Reword SqlLegacyRepro placeholder connection string; add secrets instructions

[paulmedynski]

Summary

Two related changes to stop a placeholder connection string from tripping secret scanning, and to document placeholder conventions going forward.

1. tools/SniCloseLegacyRepro/SniCloseLegacyRepro.csproj — Reworded the SNICLOSE_CONNSTR example in the header comment from Server=...;User ID=...;Password=... to angle-bracket placeholders Server=<server>;User ID=<user>;Password=<pwd>. The literal Password=... (ellipsis value) was matched by the SEC101/037 SqlLegacyCredentials push-protection rule as a credential. The new form matches the style already used in the sibling README.md, which the scanner ignores.

2. .github/instructions/secrets.instructions.md (new) — Documents:

   • Golden rules for handling secrets in a repo that mirrors to public GitHub.
   • Approved placeholder formats (<pwd>, <myPassword>, ********, ${VAR}, <Secret>) with full connection-string examples.
   • Disallowed styles — notably the Password=... ellipsis that trips SEC101/037, realistic fake secrets, and bare-word secrets.
   • Preferred runtime patterns (env vars, SqlCredential/SecureString, integrated auth, CI secret variables).
   • A playbook for when a push is blocked by secret scanning, including handling of already-public/mirrored commits.

Notes

• This is a documentation/tooling-comment change only; no product code or public API is affected.
• The reword prevents recurrence in future files/commits but does not retroactively alter historical commits.

[Copilot]

Pull request overview

This PR addresses secret-scanning false positives caused by placeholder connection strings and adds repository guidance to prevent future credential/secret mishandling in docs, comments, and samples.

Changes:

• Reworded the SNICLOSE_CONNSTR placeholder example in the SNI close legacy repro project to use angle-bracket placeholders instead of ellipses.
• Added a new .github/instructions/secrets.instructions.md guide documenting safe placeholder formats, runtime secret-handling patterns, and a push-protection troubleshooting playbook.

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 2 comments.

File	Description
tools/SniCloseLegacyRepro/SniCloseLegacyRepro.csproj	Updates the example env-var connection string placeholder to avoid Password=... patterns that trigger secret scanning.
.github/instructions/secrets.instructions.md	Adds a secrets/credentials handling guide; currently includes some literal ellipsis patterns that may themselves retrigger secret scanning.

Comments suppressed due to low confidence (1)

.github/instructions/secrets.instructions.md:85

• This section uses the literal Password=... again, which can trip the same SEC101/037 SqlLegacyCredentials secret-scanning rule. Consider describing it without including the exact Password=... string.

   - *False positive* (a placeholder like `Password=...`): reword to an approved
     placeholder (`Password=<pwd>`) so future commits don't recur.

[Copilot]

Pull request overview

Copilot reviewed 2 out of 2 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

.github/instructions/secrets.instructions.md:61

• Optional: This connection-string example uses User Id while other examples in this doc use User ID. Consider using User ID consistently to avoid readers copying mixed forms.

Server=tcp:<servername>.database.windows.net;Database=<dbname>;Authentication=Active Directory Service Principal;User Id=<AppId>;Password=<Secret>

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 62.70%. Comparing base (d040700) to head (12c3de7).
⚠️ Report is 3 commits behind head on main.

❗ There is a different number of reports uploaded between BASE (d040700) and HEAD (12c3de7). Click for more details.

HEAD has 1 upload less than BASE

Flag	BASE (d040700)	HEAD (12c3de7)
CI-SqlClient	1	0

Additional details and impacted files

@@            Coverage Diff             @@
##             main    #4475      +/-   ##
==========================================
- Coverage   70.88%   62.70%   -8.18%     
==========================================
  Files         288      283       -5     
  Lines       43935    66821   +22886     
==========================================
+ Hits        31142    41899   +10757     
- Misses      12793    24922   +12129     

Flag	Coverage Δ
CI-SqlClient	?
PR-SqlClient-Project	62.70% <ø> (?)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.