{CI} Add azdev scan check in PR's CI

azure-pipelines.yml

@@ -1095,6 +1095,34 @@ jobs:
         azdev linter --ci-exclusions --min-severity medium
       fi
 
+- job: AzdevScan
+  condition: and(succeeded(), eq(variables['Build.Reason'], 'PullRequest'))
+  displayName: "Secret Scan"
+  pool:
+    name: ${{ variables.ubuntu_pool }}
+  steps:
+    - task: UsePythonVersion@0
+      displayName: 'Use Python 3.11'
+      inputs:
+        versionSpec: 3.11
+    - template: .azure-pipelines/templates/azdev_setup.yml
+    - bash: |
+        set -ev
+        . env/bin/activate
+        git fetch origin --depth=1 $(System.PullRequest.TargetBranch)
+        declare -A secret_files
+        for FILE in `git diff --name-only --diff-filter=AM origin/$(System.PullRequest.TargetBranch)` ; do
+          detected=$(azdev scan -f $FILE | python -c "import sys, json; print(json.load(sys.stdin)['secrets_detected'])")
+          if [ $detected == 'True' ]; then
+            echo "Secrets detected from "$FILE", Please remove or replace it. You can leverage 'azdev scan'/'azdev mask' command if needed." 1>&2
+            secret_files+=$FILE
+          fi
+        done
+        if [ "${#secret_files[@]}" -gt 0 ]; then
+          exit 1
+        fi
+
+
 - job: CodegenCoverage
   condition: and(succeededOrFailed(), in(variables['Build.Reason'], 'BatchedCI'))
   displayName: "Codegen Coverage"