updating devops pipeline

Author: EMaher

src/services/identity-guide-service.ts

@@ -297,7 +297,9 @@ fi
 
 ---
 
-## Step 2: Create Managed Identity
+## Step 2: Create Managed Identity and Assign RBAC Roles
+
+### Create the Managed Identity
 
 **PowerShell:**
 \`\`\`powershell
@@ -309,13 +311,6 @@ $TENANT_ID = az account show --query tenantId -o tsv
 Write-Host "Managed Identity Client ID: $MI_CLIENT_ID"
 Write-Host "Managed Identity Principal ID: $MI_PRINCIPAL_ID"
 Write-Host "Tenant ID: $TENANT_ID"
-
-# Assign API Management Service Contributor role for each environment's resource group
-foreach ($env in $ENVIRONMENTS) {
-    $envUpper = $env.ToUpper()
-    $apimRg = Get-Variable -Name "APIM_RG_$envUpper" -ValueOnly
-    az role assignment create --assignee-object-id $MI_PRINCIPAL_ID --assignee-principal-type ServicePrincipal --role "API Management Service Contributor" --scope "/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$apimRg"
-}
 \`\`\`
 
 **Git Bash:**
@@ -328,16 +323,102 @@ TENANT_ID=$(az account show --query tenantId -o tsv)
 echo "Managed Identity Client ID: $MI_CLIENT_ID"
 echo "Managed Identity Principal ID: $MI_PRINCIPAL_ID"
 echo "Tenant ID: $TENANT_ID"
+\`\`\`
+
+---
+
+### Assign RBAC Roles to the Managed Identity
+
+> **Important:** The managed identity needs appropriate RBAC roles to access APIM resources:
+> - **API Management Service Reader Role** — Required for the **extract** pipeline to read APIM configurations (APIs, policies, backends, tags, etc.)
+> - **API Management Service Contributor** — Required for the **publish** pipeline to create/update APIM resources
+>
+> For security best practice, assign roles at the **APIM service scope** (not the resource group) to follow the principle of least privilege.
+
+**PowerShell:**
+\`\`\`powershell
+# Assign RBAC roles for each environment's APIM instance
+foreach ($env in $ENVIRONMENTS) {
+    $envUpper = $env.ToUpper()
+    $apimInstanceId = Get-Variable -Name "APIM_INSTANCE_$envUpper" -ValueOnly
+    
+    Write-Host "Assigning roles for $env environment (APIM: $apimInstanceId)"
+    
+    # API Management Service Reader Role (for extract pipeline)
+    az role assignment create \`
+        --assignee-object-id $MI_PRINCIPAL_ID \`
+        --assignee-principal-type ServicePrincipal \`
+        --role "API Management Service Reader Role" \`
+        --scope $apimInstanceId
+    
+    # API Management Service Contributor (for publish pipeline)
+    az role assignment create \`
+        --assignee-object-id $MI_PRINCIPAL_ID \`
+        --assignee-principal-type ServicePrincipal \`
+        --role "API Management Service Contributor" \`
+        --scope $apimInstanceId
+}
+
+Write-Host "\`nℹ️  Note: RBAC role assignments can take 5-10 minutes to propagate."
+\`\`\`
 
-# Assign API Management Service Contributor role for each environment's resource group
+**Git Bash:**
+\`\`\`bash
+# Assign RBAC roles for each environment's APIM instance
 for env in "\${ENVIRONMENTS[@]}"; do
     env_upper=$(echo "$env" | tr '[:lower:]' '[:upper:]')
-    apim_rg_var="APIM_RG_\${env_upper}"
-    apim_rg="\${!apim_rg_var}"
-    az role assignment create --assignee-object-id "$MI_PRINCIPAL_ID" --assignee-principal-type ServicePrincipal --role "API Management Service Contributor" --scope "/subscriptions/$SUBSCRIPTION_ID/resourceGroups/$apim_rg"
+    apim_instance_var="APIM_INSTANCE_\${env_upper}"
+    apim_instance_id="\${!apim_instance_var}"
+    
+    echo "Assigning roles for $env environment (APIM: $apim_instance_id)"
+    
+    # API Management Service Reader Role (for extract pipeline)
+    az role assignment create \\
+        --assignee-object-id "$MI_PRINCIPAL_ID" \\
+        --assignee-principal-type ServicePrincipal \\
+        --role "API Management Service Reader Role" \\
+        --scope "$apim_instance_id"
+    
+    # API Management Service Contributor (for publish pipeline)
+    az role assignment create \\
+        --assignee-object-id "$MI_PRINCIPAL_ID" \\
+        --assignee-principal-type ServicePrincipal \\
+        --role "API Management Service Contributor" \\
+        --scope "$apim_instance_id"
 done
+
+echo ""
+echo "ℹ️  Note: RBAC role assignments can take 5-10 minutes to propagate."
 \`\`\`
 
