[sodle-splunk]

Written by Codex.

Summary

• Mark temporary AWS credentials as password-typed action input.
• Exclude action-scoped credentials before parameters are retained in ActionResult.
• Remove credential parameter paths from action output metadata.
• Preserve PR fix!: harden Security Hub ingestion boundaries #24's polling-loss protections and pagination bounds.
• Refresh shared quality hooks and their generated maintenance artifacts.

Tracking

• PAPP-37946 / PSAAS-32390 / VULN-95113
• PAPP-38066 / PSAAS-31807 / VULN-94532
• Parent epic: ESPM-5228

Rebase reconciliation

PR #25 was rebased onto PR #24 at dee5a7b115775e83d73b03958aba6bfc8c2a7417. Combined head fa97b6cd66db7c0cced7075abe58047aa613251d preserves PR #24's stable first-run boundary, checkpoint migration, SQS occurrence and deferred-message tracking, malformed-message fail-closed behavior, durable-prefix checkpointing, pagination bounds, and finite scheduled-poll handling while adding credential redaction.

Exact source reconciliation confirms that the regression caused by the old PR #25 base is removed. VULN-94532 therefore returns to PR #24's connector-complete state; its previously documented invocation-mode classification remains a separate platform follow-up.

Quality gate

• Full local pre-commit passes except for environment-only failures: Semgrep cannot initialize the local certificate store, and dependency packaging cannot run without Docker.
• Source compilation passes locally.
• All other local hooks pass, including merge-conflict checks, formatting, linting, app linting, secret detection, documentation, copyright, release-note, and static-test checks.
• Hosted checks will rerun at the rebased head.

Release impact

Asset configuration and credential use are unchanged. The action history no longer retains temporary credential material. PR #24's intentionally breaking polling and result-bound changes remain part of the combined release.

Merge strategy: merge commit only; do not squash.

[github-actions]

Merging this PR will release 3.0.0 with the following release notes:

3.0.0 (2026-08-12)

Connector release changes

• Stabilize scheduled polling windows and migrate invalid legacy checkpoints to a safe UTC lookback.
• Preserve older valid checkpoints during migration so unprocessed findings remain in the polling window.
• Reject provider pages that exceed the requested local finding allowance before accumulation.
• Limit omitted-result pagination to 1,000 findings and exact-ID validation to 100 retained findings.
• Reuse the bounded exact-ID result for related-finding output instead of issuing a second unbounded request.
• Persist per-message SQS progress so capped polls resume at the unprocessed finding.
• Track SQS ingestion by exact message occurrence and delete only fully ingested messages.
• Rotate capped SQS retries past persistent failures and report deferred or invalid messages.
• Prioritize messages deferred by an earlier poll so persistent failures cannot starve later messages.
• Continue direct polling after individual ingestion failures without checkpointing past the earliest failure.
• Prevent action-scoped AWS credentials from being retained in action results.

[phantom-jacob]

Codex review blocker: the current history contains literal \n text in the commit bodies for a23052c8, fa97b6cd. Those are two characters, not paragraph breaks. Please rewrite the affected commit messages with real newlines so release tooling and trailers see valid multiline messages. Preserve the distinct commits rather than squashing them.

Commented by Codex.