Suppress APIScan documentationnotfound finding for Extensions.Abstractions

[cheenamalhotra]

Summary

Resolves the APIScan documentationnotfound error reported against microsoft.data.sqlclient.extensions.abstractions.dll for Microsoft.Data.SqlClient.SqlAuthenticationProviderManager, along with the accompanying Guardian warning about a missing suppression file.

Suppression file expected at D:\a\_work\1\.gdn\.gdnsuppress but not found.
ApiScan Error documentationnotfound - File: release/netstandard2.0/microsoft.data.sqlclient.extensions.abstractions.dll.
Signature: ed88d73ca41890d1e3d1e94bb67a93b82ea582c60ac6f496223b89c2da201f62

Changes

.config/guardian/.gdnsuppress (new) — Guardian suppression file containing the single APIScan signature under the default suppression set, with a justification marking it as temporary. Lives alongside the existing baseline and other SDL tool configs (CredScan/PoliCheck/TSA).

sqlclient-official.yml / sqlclient-non-official.yml — wire globalSdl.suppression to that file. Guardian previously looked for a suppression file at its default agent location (<work>/.gdn/.gdnsuppress), which this repo never provided; that is the source of the "Suppression file expected at ... but not found" message.

Why the suppression file rather than the baseline

.gdnbaselines is documented in both pipelines as a snapshot of findings that pre-existed the breakOnSdlError rollout. Putting a new, post-baseline waiver there would make the snapshot drift and blur its meaning. Suppressions are the intended mechanism for consciously accepted new findings, so this finding is recorded only in .gdnsuppress — one place to remove when the underlying documentation issue is fixed. The baseline file is left byte-identical to its original snapshot.

Checklist

• Tests added or updated (n/a — pipeline/SDL config only)
• Public API changes documented (n/a)
• Verified against customer repro (n/a)
• Ensure no breaking changes introduced

[Copilot]

Pull request overview

This PR suppresses an APIScan documentationnotfound finding for microsoft.data.sqlclient.extensions.abstractions.dll by adding the reported signature to the repo’s Guardian baseline file, aligning with the existing SDL/Guardian baseline workflow used by the OneBranch pipelines.

Changes:

• Added a new APIScan finding signature entry to .config/guardian/.gdnbaselines.
• Included metadata for the new entry (memberOf/default + createdDate) and a justification note.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.82%. Comparing base (c642196) to head (4d01c9a).
⚠️ Report is 3 commits behind head on main.

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4531      +/-   ##
==========================================
- Coverage   64.84%   62.82%   -2.02%     
==========================================
  Files         288      283       -5     
  Lines       44092    67410   +23318     
==========================================
+ Hits        28590    42349   +13759     
- Misses      15502    25061    +9559     

Flag	Coverage Δ
CI-SqlClient	?
PR-SqlClient-Project	62.82% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

Pull request overview

Copilot reviewed 4 out of 4 changed files in this pull request and generated no new comments.

Suppressed comments (3)

eng/pipelines/onebranch/sqlclient-official.yml:186

• The PR description says adding the signature to .gdnbaselines is the supported suppression mechanism and that no .gdnsuppress file is required, but this change wires up an explicit suppressionFile and the PR also adds .config/guardian/.gdnsuppress. Please either (a) update the PR description to reflect the suppressionFile approach, or (b) remove the suppressionFile configuration (and the .gdnsuppress file) to keep the change strictly baseline-only.

      suppression:
        suppressionFile: $(Build.SourcesDirectory)/.config/guardian/.gdnsuppress
        suppressionSet: default

.config/guardian/.gdnbaselines:131

• This new ApiScan signature is being added to the Guardian baseline, but the baseline is described in the pipelines as a snapshot of pre-existing findings. Since this PR also introduces a dedicated suppression file (.gdnsuppress) for post-baseline suppressions, keeping this entry in .gdnbaselines makes the baseline drift and creates redundant suppression paths. Prefer removing this entry from .gdnbaselines and relying on the suppression file instead.

    "ed88d73ca41890d1e3d1e94bb67a93b82ea582c60ac6f496223b89c2da201f62": {
      "signature": "ed88d73ca41890d1e3d1e94bb67a93b82ea582c60ac6f496223b89c2da201f62",
      "alternativeSignatures": [],
      "memberOf": [
        "default"

eng/pipelines/onebranch/sqlclient-non-official.yml:171

• Same as sqlclient-official.yml: the PR description claims baseline-only suppression with no .gdnsuppress, but this pipeline now configures globalSdl.suppression to point at .config/guardian/.gdnsuppress. Align the PR description and suppression mechanism (baseline-only vs suppressionFile) to avoid confusion for future maintainers.

      suppression:
        suppressionFile: $(Build.SourcesDirectory)/.config/guardian/.gdnsuppress
        suppressionSet: default

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated no new comments.

[cheenamalhotra]

Turns out this cannot be suppressed:

##[warning]Result with signature: ed88d73ca41890d1e3d1e94bb67a93b82ea582c60ac6f496223b89c2da201f62 was determined to be suppressed, but policy indicates that results matching rule id: documentationnotfound cannot be suppressed. Result will be considered breaking.

Closing PR and we should prioritize #4348