+### Verify Role Assignments
+
+Verify the roles were assigned correctly:
+
+**PowerShell:**
+\`\`\`powershell
+foreach ($env in $ENVIRONMENTS) {
+    $envUpper = $env.ToUpper()
+    $apimInstanceId = Get-Variable -Name "APIM_INSTANCE_$envUpper" -ValueOnly
+    Write-Host "\`nRole assignments for $env environment:"
+    az role assignment list --assignee $MI_PRINCIPAL_ID --scope $apimInstanceId --query "[].{Role:roleDefinitionName, Scope:scope}" -o table
+}
+\`\`\`
+
+**Git Bash:**
+\`\`\`bash
+for env in "\${ENVIRONMENTS[@]}"; do
+    env_upper=$(echo "$env" | tr '[:lower:]' '[:upper:]')
+    apim_instance_var="APIM_INSTANCE_\${env_upper}"
+    apim_instance_id="\${!apim_instance_var}"
+    echo ""
+    echo "Role assignments for $env environment:"
+    az role assignment list --assignee "$MI_PRINCIPAL_ID" --scope "$apim_instance_id" --query "[].{Role:roleDefinitionName, Scope:scope}" -o table
+done
+\`\`\`
+
+> **Expected Output:** You should see both "API Management Service Reader Role" and "API Management Service Contributor" roles listed for each environment.
+
 ---
 
 ## Step 3: Configure Azure DevOps CLI
@@ -524,7 +605,7 @@ az pipelines variable-group create \`
     --name "apim-common" \`
     --project $AZDO_PROJECT \`
     --organization $AZDO_ORG \`
-    --variables AZURE_SUBSCRIPTION_ID=$SUBSCRIPTION_ID AZURE_SERVICE_CONNECTION="AZURE_SERVICE_CONNECTION"
+    --variables AZURE_SUBSCRIPTION_ID=$SUBSCRIPTION_ID APIOPS_CLI_VERSION="latest"
 \`\`\`
 
 **Git Bash:**
@@ -533,7 +614,7 @@ az pipelines variable-group create \\
     --name "apim-common" \\
     --project "$AZDO_PROJECT" \\
     --organization "$AZDO_ORG" \\
-    --variables AZURE_SUBSCRIPTION_ID="$SUBSCRIPTION_ID" AZURE_SERVICE_CONNECTION="AZURE_SERVICE_CONNECTION"
+    --variables AZURE_SUBSCRIPTION_ID="$SUBSCRIPTION_ID" APIOPS_CLI_VERSION="latest"
 \`\`\`
 
 Create environment-specific variable groups using values extracted from APIM instance IDs:
@@ -549,7 +630,7 @@ foreach ($env in $ENVIRONMENTS) {
         --name "apim-$env" \`
         --project $AZDO_PROJECT \`
         --organization $AZDO_ORG \`
-        --variables APIM_RESOURCE_GROUP=$apimRg APIM_SERVICE_NAME=$apimName AZURE_SUBSCRIPTION_ID=$SUBSCRIPTION_ID AZURE_SERVICE_CONNECTION="AZURE_SERVICE_CONNECTION_$envUpper"
+        --variables APIM_RESOURCE_GROUP=$apimRg APIM_SERVICE_NAME=$apimName AZURE_SUBSCRIPTION_ID=$SUBSCRIPTION_ID
 }
 \`\`\`
 
