores only."
+              missing=1
+              continue
+            fi
+
+            value=$(jq -r --arg token "$token" '.[$token] // empty' <<< "$AVAILABLE_SECRETS_JSON")
+            if [ -z "$value" ]; then
+              echo "::error::Missing secret for token '$token'"
+              missing=1
+              continue
+            fi
+
+            printf '%s=%s\\n' "$token" "$value" >> "$GITHUB_ENV"
+          done <<< "$tokens"
+
+          if [ "$missing" -ne 0 ]; then
+            exit 1
+          fi
+
       - name: Substitute tokens in configuration.${env}.yaml
         uses: cschleiden/replace-tokens@v1.3
         with:
           tokenPrefix: '{#['
           tokenSuffix: ']#}'
           files: '["configuration.${env}.yaml"]'
-          # Example token mapping for ${env} (uncomment and customize when needed):
-          # env:
-          #   MY_SECRET: \${{ secrets.MY_SECRET_${envUpper} }}
-          #   ANOTHER_TOKEN: \${{ secrets.ANOTHER_TOKEN_${envUpper} }}
+          # Token values are injected in the previous step based on token names.
+          # Ensure tokens in configuration.${env}.yaml match secret names exactly.
+
+      - name: Validate token substitution (${env})
+        run: |
+          if grep -q '{#\\[' configuration.${env}.yaml; then
+            echo "Unresolved tokens remain in configuration.${env}.yaml"
+            grep -o '{#\\[[^]]*\\]#}' configuration.${env}.yaml | sort -u
+            exit 1
+          fi
 
       - name: Publish to ${env} (incremental - last commit only)
         if: \${{ github.event.inputs.COMMIT_ID_CHOICE != 'publish-all-artifacts-in-repo' }}

tests/unit/templates/github-actions/publish-workflow.test.ts

@@ -235,5 +235,35 @@ describe('github-actions/publish-workflow', () => {
       expect(tokenIdx).toBeGreaterThan(0);
       expect(tokenIdx).toBeLessThan(publishIdx);
     });
+
+    it('should validate unresolved tokens after substitution', () => {
+      const workflow = generatePublishWorkflow({
+        artifactDir: './apim-artifacts',
+        environments: ['dev', 'prod'],
+      });
+      expect(workflow).toContain('Validate token source values (dev)');
+      expect(workflow).toContain('Validate token source values (prod)');
+      expect(workflow).toContain('AVAILABLE_SECRETS_JSON: ${{ toJSON(secrets) }}');
+      expect(workflow).toContain("echo \"::error::Missing secret for token '$token'\"");
+      expect(workflow).toContain("printf '%s=%s\\n' \"$token\" \"$value\" >> \"$GITHUB_ENV\"");
+      expect(workflow).toContain('Validate token substitution (dev)');
+      expect(workflow).toContain('Validate token substitution (prod)');
+      expect(workflow).toContain("grep -q '{#\\[' configuration.dev.yaml");
+      expect(workflow).toContain("grep -q '{#\\[' configuration.prod.yaml");
+    });
+
+    it('should place token validation step between substitution and publish', () => {
+      const workflow = generatePublishWorkflow({
+        artifactDir: './apim-artifacts',
+        environments: ['dev'],
+      });
+      const validateSourcesIdx = workflow.indexOf('Validate token source values (dev)');
+      const substituteIdx = workflow.indexOf('cschleiden/replace-tokens');
+      const validateSubstitutionIdx = workflow.indexOf('Validate token substitution (dev)');
+      const publishIdx = workflow.indexOf('npx apiops publish');
+      expect(validateSourcesIdx).toBeLessThan(substituteIdx);
+      expect(substituteIdx).toBeLessThan(validateSubstitutionIdx);
+      expect(validateSubstitutionIdx).toBeLessThan(publishIdx);
+    });
   });
 });