Scrub New Relic ingestion keys from test recordings

[Shiwani (shiwanijain)]

🤖 PR Validation — ️✔️ All clear

Breaking Changes
️✔️ None

Summary

• replace the recorded New Relic ingestion credential with a non-secret placeholder
• scrub ingestionKey values from recorded request and response bodies
• add regression coverage for both recording processor paths

Security

Addresses secret-scanning alert #618. The exposed credential should be treated as compromised and invalidated by the service/security owner; this PR prevents it from remaining at the current default-branch path or recurring in future recordings.

Validation

• azdev test new-relic (2 passed)
• azdev style new-relic
• azdev linter new-relic
• cassette scan: 0 key-shaped tokens

[azure-client-tools-bot-prd]

Hi Shiwani (@shiwanijain),
Please write the description of changes which can be perceived by customers into HISTORY.rst.
If you want to release a new extension version, please update the version in pyproject.toml (or setup.py, if the extension has not migrated yet) as well.

[azure-pipelines]

Azure Pipelines:
There may be pipelines that require an authorized user to comment /azp run to run.

[Copilot]

🟡 Changes recommended

The new recording processor can throw an AttributeError when it encounters body: null interactions, potentially breaking recording/playback.

Once you've addressed the issues Copilot identified, you can request another Copilot review.

Pull request overview

This PR hardens the new-relic extension’s test recordings against credential leakage by replacing recorded ingestion keys with a placeholder and introducing a recording processor to scrub ingestionKey values during recording/playback.

Changes:

• Added NewRelicSecretScrubber recording processor to redact ingestionKey values in request/response bodies.
• Wired the scrubber into the NewRelicScenario scenario tests and added a unit test to cover both processor paths.
• Updated the existing YAML cassette to remove the previously recorded ingestion key.

File summaries

File	Description
src/new-relic/azext_new_relic/tests/latest/recording_processors.py	Introduces a recording processor to scrub ingestionKey from text payloads.
src/new-relic/azext_new_relic/tests/latest/test_recording_processors.py	Adds regression coverage for request/response processing.
src/new-relic/azext_new_relic/tests/latest/test_new_relic.py	Registers the scrubber as a recording processor for scenario tests.
src/new-relic/azext_new_relic/tests/latest/recordings/test_new_relic_monitor.yaml	Replaces the recorded ingestion key value with a non-secret placeholder.

Review details

• Files reviewed: 4/4 changed files
• Comments generated: 1
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Shiwani (shiwanijain)]

This is a test-only security remediation with no customer-facing command or extension behavior change, so no HISTORY entry or version bump is needed. It removes an exposed credential from the cassette and adds recording-time redaction plus regression coverage.

[Shiwani (shiwanijain)]

/copilot review

[Yong Zhang (yonzhan)]

new-relic

[Ethan Yang (necusjz)]

/azp run

[azure-pipelines]

Azure Pipelines:
Successfully started running 2 pipeline(s).