apiops init: generate a Copilot prompt file to audit artifacts against APIM best practices #202

Problem or use case

After apiops extract, users have no guided way to check their extracted APIM artifacts against APIM best practices. The audit should look for anti-patterns (e.g. named values holding secrets that aren''t marked secret) that otherwise go unnoticed. We want a low-friction, Copilot-assisted audit that also offers to fix the issues it finds.

Proposed solution

Have apiops init generate an additional Copilot prompt file — e.g. .github/prompts/apiops-check-best-practices.prompt.md — following the same generation pattern as the existing identity-setup prompt (src/templates/copilot/identity-setup-prompt.ts, written in src/services/init-service.ts). When opened with GitHub Copilot, the prompt guides the user through auditing the artifacts in the repo against a focused set of APIM best practices.

Scope — only things apiops-cli tracks

Keep the checks centered on apiops-managed artifacts (policies, named values, backends, diagnostics/loggers, subscriptions, products). Explicitly out of scope: infra/SKU/networking/scale guidance from the WAF doc that doesn''t map to apiops artifacts.

Checks (initial set)

1. Hardcoded secrets in policy.xml (headline check) — detect literal secrets in policy XML (set-header auth/keys, set-query-parameter code/sig, authentication-basic password, validate-jwt keys, connection-string fragments).
   • Offer to fix: create a (secret) named value for the secret and rewrite the policy to reference it via {{named-value}}, per https://learn.microsoft.com/en-us/azure/api-management/api-management-howto-properties
2. Named values holding secrets that aren''t marked secret: true or aren''t Key Vault–backed → flag and offer to mark/migrate.
3. Backend URLs / keys inlined in policies instead of using named values/backends → suggest parameterizing.

(Start with check #1; #2–#3 can follow.)

Reference

APIM best-practice guidance: https://learn.microsoft.com/en-us/azure/well-architected/service-guides/azure-api-management — used as a source, but the prompt should distill only the artifact-level items above rather than the full large-deployment guidance.

Affected command

apiops init (generates the prompt file); the prompt itself assists with apiops extract output.

Implementation notes

• New template under src/templates/copilot/ (e.g. best-practices-prompt.ts) + embedded markdown, mirroring identity-setup-prompt.ts.
• Write the file in init-service.ts alongside the identity prompt (conflict-check + add to generatedFiles.configs), and mention it in the init-command.ts next-steps output.
• Relates to Secrets hardcoded in policy XML are not redacted on extract #198 (the CLI-side redact-and-warn for the same class of issue; this prompt is the interactive remediation counterpart).