publish --delete-unmatched (full publish) does not remove child resources, and does not protect the built-in master subscription #342

Summary

With apiops-cli 1.0.5, a full apiops publish --delete-unmatched (no --commit-id) only reconciles top-level resources (and managed-gateway API assignments). Child resources that exist in APIM but not in the artifact folder are never deleted. Separately, the built-in master subscription is not treated as a system resource, so it is deleted when its file is absent.

1. Child resources are not reconciled

Steps to reproduce

1. Publish an artifact folder that contains an API with an API-level policy (apis/<api>/policy.xml) and a product with an API link (products/<p>/apis.json).
2. Remove apis/<api>/policy.xml and the API from products/<p>/apis.json.
3. Run apiops publish --delete-unmatched --dry-run, then without --dry-run.

Expected

The API policy and the product–API link are listed as DELETE and removed, so APIM matches the artifact folder (as with top-level resources).

Actual

No DELETE actions are produced for them; both remain in APIM.

Analysis

computeDeleteActions (services/delete-unmatched-service.js) lists deployed resources per resource type via listResources. For child types (ApiPolicy, ApiOperationPolicy, ProductPolicy, ApiDiagnostic, ApiSchema, ProductApi, ProductGroup, ApiTagDescription, …) the list path needs a parent, so the call throws and the error is swallowed; those types are silently skipped. Incremental mode (--commit-id) does delete children whose files were removed in that commit, but full publish – the mode needed to redeploy an older revision (rollback) – does not.

Impact

• Removing a policy/diagnostic/link from Git has no effect in APIM.
• Redeploying an older revision leaves child resources that were added later.
• The dry-run gives no indication of this.

Suggestion

For each deployed parent (API, product, operation, …), enumerate its children and compare them with the artifact folder; at minimum, warn in the dry-run/publish output that child resources are not reconciled.

2. master subscription is not protected

isSystemResource covers the built-in products/APIs (starter, unlimited, echo-api, …) and built-in groups, but not the built-in master subscription (scope /). Publish already skips root-scoped subscriptions, but with --delete-unmatched the master subscription is listed as DELETE when subscriptions/master is not present in the artifact folder. Expected: treat it as a system resource, like the other built-ins.

Environment

• @azure-tools/apiops-cli 1.0.5, Node.js 22, GitHub Actions (ubuntu-latest) and Windows.

Possibly related: #142, #169.