apiops init: generate a Copilot prompt file to audit artifacts against APIM best practices

Bắt đầu với src/templates/copilot/identity-setup-prompt.ts và src/services/init-service.ts để theo dõi mẫu tạo prompt hiện có. Sau đó kiểm tra src/commands/init-command.ts để xem output của các bước tiếp theo và cách xử lý generatedFiles.configs. Công việc được xem là hoàn tất khi apiops init tạo prompt mới cùng với identity prompt, đồng thời focused artifact audit bắt đầu bằng việc tìm các secrets hardcoded trong policy.xml và đưa ra phương án khắc phục.

Problem or use case

After apiops extract, users have no guided way to check their extracted APIM artifacts against APIM best practices. The audit should look for anti-patterns (e.g. named values holding secrets that aren''t marked secret) that otherwise go unnoticed. We want a low-friction, Copilot-assisted audit that also offers to fix the issues it finds.

Proposed solution

Have apiops init generate an additional Copilot prompt file — e.g. .github/prompts/apiops-check-best-practices.prompt.md — following the same generation pattern as the existing identity-setup prompt (src/templates/copilot/identity-setup-prompt.ts, written in src/services/init-service.ts). When opened with GitHub Copilot, the prompt guides the user through auditing the artifacts in the repo against a focused set of APIM best practices.

Scope — only things apiops-cli tracks

Keep the checks centered on apiops-managed artifacts (policies, named values, backends, diagnostics/loggers, subscriptions, products). Explicitly out of scope: infra/SKU/networking/scale guidance from the WAF doc that doesn''t map to apiops artifacts.

Checks (initial set)

1. Hardcoded secrets in policy.xml (headline check) — detect literal secrets in policy XML (set-header auth/keys, set-query-parameter code/sig, authentication-basic password, validate-jwt keys, connection-string fragments).
   • Offer to fix: create a (secret) named value for the secret and rewrite the policy to reference it via {{named-value}}, per https://learn.microsoft.com/en-us/azure/api-management/api-management-howto-properties
2. Named values holding secrets that aren''t marked secret: true or aren''t Key Vault–backed → flag and offer to mark/migrate.
3. Backend URLs / keys inlined in policies instead of using named values/backends → suggest parameterizing.

(Start with check #1; #2–#3 can follow.)

Reference

APIM best-practice guidance: https://learn.microsoft.com/en-us/azure/well-architected/service-guides/azure-api-management — used as a source, but the prompt should distill only the artifact-level items above rather than the full large-deployment guidance.

Affected command

apiops init (generates the prompt file); the prompt itself assists with apiops extract output.

Implementation notes

• New template under src/templates/copilot/ (e.g. best-practices-prompt.ts) + embedded markdown, mirroring identity-setup-prompt.ts.
• Write the file in init-service.ts alongside the identity prompt (conflict-check + add to generatedFiles.configs), and mention it in the init-command.ts next-steps output.
• Relates to #198 (the CLI-side redact-and-warn for the same class of issue; this prompt is the interactive remediation counterpart).