A Friday AI Prompt Epiphany

# Configuration
$organization = "<ORG>"
$project = "<AzDO PROJECT>"
$queryId = "<QUERY ID>"
$parentWorkItemId = "<PARENT WORK ITEM ID>"
$baseUrl = "https://dev.azure.com/$organization/$project"

# Get PAT from environment or prompt
$pat = $env:AZURE_DEVOPS_PAT
if (-not $pat) {
    $pat = Read-Host -Prompt "Enter your Azure DevOps PAT" -AsSecureString
    $pat = [Runtime.InteropServices.Marshal]::PtrToStringAuto(
        [Runtime.InteropServices.Marshal]::SecureStringToBSTR($pat)
    )
}

$base64Auth = [Convert]::ToBase64String([Text.Encoding]::ASCII.GetBytes(":$pat"))
$headers = @{
    Authorization  = "Basic $base64Auth"
    "Content-Type" = "application/json"
}

# Execute the query to get work item IDs
Write-Host "Fetching work items from query..."
$queryUrl = "https://dev.azure.com/$organization/$project/_apis/wit/wiql/$queryId`?api-version=7.1"
$queryResult = Invoke-RestMethod -Uri $queryUrl -Headers $headers -Method Get

$workItemIds = $queryResult.workItems | Select-Object -ExpandProperty id

if (-not $workItemIds) {
    Write-Host "No work items found in query."
    exit
}

Write-Host "Found $($workItemIds.Count) work item(s): $($workItemIds -join ', ')"

# Get the URL of the parent work item
$parentUrl = "https://dev.azure.com/$organization/_apis/wit/workItems/$parentWorkItemId"

# Add parent link to each work item
foreach ($id in $workItemIds) {
    Write-Host "Processing work item $id..."

    # Check existing relations to avoid duplicate parent
    $wiUrl = "https://dev.azure.com/$organization/$project/_apis/wit/workItems/$id`?`$expand=relations&api-version=7.1"
    $wi = Invoke-RestMethod -Uri $wiUrl -Headers $headers -Method Get

    $existingParent = $wi.relations | Where-Object { $_.rel -eq "System.LinkTypes.Hierarchy-Reverse" }
    if ($existingParent) {
        Write-Host "  Work item $id already has a parent. Skipping."
        continue
    }

    $patchUrl = "https://dev.azure.com/$organization/$project/_apis/wit/workItems/$id`?api-version=7.1"
    $patchHeaders = $headers.Clone()
    $patchHeaders["Content-Type"] = "application/json-patch+json"

    $body = ConvertTo-Json -InputObject @(
        @{
            op    = "add"
            path  = "/relations/-"
            value = @{
                rel        = "System.LinkTypes.Hierarchy-Reverse"
                url        = $parentUrl
                attributes = @{ comment = "Parent set by automation script" }
            }
        }
    ) -Depth 5

    try {
        Invoke-RestMethod -Uri $patchUrl -Headers $patchHeaders -Method Patch -Body $body | Out-Null
        Write-Host "  Successfully set parent for work item $id."
    }
    catch {
        Write-Warning "  Failed to update work item $id`: $_"
    }
}

Write-Host "Done."

# Prompt: Securely parent work items from an Azure DevOps query

## Goal
Parent all work items returned by Azure DevOps query <URL> to portfolio parent work item <PARENT_ID>.

## Guardrails (non-negotiable)
- Do not expose secrets. Use a Personal Access Token (PAT) from a secure source (environment variable or secret store), never hard-code it.
- Use least privilege: token must have only the Work Items permissions required.
- Do not modify unrelated work items.
- If a work item already has a parent, do not overwrite unless explicitly instructed.
- Log actions and produce a summary of changes.

## Steps
1. Retrieve work item IDs from the query.
2. For each work item:
   - Fetch existing relations.
   - If a parent exists, skip (or re-parent only if instructed).
   - Add the parent relation to <PARENT_ID>.
3. Validate:
   - Re-fetch each updated work item and confirm the parent relation exists.
   - Produce a report: updated, skipped (already parented), failed (with reason).

## Output
- Implementation approach recommendation (best option and why).
- A safe script or command sequence (PowerShell or Azure DevOps CLI).
- A validation report format (markdown table or JSON).