@@ -566,7 +647,7 @@ for env in "\${ENVIRONMENTS[@]}"; do
         --name "apim-$env" \\
         --project "$AZDO_PROJECT" \\
         --organization "$AZDO_ORG" \\
-        --variables APIM_RESOURCE_GROUP="$apim_rg" APIM_SERVICE_NAME="$apim_name" AZURE_SUBSCRIPTION_ID="$SUBSCRIPTION_ID" AZURE_SERVICE_CONNECTION="AZURE_SERVICE_CONNECTION_$env_upper"
+        --variables APIM_RESOURCE_GROUP="$apim_rg" APIM_SERVICE_NAME="$apim_name" AZURE_SUBSCRIPTION_ID="$SUBSCRIPTION_ID"
 done
 \`\`\`
 

src/services/init-service.ts

@@ -348,6 +348,7 @@ class InitServiceImpl implements InitService {
     // Extract pipeline
     const extractPipelineConfig: ExtractPipelineConfig = {
       artifactDir: config.artifactDir,
+      environments: config.environments,
     };
     const extractContent = generateExtractPipeline(extractPipelineConfig);
     const extractPath = path.join(pipelinesDir, 'run-apim-extractor.yml');

src/templates/azure-devops/extract-pipeline.ts

@@ -5,73 +5,89 @@
 
 export interface ExtractPipelineConfig {
   artifactDir: string;
+  environments: string[];
 }
 
 export function generateExtractPipeline(config: ExtractPipelineConfig): string {
+  const envValues = config.environments.map((env) => `      - '${env}'`).join('\n');
+
   return `# Azure DevOps Pipeline: Run APIM Extractor
 
 trigger: none
 
 parameters:
+  - name: ENVIRONMENT
+    type: string
+    displayName: 'Choose which environment to extract from'
+    default: '${config.environments[0]}'
+    values:
+${envValues}
   - name: CONFIGURATION_YAML_PATH
     type: string
     displayName: 'Choose whether to extract all APIs or use the extraction configuration file'
     default: 'Extract All APIs'
     values:
       - 'Extract All APIs'
       - 'configuration.extract.yaml'
-  - name: resourceGroup
-    type: string
-    displayName: 'Azure Resource Group'
-    default: $(APIM_RESOURCE_GROUP)
-  - name: serviceName
-    type: string
-    displayName: 'APIM Service Name'
-    default: $(APIM_SERVICE_NAME)
 
 pool:
   vmImage: 'ubuntu-latest'
 
 variables:
   - group: apim-common
+  - \${{ if eq(parameters.ENVIRONMENT, '${config.environments[0]}') }}:
+    - group: apim-${config.environments[0]}
+${config.environments.slice(1).map(env => `  - \${{ if eq(parameters.ENVIRONMENT, '${env}') }}:
+    - group: apim-${env}`).join('\n')}
 
 steps:
-  - task: NodeTool@0
+  - task: UseNode@1
     displayName: 'Setup Node.js'
     inputs:
-      versionSpec: '22.x'
+      version: '22.x'
 
-  - script: npm ci
+  - script: |
+      az extension add --name azure-devops --upgrade
+      az devops configure --defaults organization=$(System.TeamFoundationCollectionUri) project=$(System.TeamProject)
+    displayName: 'Install Azure DevOps CLI extension'
+    env:
+      AZURE_DEVOPS_EXT_PAT: $(System.AccessToken)
+
+  - script: npm install @peterhauge/apiops-cli@$(APIOPS_CLI_VERSION)
     displayName: 'Install dependencies'
 
   - task: AzureCLI@2
     displayName: 'Run APIM Extract (All APIs)'
     condition: eq('\${{ parameters.CONFIGURATION_YAML_PATH }}', 'Extract All APIs')
     inputs:
-      azureSubscription: '$(AZURE_SERVICE_CONNECTION)'
+      azureSubscription: 'AZURE_SERVICE_CONNECTION_\${{ upper(parameters.ENVIRONMENT) }}'
       scriptType: 'bash'
       scriptLocation: 'inlineScript'
+      addSpnToEnvironment: true
+      workingDirectory: '$(Build.SourcesDirectory)'
       inlineScript: |
         npx apiops extract \\
-          --resource-group \${{ parameters.resourceGroup }} \\
-          --service-name \${{ parameters.serviceName }} \\
-          --output ${config.artifactDir} \\
-          --subscription-id $(AZURE_SUBSCRIPTION_ID)
+          --resource-group "$(APIM_RESOURCE_GROUP)" \\
+          --service-name "$(APIM_SERVICE_NAME)" \\
+          --output $(Build.SourcesDirectory)/${config.artifactDir} \\
+          --subscription-id "$(AZURE_SUBSCRIPTION_ID)"
 
