mgmt, generate-test skip JSON that fails CredScan in CI

[XiaofeiCao]

Azure/azure-sdk-for-java#31007 (comment)

CI failure: https://dev.azure.com/azure-sdk/public/_build/results?buildId=1857734&view=logs&j=bc67675d-56bf-581f-e0a2-208848ba68ca&t=7eee3a58-6120-518b-7fcb-7e943712aa81

[XiaofeiCao]

Suppression doesn't work, as it doesn't support wildcards.
https://secdevtools.azurewebsites.net/helpcredscan.html

[weidongxu-microsoft]

This one is apiKey.

Do you have other name that get flagged by CredScan?

[weidongxu-microsoft]

another storageAccountPrimaryKey.

[XiaofeiCao]

From our CredScanSuppression.json, I got OAuth2ClientCredential.

[weidongxu-microsoft]

From our CredScanSuppression.json, I got OAuth2ClientCredential.

This is different thing. It is code from swagger, not tests. So it has to get to suppression else that RP just not correct.

We don't bother add tests to suppression. Easier to just delete the test.

[XiaofeiCao]

Found the source code and a seemingly exhaustive config list:
https://msazure.visualstudio.com/One/_git/e4f88693-d8b9-42a6-bd57-99bce573e20c?path=/src/CredScan.MCEScanner/Configuration/config.xml

I think we can use the regex that contains CSCAN-AZURE0120_Code (I assume it's used for scanning code)?

[XiaofeiCao]

Not sure if this is in use...
<Regex id="Regex_Ranker_CSCAN-AZURE0130_1dd3f4ad-9d76-4b5f-9f89-20ca2c45184f_339559_CEP2.0">(?i)(SharedAccess(Policy)?|SAS|Primary|Secondary)Key\W|SharedAccessSignature\W|SharedKey\W</Regex>

Seems it is...

##[error]1. Credential Scanner Error CSCAN-GENERAL0130

[weidongxu-microsoft]

That one is likely too complicated.

Maybe we just skip either the test or the property if it has property which name contains "key" or "credential".

[weidongxu-microsoft]

May need to handle sample as well.
Azure/azure-sdk-for-java#31685

Can replace it with "fakeTokenPlaceholder"