fix(generator): mask embedded gcloud service-account key contents

[thomhurst]

Generated Google SDK 585 output in #5344 (head ce4f556, generation run 35684123650) omits [SecretValue] from embedded service-account credentials accepted by Oracle Goldengate create options.

Codex P1 finding: #5344 (comment)

Captured SDK help explicitly describes --google-big-query-connection-properties-service-account-key-file, the Cloud Storage/Pub/Sub equivalents, and the Iceberg Cloud Storage equivalent as "The base64 encoded content of the service account key file". These values are credential contents, despite their -file names. Without the attribute, command logging and telemetry can expose them.

Fix the generic classification in tools/ModularPipelines.OptionsGenerator/src/ModularPipelines.OptionsGenerator/Generators/GeneratorUtils.cs and its scraper/enhancer path. Add captured SDK regressions covering these properties, preserve non-secret file paths/resource identifiers/HTTP-location metadata, and verify explicit secret overrides. Merge the source fix separately, then regenerate from latest main and confirm runtime metadata/masking in the healthy Google replacement. Never patch generated options or API baselines.

Related acceptance: #5180 and #4799. Defective generated PR #5344 must be closed and its pending CI cancelled before replacement.

[thomhurst]

The generic source correction is pushed in 733cb1e on #5346, confirmed at its remote head. Four captured SDK 585 service-account-key cases fail before the fix and pass after it. All 264 focused classifier, scraper, and enhancer tests pass, including actual paths, resource identifiers, HTTP-location metadata, and explicit overrides.

The classifier distinguishes inline contents from file paths and recognizes service-account key material. Gcloud and the enhancer use option-local prose to avoid inherited group descriptions suppressing that result. Four Google runtime attribute regressions are prepared for the next unchanged workflow artifact.

The generated-output finding remains pending source merge, fresh latest-main generation, and actual Google integration validation. #5344 remains closed; all its pending CI is cancelled and verified clear. #5345 tracks acceptance.

[thomhurst]

Source fix #5346 is merged as ca572f7. All 3,402 generator tests, CodeQL, and reviews pass; no pending work remains on the source PR.

Fresh latest-main generation: https://github.com/thomhurst/ModularPipelines/actions/runs/35690354313. The replacement retains the 76 nested-choice cases and adds four runtime SecretValue attribute checks for the embedded service-account keys. This finding remains pending unchanged-artifact review and actual Google integration CI.

[thomhurst]

Fresh latest-main replacement: #5347, generated by run 35690354313 after source fixes through #5346. Artifact 10678711892 is unchanged and passes provenance, coverage, and documentation checks. Compared with rejected #5344, only eight embedded-credential SecretValue annotations and the fingerprint change; no masking annotation is removed.

The replacement retains 76 nested-choice cases and adds runtime attribute checks for all eight credential fields. Explicit integration CI: https://github.com/thomhurst/ModularPipelines/actions/runs/35692851347. Acceptance remains pending actual Google test execution and reviews.

[thomhurst]

Codex found two additional classifier gaps in #5347 at 5a12a85: #5347 (comment)

1. MysqlConnectionPropertiesSslKeyFile lacks SecretValue. Captured SDK help says: Client Key - The base64 encoded content of a .pem or .crt file containing the client private key (for 2-way SSL). The current rule misses the label prefix and the file-containing-material wording. This extends fix(generator): mask embedded gcloud service-account key contents #5345's inline credential-content defect.
2. GcloudIamOauthClientsCredentialsDescribeOptions.Credential is masked despite help declaring ID of the oauth client credential or fully qualified identifier for the oauth client credential. The resource-identifier matcher only accepts a single-word resource name. This extends fix(generator): preserve gcloud provider groups, resource values, enums, and secrets #5180's resource-identifier masking defect.

The generated PR will be closed and all pending CI cancelled. The generic classifier and captured regressions will be corrected separately. I am auditing related file-content fields and multi-word resource identities before another latest-main regeneration; generated files will not be patched.

[thomhurst]

Source fix: #5348 (0f31d5b623). It covers both findings from the Codex review, plus the same inline-secret classification gap in PostgreSQL private keys, four KeyStore bodies, and Oracle wallet contents. The focused generator suite passes all 303 tests, including non-secret certificates, TrustStore bodies, configuration bodies, and actual paths.

This generated PR remains closed. Its queued/running work is now cancelled; all five workflow runs are completed. A fresh Google generation will follow after the source fix passes review and merges into main.

[thomhurst]

Source fix #5348 is merged as a94af5a6379aa097b0828d9584323787c9fc6449. All 3,434 generator tests pass, with clear Claude, Codex, and CodeRabbit reviews and successful CodeQL checks.

Fresh Google generation from that main commit: https://github.com/thomhurst/ModularPipelines/actions/runs/35696052122. Acceptance remains open until the generated replacement passes its artifact audit and actual Google integration tests.

[thomhurst]

Fresh replacement: #5349, generated by https://github.com/thomhurst/ModularPipelines/actions/runs/35696052122 from main a94af5a6379aa097b0828d9584323787c9fc6449 after source fix #5348.

The unchanged artifact preserves all 7,951 commands, including all 54 reported commands, with no removals or exclusions. Compared with #5347, exactly seven inline-secret annotations are added and eight OAuth/SCIM resource-ID annotations are removed. All 15 embedded credential fields are now marked as secrets. Documentation builds successfully (331 documents).

The generated library compiles. The replacement adapts the four existing handwritten test constructor calls and adds focused Google regressions. Actual Google integration validation is running in https://github.com/thomhurst/ModularPipelines/actions/runs/35698901283. Acceptance remains open until CI and review finish.