   - task: AzureCLI@2
     displayName: 'Run APIM Extract (With Configuration)'
     condition: ne('\${{ parameters.CONFIGURATION_YAML_PATH }}', 'Extract All APIs')
     inputs:
-      azureSubscription: '$(AZURE_SERVICE_CONNECTION)'
+      azureSubscription: 'AZURE_SERVICE_CONNECTION_\${{ upper(parameters.ENVIRONMENT) }}'
       scriptType: 'bash'
       scriptLocation: 'inlineScript'
+      addSpnToEnvironment: true
+      workingDirectory: '$(Build.SourcesDirectory)'
       inlineScript: |
         npx apiops extract \\
-          --resource-group \${{ parameters.resourceGroup }} \\
-          --service-name \${{ parameters.serviceName }} \\
-          --output ${config.artifactDir} \\
-          --filter configuration.extract.yaml \\
-          --subscription-id $(AZURE_SUBSCRIPTION_ID)
+          --resource-group "$(APIM_RESOURCE_GROUP)" \\
+          --service-name "$(APIM_SERVICE_NAME)" \\
+          --output $(Build.SourcesDirectory)/${config.artifactDir} \\
+          --filter $(Build.SourcesDirectory)/configuration.extract.yaml \\
+          --subscription-id "$(AZURE_SUBSCRIPTION_ID)"
 
   - task: PublishPipelineArtifact@1
     displayName: 'Publish artifacts'
@@ -80,20 +96,62 @@ steps:
       artifactName: apim-artifacts
 
   - script: |
-      BRANCH_NAME="apim-extract-$(Build.BuildId)"
+      BRANCH_NAME="apim-extract-\${{ parameters.ENVIRONMENT }}-$(Build.BuildId)"
+      
+      # Configure git authentication using System.AccessToken
       git config user.name "Azure DevOps"
       git config user.email "azuredevops@microsoft.com"
+      git config --global http.extraheader "AUTHORIZATION: bearer $SYSTEM_ACCESSTOKEN"
+      
+      # Create and commit changes
       git checkout -b "$BRANCH_NAME"
       git add ${config.artifactDir}
+      
       if git diff --cached --quiet; then
         echo "No changes to commit"
+        echo "##vso[task.setvariable variable=HAS_CHANGES]false"
       else
-        git commit -m "chore: update APIM artifacts from extract"
+        git commit -m "chore: update APIM artifacts from \${{ parameters.ENVIRONMENT }} extract"
         git push origin "$BRANCH_NAME"
-        echo "##vso[task.logissue type=warning]Branch '$BRANCH_NAME' pushed. Please create a pull request to merge the changes."
+        echo "##vso[task.setvariable variable=HAS_CHANGES]true"
+        echo "##vso[task.setvariable variable=BRANCH_NAME]$BRANCH_NAME"
+        echo "Branch '$BRANCH_NAME' created and pushed successfully"
       fi
     displayName: 'Create branch with changes'
     env:
       SYSTEM_ACCESSTOKEN: $(System.AccessToken)
+
+  - task: PowerShell@2
+    displayName: 'Create pull request'
+    condition: and(succeeded(), eq(variables['HAS_CHANGES'], 'true'))
+    env:
+      AZURE_DEVOPS_EXT_PAT: $(System.AccessToken)
+    inputs:
+      targetType: 'inline'
+      pwsh: true
+      script: |
+        $branchName = "$(BRANCH_NAME)"
+        $title = "chore: APIM \${{ parameters.ENVIRONMENT }} extract (Build $(Build.BuildId))"
+        $description = "Automated extraction of APIM artifacts from **\${{ parameters.ENVIRONMENT }}** environment.\`n\`nBuild: [$(Build.BuildId)]($(System.TeamFoundationCollectionUri)$(System.TeamProject)/_build/results?buildId=$(Build.BuildId))"
+        
+        Write-Host "Creating pull request from branch: $branchName"
+        
+        az repos pr create \`
+          --organization "$(System.TeamFoundationCollectionUri)" \`
+          --project "$(System.TeamProject)" \`
+          --repository "$(Build.Repository.Name)" \`
+          --source-branch "$branchName" \`
+          --target-branch "$(Build.SourceBranchName)" \`
+          --title "$title" \`
+          --description "$description" \`
+          --auto-complete false \`
+          --output table
+        
+        if ($LASTEXITCODE -eq 0) {
+          Write-Host "##[section]✅ Pull request created successfully"
+        } else {
+          Write-Host "##[error]Failed to create pull request"
+          exit 1
+        }
 `;
 }