Suppress CredScan false positive on Application Gateway mTLS test recording

[santoshgh317]

🤖 PR Validation — ️✔️ All clear

Tests
️✔️ 2/2

Description

Adds a single CredScan suppression entry to unblock the release-rollup PR #30195 ("[Do Not Squash] Release network 2026 01 01"). Its azure-powershell - security-tools stage is the only remaining failing check on that PR; every other leg (Build, Analyze, Test windows/linux/macOS on both powershell-core and windows-powershell) is green.

Root cause

• Child PR #30158 ("Add Application Gateway frontend mTLS passthrough configuration") added a new session-recording file: src/Network/Network.Test/SessionRecords/Commands.Network.Test.ScenarioTests.ApplicationGatewayTests/TestApplicationGatewayCRUDWithMutualAuthentication.json (~2 MB).
• The recording captures the wire traffic for the mTLS test scenario, which includes 264 PFX-formatted base64 blobs — the client and server test certificates the cmdlet uploads and reads back. These are ephemeral test-only certificates with no live credentials.
• Credential Scanner's PfxContent rule (error CSCAN-GENERAL0020) pattern-matches on those PFX blobs and treats each match as a finding. Guardian aggregates the findings and exits with code 8 ("one or more breaking results") whenever the delta against the main baseline exceeds threshold.
• The build annotation confirms the pinpoint: line 1851, column 794 of the file above.

Why this only surfaces now

• PR Add Application Gateway frontend mTLS passthrough configuration #30158 passed its own child-PR CI when it merged into release-network-2026-01-01. Release-branch CI runs against a looser Guardian baseline, so the new PFX blobs were classified as a permitted delta on that branch.
• The rollup PR [Do Not Squash] Release network 2026 01 01 #30195 targets main, which has the strictest Guardian baseline in the repo. On the rollup, every new finding since the last known-clean main baseline must be either in tools/SecurityTools/CredScanSuppressions.json or an approved waiver. The new mTLS recording was never added to the suppression list.
• Yesterday PR [Do Not Squash] Release network 2026 01 01 #30195 was mergeStateStatus: DIRTY (main was 45 commits ahead), so a fresh, complete CI didn't run against the rollup head SHA. Once #30196 merged and the rollup's head SHA advanced to include the merge commit, Azure Pipelines kicked off Build #20260925.6 — the first true full run — and security-tools reported the finding.

The fix

One entry appended to tools/SecurityTools/CredScanSuppressions.json, in the same Network cluster as the existing sibling entries:

{
  "file": "src\\Network\\Network.Test\\SessionRecords\\Commands.Network.Test.ScenarioTests.ApplicationGatewayTests\\TestApplicationGatewayCRUDWithMutualAuthentication.json",
  "_justification": "Legitimate test session record for mutual TLS (mTLS) scenarios; contains PFX-formatted client and server test certificates recorded during the Application Gateway mTLS Passthrough test (added by PR #30158). All certificates are ephemeral test data; no live credentials."
}

This mirrors the existing suppressions at the same location for:

• TestApplicationGatewayCRUD2.json (line 89) — same file family, same pattern
• ApplicationGatewaySslCert1.pfx / ApplicationGatewaySslCert2.pfx (lines 41, 45) — standalone PFX test certificates

Why land on release-network-2026-01-01 (not directly on main)

Landing this on the release branch first is deliberate — the fix flows into main atomically with the rollup PR #30195, so the rollup's next security-tools run sees the suppression as part of the same aggregate change set that added the mTLS recording. Merging the suppression on main in parallel would work, but it would leave a brief window where main disagrees with release-network-2026-01-01 about which files are suppressed, and it would require a second sync commit before #30195 can merge cleanly.

Testing

• Get-Content tools/SecurityTools/CredScanSuppressions.json -Raw | ConvertFrom-Json → parses OK.
• git diff --stat → 1 file changed, +4 lines / -0 lines. Nothing outside the suppression file is touched.
• After merging this PR, PR #30195 will pick up the change automatically and its next security-tools rerun is expected to pass. No changes are required to [Do Not Squash] Release network 2026 01 01 #30195 itself.

Checklist

• JSON is valid.
• Suppression path is the exact filename Guardian reported in the build annotation (double-backslash-escaped to match sibling entries).
• _justification explains what the file is, why the blobs look like credentials, and confirms they are test data (mirrors the tone of surrounding entries).
• No changes outside tools/SecurityTools/CredScanSuppressions.json.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Aditya Pujara (a0x1ab)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 3 pipeline(s).

[santoshgh317]

DanielMicrosoft — kindly review. This is the tiny suppression PR needed to unblock the release-network-2026-01-01 → main rollup (#30195).

Context:

• Only failing check on [Do Not Squash] Release network 2026 01 01 #30195 is azure-powershell - security-tools (CredScan CSCAN-GENERAL0020, Build #20260925.6).
• Guardian is flagging the new mTLS test session recording added by Add Application Gateway frontend mTLS passthrough configuration #30158: src/Network/Network.Test/SessionRecords/Commands.Network.Test.ScenarioTests.ApplicationGatewayTests/TestApplicationGatewayCRUDWithMutualAuthentication.json — the file contains ~264 PFX-formatted base64 blobs which are ephemeral test-only client/server certificates.
• Fix is 4 lines added to tools/SecurityTools/CredScanSuppressions.json following the exact pattern already in place for sibling Network artifacts (TestApplicationGatewayCRUD2.json L89, ApplicationGatewaySslCert1.pfx L41, ApplicationGatewaySslCert2.pfx L45).
• Landed here on the release branch so it flows into main atomically via the rollup PR.

Once merged, #30195 auto-picks it up and security-tools should go green on the next rerun. Thanks for the fast turnaround.