Repository navigation
fix: redact action-scoped AWS credentials - #34
Conversation
Refresh pre-commit hooks and apply their generated maintenance updates before the connector behavior change. Authored by Codex.
Mark temporary credentials as password input, omit them from persisted ActionResult parameters, and remove their output metadata. References PAPP-37946, PSAAS-32390, and VULN-95113. Authored by Codex.
|
Merging this PR will release 2.3.3 (2026-08-12)Connector release changes
|
Written by Codex.
Use dev-cicd-tools v2.2.9 so generated metadata follows the corrected secret-output handling. Authored-by: Codex <codex@openai.com>
Regenerate connector metadata with the corrected validation hook so password parameters are not advertised as action outputs. Authored-by: Codex <codex@openai.com>
Run the existing changes against the current shared workflow after the prior workflow identifier was retired. Authored-by: Codex <codex@openai.com>
|
Codex review blocker: the current history contains literal Commented by Codex. |
24bfcc5 to
2e080e7
Compare
ChrisGeohring
left a comment
ChrisGeohring
left a comment
There was a problem hiding this comment.
Reviewed the current head for P0/P1 code issues. No P0/P1 code blocker found. This approval covers the connector code review; any shared sanity, integration, or test-inventory gates remain separate CI follow-up.
|
🎉 This PR is included in version 2.3.3 🎉 The release is available on GitHub release Your semantic-release bot 📦🚀 |
Written by Codex.
Summary
Tracking
Quality gate
Full pre-commit suite passes locally and the hosted pre-commit check passes at the corrected head.
Source compilation passes locally.
Hosted compile rerun passed on 2026-08-07; no connector-code compile failure remains.
Security scans are non-blocking under the connector quality policy; integration failures are ignored unless they implicate the changed code.
Release impact
Asset configuration and credential use are unchanged. The action history no longer retains temporary credential material.
Merge strategy: merge commit only; do not squash.