fix(segment): run asset discovery under -DryRun even for new groups

Dry-run previously short-circuited before subnet expansion/asset
discovery whenever the target group didn't exist yet, so it reported
zero information about what would actually happen. Discovery is
read-only (GET calls only), so it now always runs; only the group
membership check (which needs a real group ID) is skipped when the
group doesn't exist, with discovered assets still counted and
reported in that case.

Verified end-to-end against a real tenant: -DryRun -Server correctly
found the 2 expected server assets in 10.1.11.0/24.

Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>

Author: tjobarow

Segment/Segment/Asset Management/Create Custom Group from Asset Subnets/New-CustomGroupsFromSubnets.ps1

@@ -1181,10 +1181,16 @@ processing workflow and final summary reporting.
     .OUTPUTS
         Returns a PSCustomObject summarizing what happened for this group (for the final run summary).
     .NOTES
+        All read-only work (subnet expansion, asset discovery) always runs, even under -DryRun and even
+        when the target group does not exist yet - only mutating API calls (group creation, member
+        add/remove) are skipped under -DryRun. The one exception is the group membership check itself
+        (GET .../successors), which requires a real group ID and so cannot run against a group that
+        doesn't exist yet (Add mode, -DryRun) or doesn't exist at all (Remove mode) - in both cases,
+        discovered assets are still counted and reported, just without a membership diff.
         Always updates the local JSON record via Update-GroupRecordEntry, even when the group did not
         already exist and -DryRun prevented it from actually being created (record reflects a null groupId
         in that case, and is corrected on the next non-dry-run pass). In -RemoveAssets mode, a missing
-        group is skipped entirely - nothing is recorded, since there is no group to describe.
+        group is never recorded, since there is no group to describe.
     #>
 function Invoke-ProcessGroupSubnetMapping {
     param(
@@ -1209,38 +1215,37 @@ function Invoke-ProcessGroupSubnetMapping {
 
     if ($RemoveAssets) {
         $existingGroup = Get-CustomGroupByName -GroupName $GroupName
-        if ($null -eq $existingGroup) {
-            Write-Host "Group '$GroupName' does not exist - nothing to remove. Skipping."
-            return [PSCustomObject]@{
-                GroupName      = $GroupName
-                Subnet         = $Subnet
-                Mode           = "Remove"
-                AssetsFound    = 0
-                AssetsAffected = 0
-                AssetsSkipped  = 0
-            }
-        }
-        $GroupId = $existingGroup.id
+        $GroupId = if ($null -ne $existingGroup) { $existingGroup.id } else { $null }
     }
     else {
         $GroupId = New-CustomGroupIfMissing -GroupName $GroupName -Subnet $Subnet -DryRun:$DryRun
-
-        if ([string]::IsNullOrWhiteSpace($GroupId)) {
-            Write-Host "[DRY RUN] Skipping asset discovery/assignment for '$GroupName' - group does not exist yet and would only be created in a non-dry-run pass"
-            return [PSCustomObject]@{
-                GroupName      = $GroupName
-                Subnet         = $Subnet
-                Mode           = "Add"
-                AssetsFound    = 0
-                AssetsAffected = 0
-                AssetsSkipped  = 0
-            }
-        }
     }
+    $GroupExists = -not [string]::IsNullOrWhiteSpace($GroupId)
 
+    # Asset discovery is entirely read-only (GET calls only) - it always runs, regardless of -DryRun
+    # or whether the group exists yet, so a dry run reports real matching-asset counts.
     $HostAddresses = Get-SubnetHostAddresses -TargetSubnet $Subnet
     [System.Collections.ArrayList]$Assets = [System.Collections.ArrayList]@(Get-AssetsByHostAddresses -AssetSubnetHostAddresses $HostAddresses -MaxConcurrentBatches $MaxConcurrentBatches)
 
+    if (-not $GroupExists) {
+        # Membership can't be checked against a group that doesn't exist (Remove mode: not at all;
+        # Add mode: only reachable here under -DryRun, since a non-dry-run always creates the group).
+        if ($RemoveAssets) {
+            Write-Host "Group '$GroupName' does not exist - nothing to remove ($($Assets.Count) matching asset(s) found, but there is no group to check membership against). Skipping."
+        }
+        else {
+            Write-Host "[DRY RUN] Group '$GroupName' does not exist yet - would create it and add all $($Assets.Count) matching asset(s) to it (a new group has no existing members to skip)"
+        }
+        return [PSCustomObject]@{
+            GroupName      = $GroupName
+            Subnet         = $Subnet
+            Mode           = $RemoveAssets ? "Remove" : "Add"
+            AssetsFound    = $Assets.Count
+            AssetsAffected = $RemoveAssets ? 0 : $Assets.Count
+            AssetsSkipped  = 0
+        }
+    }
+
     if ($RemoveAssets) {
         $AssignResult = Remove-AssetsFromCustomGroup -GroupId $GroupId -Assets $Assets -DryRun:$DryRun
         Update-GroupRecordEntry -GroupName $GroupName -GroupId $GroupId -Subnet $Subnet -RemovedAssetIds @($AssignResult.Removed | ForEach-Object { $_.id })

Segment/Segment/Asset Management/Create Custom Group from Asset Subnets/README.md

@@ -170,11 +170,12 @@ Every run mirrors all console output to a timestamped log file at `logs\New-Cust
 
 ## Dry Run Mode
 
-Use the `-DryRun` switch to preview what changes would be made without actually applying them:
+Use the `-DryRun` switch to preview what changes would be made without actually applying them. All read-only work still runs - group existence checks, subnet expansion, and asset discovery are never skipped, so the reported `AssetsFound`/`AssetsAffected` counts are always real:
 
 - Group existence is still checked, but missing groups are **not** created
-- Matching assets are still discovered and checked against current group membership
-- The request body that would be sent to add members is displayed, but no mutating API calls are made
+- Matching assets are still discovered regardless of whether the group exists yet
+- If the group already exists, current membership is still checked (read-only) and the request body that would be sent to add/remove members is displayed, but no mutating API calls are made
+- If the group doesn't exist yet (Add mode) or doesn't exist at all (Remove mode), membership can't be checked against it - discovered assets are still counted and reported, just without a per-asset membership diff (Add mode assumes all of them would be added, since a new group has no existing members to skip)
 - The local JSON record is still updated for groups that already exist, but not for groups that would only be created in a non-dry-run pass
 
 ## Notes