Add CredScan cleanup guide

[mccoyp]

Description

This adds a guide for cleaning up CredScan warnings so that package owners can clean up warnings for packages they own, on their own.

All SDK Contribution checklist:

• The pull request does not introduce [breaking changes]
• CHANGELOG is updated for new features, bug fixes or other significant changes.
• I have read the contribution guidelines.

General Guidelines and Best Practices

• Title of the pull request is clear and informative.
• There are a small number of commits, each of which have an informative message. This means that previously merged commits do not appear in the history of the PR. For more information on cleaning up the commits in your PR, see this page.

Testing Guidelines

• N/A Pull request includes test coverage for the included changes.

[check-enforcer]

This pull request is protected by Check Enforcer.

What is Check Enforcer?

Check Enforcer helps ensure all pull requests are covered by at least one check-run (typically an Azure Pipeline). When all check-runs associated with this pull request pass then Check Enforcer itself will pass.

Why am I getting this message?

You are getting this message because Check Enforcer did not detect any check-runs being associated with this pull request within five minutes. This may indicate that your pull request is not covered by any pipelines and so Check Enforcer is correctly blocking the pull request being merged.

What should I do now?

If the check-enforcer check-run is not passing and all other check-runs associated with this PR are passing (excluding license-cla) then you could try telling Check Enforcer to evaluate your pull request again. You can do this by adding a comment to this pull request as follows:
/check-enforcer evaluate
Typically evaulation only takes a few seconds. If you know that your pull request is not covered by a pipeline and this is expected you can override Check Enforcer using the following command:
/check-enforcer override
Note that using the override command triggers alerts so that follow-up investigations can occur (PRs still need to be approved as normal).

What if I am onboarding a new service?

Often, new services do not have validation pipelines associated with them, in order to bootstrap pipelines for a new service, you can issue the following command as a pull request comment:
/azp run prepare-pipelines
This will run a pipeline that analyzes the source tree and creates the pipelines necessary to build and validate your pull request. Once the pipeline has been created you can trigger the pipeline using the following comment:
/azp run python - [service] - ci

[weshaggard]

We are considering to add the CredScan check inside of PR validation in .NET repo and once we get that figured out we could do that similarly in python repo if you guys feel that would be helpful for you guys.

[mccoyp]

That would definitely be great to implement once that's ready! I synced with Sima about the PR validation work and think it'll be a great solution moving forward. This guide will hopefully help Python cut through our current backlog of CredScan warnings and get us in a position to use PR validation.

[weshaggard]

It is recommended to try and reuse an existing placeholder instead of adding new ones.

[mccoyp]

Agreed -- I hope that's clear in this doc. Do you think this list of suppression options is accurate, in terms of which options are preferable?

[weshaggard]

Yes I think that does cover it but I guess I missed it reading through the other text. Perhaps it might be worth moving up those steps so it is nice summary and add the text after for more details about the specifics.

[weshaggard]

If you suppress an entire file that entire file should only contain fake secrets. We should never suppress an entire file if there is other normal code because we don't want to accidently allow other secrets to slip in a file.

[mccoyp]

/check-enforcer override

[sima-zhu]

Thanks for drafting this! We will use this as initial template.