Handle secret redaction in policy XML

[Copilot]

This pull request introduces comprehensive support for secret redaction in policy extraction and publishing workflows, and adds a new integration test for redaction. The main changes ensure that extracted policy files have secrets redacted, and that publishing is strictly blocked if any redaction markers remain. This prevents accidental exposure of secrets and enforces best practices for secret management. Additionally, documentation and test workflows have been updated to reflect and validate these changes.

Secret Redaction and Enforcement:

• All policy extraction functions (extractApiPolicy, extractApiOperations, extractGraphQLResolvers, extractServicePolicy, extractProductPolicy) now use redactAndWarnPolicySecrets to redact secrets from policy content before writing to disk or returning content. [1] [2] [3] [4] [5]
• The publish workflow (runPublish in publish-service.ts) performs a pre-flight scan for redaction markers (*** REDACTED ***) in all artifacts to be published, aborting the entire publish if any are found, including in dry-run mode.
• The policy publishing logic (publishPolicy in resource-publisher.ts) performs a fail-safe check for redaction markers after overrides are applied, blocking publishing if any remain. [1] [2]

Integration Test and Documentation Updates:

• A new GitHub Actions workflow (integration-redact-secrets.yml) has been added to test the redaction and publishing guard end-to-end, including parameterization and Azure login.
• The integration test prerequisites documentation and .squad/agents/apimexpert/history.md have been updated to cover the new workflow and clarify best practices for handling redacted secrets and policy overrides. [1] [2]

Refactoring and Exports:

• The POLICY_TYPES set is now exported for broader use in the codebase.
• Imports for redactAndWarnPolicySecrets and related helpers have been added where necessary. [1] [2] [3] [4] [5]

These changes collectively ensure that secrets are never published accidentally and provide clear guidance and test coverage for handling redacted secrets in API Management workflows.policy.xml redaction handled Authorization headers as all-or-nothing values, which missed the common ****** shape called out in review. This update redacts literal bearer tokens without stripping the Bearer` scheme and preserves named value-backed bearer headers.

• Authorization header redaction

  • Detect Authorization values in the form `******
  • Rewrite literal tokens to ****** REDACTED ***
  • Preserve non-bearer authorization values under the existing redaction path

• Named value preservation

  • Keep `****** unchanged so extracted policies continue to reference APIM named values correctly
  • Avoid treating named value references as inline secrets

• Regression coverage

  • Extend secret-redactor unit coverage for literal bearer tokens and named value-backed bearer headers
  • Update API policy extraction expectations to reflect the preserved Bearer prefix

const { redactedContent } = redactPolicySecrets(`
  <set-header name="Authorization">
    <value>******
  </set-header>
`);

// => <value>****** REDACTED ***</value>

[EMaher]

I don't see code to handle JWT Bearer tokens.

[petehauge]

Some comments sent in teams- thanks!