Repository navigation
[ML] Avoid secret-scanning false positive in named OneLake test - #49835
Merged
Merged
Conversation
Validate the named OneLake URI by components instead of embedding a workspace-at-host literal that secret scanning misclassifies. Preserve authority, artifact path, scheme, query and fragment checks. No production behavior or actual credentials are changed. Authored-by: GitHub Copilot CLI 1.0.105 Model: GPT-6.1 Sol (gpt-6.1-sol) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5ff91386-9727-4ae0-914b-39e54a9549d5
|
Azure Pipelines: Successfully started running 1 pipeline(s). 9 pipeline(s) were filtered out due to trigger conditions. There may be pipelines that require an authorized user to comment /azp run to run. |
vaibhj
marked this pull request as ready for review
November 5, 2026 18:54
vaibhj
requested review from
Justin Firsching (JustinFirsching),
Klein Hu (NonStatic2014),
Amit Chauhan (achauhan-scc),
Arun (arunsu),
Jayesh Tanna (jayesh-tanna),
kingernupur,
Nikolay Rovinskiy (nick863),
Ayush Mishra (novaturient95),
Razvan Tanase (rtanase),
Riti Sharma (sharma-riti) and
Vivek Ramaswamy (vivram)
as code owners
November 5, 2026 18:54
Contributor
|
Add |
Contributor
There was a problem hiding this comment.
🟢 Approval recommended
There are no active review issues for this test-only change to avoid a secret-scanning false positive.
No open issues 🎉
What changed in this PR
Updates the Azure AI ML named-OneLake resolver test to avoid a secret-scanning false positive from a synthetic URI literal, without changing production behavior.
Changes:
- Replaces the full URI assertion with component checks using
urlsplit. - Retains checks for the scheme, workspace/host authority, lakehouse path, and absence of query and fragment.
No review findings.
| File | Description |
|---|---|
sdk/ml/azure-ai-ml/tests/dataset/unittests/test_data_path_resolver.py |
Replaces the synthetic full URI literal with component-level assertions. |
Review effort: Balanced
Add the requested owners to ML and azure-ai-ml ownership entries. Preserve existing owners and avoid duplicate entries. Authored-by: GitHub Copilot CLI 1.0.105 Model: GPT-6.1 Sol (gpt-6.1-sol) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5ff91386-9727-4ae0-914b-39e54a9549d5
vaibhj
requested review from
a team,
jenny (JennyPng),
Kashif Khan (kashifkhan),
Libba Lawrence (l0lawrence) and
Jeff Fisher (xirzec)
as code owners
November 5, 2026 19:24
Ayush Mishra (novaturient95)
approved these changes
Nov 5, 2026
Remove vaibhj and neilyan-msft from both ML ownership entries. Authored-by: GitHub Copilot CLI 1.0.105 Model: GPT-6.1 Sol (gpt-6.1-sol) Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: 5ff91386-9727-4ae0-914b-39e54a9549d5
Ayush Mishra (novaturient95)
approved these changes
Nov 5, 2026
Kashif Khan (kashifkhan)
approved these changes
Nov 5, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Secret scanning misclassified the literal authority in the synthetic named-OneLake test URI as an Azure Active Directory user credential. This fixture contains a workspace identifier, not a password or token.
Replace the full literal URI assertion with URI-component assertions. The test still verifies the ABFSS scheme, workspace/host authority, lakehouse suffix and Files subpath, and absence of query/fragment. No production code, credentials, runtime dependencies, or scanner exclusions are changed.
Validation
This branch was created directly from upstream main, independently of the resolver feature branch. Removing the static fixture prevents this representation from being reintroduced in source; existing historical secret-scanning alerts still require separate triage/dismissal by someone with repository security access. No credential was rotated or revoked because this is a synthetic test identifier.
Authored-by: GitHub Copilot CLI 1.0.105
Model: GPT-6.1 Sol (gpt-6.1-sol)
Ownership update
At the author's request, add Ayush Mishra (@novaturient95) and viragjain611 to the
/sdk/ml/and/sdk/ml/azure-ai-ml/CODEOWNERS entries. Existing owners are retained; Ayush Mishra (@novaturient95) was already present on the package entry and is not duplicated. Both remaining requested handles were verified to have repository write permission. Validation confirms exactly the two intended ownership lines change, with no duplicate owners or unrelated edits.