extract fails when a policy uses set-backend-service backend-id="{{namedValue}}" #331

Command that triggered the bug

apiops extract

Expected behavior

A policy that references a backend through a named value is valid in APIM:

<set-backend-service backend-id="{{demo-backend-id}}" />

extract should not treat the placeholder {{demo-backend-id}} as the name of a Backend resource. Extraction should finish with 0 errors and exit code 0 when every real resource exists.

Actual behavior

BACKEND_PATTERN in src/services/transitive-resolver.ts is:

const BACKEND_PATTERN = /<set-backend-service\s+backend-id="([^"]+)"/g;

It captures the raw attribute value including braces, so {{demo-backend-id}} is registered as a transitive dependency of type Backend with the literal name {{demo-backend-id}}. APIM has no such backend, so the GET 404s, the error counter is incremented, and the run exits 1:

[INFO] Resolving transitive dependencies for workspace "[ws name]"...
[INFO] Found 1 transitive dependencies to extract
[WARN] Transitive dependency backends/{{demo-backend-id}} was not found
[INFO] Workspace "[ws name]": extracted 32 resources, 1 errors
[INFO] Extraction complete: 33 resources extracted, 1 errors
Total: 33 resources extracted, 1 errors in 19.8s
##[error]Script failed with exit code: 1

The false error fails the pipeline step. The extracted files are written locally, but the pipeline stops before the "publish artifacts" task, so nothing is committed or published and no PR branch is created.

Since 1.0.5 (#319) the 404 is logged as a warning. Before that, the same case produced no log line at all, only the error count. The exit code 1 is unchanged.

Using the literal Backend name (backend-id="backend-xyz") instead of the named-value placeholder avoids the error. That workaround conflicts with our planned move to Backend entities referenced via named values, so this blocks our extract pipeline.

Observed in a workspace-scoped extract, but the code path is not workspace-specific: BACKEND_PATTERN/scanPolicyReferences and extractTransitiveDependencies are shared with the service-level extract in extract-service.ts, so I expect the same behavior at instance level (not tested).

Minimal repro:

1. Create a Backend backend-xyz and a Named Value demo-backend-id with value backend-xyz.
2. Add <set-backend-service backend-id="{{demo-backend-id}}" /> to an API policy in the extracted scope.
3. Run apiops extract with transitive resolution on (default).
4. Observe the false error and exit 1.

Likely the same problem for (from reading the regex, not tested):

• backend-id="@(...)" policy expressions (also not a literal Backend name).
• Commented-out <set-backend-service> elements — see Transitive dependency scan includes backend references inside XML comments #305.

Related: #276 / PR #290 (same bug class for Liquid {{ }} in NAMED_VALUE_PATTERN; leaves BACKEND_PATTERN untouched), #291 / PR #319 (named-value displayName 404s; added the "not found" warning)

apiops CLI version

1.0.5

Environment details

• Azure DevOps pipeline, Microsoft-hosted agent
• CLI installed from the v1.0.5 release tarball (@azure-tools/apiops-cli), run via npx apiops

CI/CD environment

Azure DevOps

Is this bug blocking you?

Yes