[Alexander Zaslonov (azaslonov)]

Summary

Publish skipped every product-scoped subscription with a 24-character hex name ("auto-generated product subscription"). Because of that, environment overrides such as primaryKey / secondaryKey could never be applied to these subscriptions. Legacy APIOps supports this, and existing customers depend on it.

This PR switches to the legacy APIOps behavior (PutProductInApim in Azure/apiops src/common/Product.cs):

• New products: when publish creates a product that did not exist in the target, it deletes the subscriptions APIM auto-created for that product, alongside the existing auto-created product-group cleanup. This keeps subscriptionsLimit from being exceeded once the extracted subscriptions are published.
• Product subscriptions: 24-hex product subscriptions are no longer skipped. They are published normally, and subscriptions: overrides are applied. The built-in master and other service-scoped subscriptions are still skipped.

Changes

• src/services/product-publisher.ts: new cleanupProductSubscriptions. It lists subscriptions in the product's service or workspace scope and deletes the ones scoped to /products/<deployed product name>. It runs only when the product was newly created; a failed delete logs a warning and does not fail the publish.
• src/services/resource-publisher.ts: removed the isAutoGeneratedProductSubscription eligibility check.
• docs/guides/environment-overrides.md: updated the subscriptions note.
• Tests:
  • 24-hex product subscriptions are published, and key overrides reach the PUT payload.
  • For a new product, only that product's subscriptions are deleted (not those of other products or APIs with the same name).
  • The workspace-scoped case is covered.
  • A failed delete does not fail the publish.
  • No cleanup runs for an existing product.

Behavior notes

• Products that already exist in the target are not cleaned up. Extracted 24-hex subscriptions are PUT alongside the existing ones, which matches legacy APIOps.

Validation

• npm test: 60 files, 1514 tests passed
• npm run lint: clean
• Not yet run against a live APIM instance

Code review

Changes touch src/ and tests/, so a CodeReviewer pass per .squad/ceremonies.md is requested.

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

Review effort: Lite
Findings: 4 · 1

Open (5)

• The scope comparison uses the raw productName but APIM resource IDs/scopes are URL paths where… · New
• The scope comparison uses the raw productName but APIM resource IDs/scopes are URL paths where… · New
• The scope comparison uses the raw productName but APIM resource IDs/scopes are URL paths where… · New
• This cleanup enumerates all subscriptions in the service/workspace and filters client-side. In… · New
• The implementation treats deletion as best-effort (logs a warning and continues on failure).… · New

What changed in this PR

Aligns subscription publishing behavior with legacy APIOps by publishing previously-skipped 24-hex product subscriptions and cleaning up APIM auto-created product subscriptions when a product is newly created, enabling environment key overrides to apply.

Changes:

• Remove eligibility skip for 24-hex product-scoped subscriptions so they publish normally and accept overrides.
• Add cleanup step to delete APIM auto-created subscriptions for newly created products (service or workspace scope).
• Update docs and unit tests to cover publishing + overrides, cleanup behavior, workspace scope, and delete-failure tolerance.

File	Description
tests/​unit/​services/​resource-publisher.test.ts	Updates tests to confirm 24-hex product subscriptions publish and overrides flow into PUT payload.
tests/​unit/​services/​product-publisher.test.ts	Adds tests ensuring auto-created product subscriptions are deleted only for newly created products (including workspace scope) and failures don’t break publish.
src/​services/​resource-publisher.ts	Removes auto-generated product subscription eligibility skip logic.
src/​services/​product-publisher.ts	Introduces cleanupProductSubscriptions invoked for newly created products to delete auto-created subscriptions.
docs/​guides/​environment-overrides.md	Updates guidance to reflect new behavior and key override support for 24-hex product subscriptions.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Warning

Copilot couldn't run its full agentic review because it didn't start before the timeout. Make sure your repository has a runner available, or add a copilot-code-review.yml file specifying one with the runs-on attribute. See the docs for more details.

Copilot review overview

Review effort: Lite
Findings: 7 · 2

Open (9)

• This lists all subscriptions in the service/workspace and filters client-side. In large APIM… · New
• Cleanup currently deletes any subscription whose scope ends with the product name. If another… · New
• This test is intended to validate that cleanup failures don’t fail the publish, but it doesn’t… · New
• This cleanup enumerates all subscriptions in the service/workspace and filters client-side. In…
• The scope comparison uses the raw productName but APIM resource IDs/scopes are URL paths where…
• The scope comparison uses the raw productName but APIM resource IDs/scopes are URL paths where…
• The scope comparison uses the raw productName but APIM resource IDs/scopes are URL paths where…
• Logging String(error) often drops useful diagnostics (stack trace, structured fields). If the… · New
• The implementation treats deletion as best-effort (logs a warning and continues on failure).…