fix(#8): remove SSM credential logging at Info level

.fullsend/config.yaml

@@ -0,0 +1,21 @@
+# fullsend per-repo configuration
+# https://github.com/fullsend-ai/fullsend
+#
+# This file configures fullsend for per-repo installation mode.
+# See ADR 0033 for details.
+version: "1"
+roles:
+    - triage
+    - coder
+    - review
+    - fix
+    - retro
+    - prioritize
+create_issues:
+    allow_targets:
+        repos:
+            - samanthajayasinghe/backplane-cli
+            - fullsend-ai/fullsend
+allowed_remote_resources:
+    - https://raw.githubusercontent.com/fullsend-ai/fullsend/
+    - https://raw.githubusercontent.com/fullsend-ai/agents/

.github/workflows/fullsend.yaml

@@ -0,0 +1,90 @@
+# This file is managed by fullsend. Do not edit it directly.
+# Upstream: https://github.com/fullsend-ai/fullsend/blob/main/internal/scaffold/fullsend-repo/.github/workflows/fullsend.yaml
+---
+# fullsend shim workflow (per-repo installation mode)
+# Routes events to agent workflows via reusable-dispatch.yml.
+# All agent execution happens in this repo's context — no external
+# config repo is needed.
+#
+# Security: pull_request_target runs the BASE branch version of this workflow,
+# preventing PRs from modifying it to exfiltrate credentials.
+# This shim never checks out PR code, so it is not vulnerable to "pwn request"
+# attacks.
+#
+# Routing: this shim forwards the raw event context to reusable-dispatch.yml,
+# which determines the stage and conditionally calls the appropriate
+# reusable-{stage}.yml workflow. Adding a new stage requires only a case
+# branch in reusable-dispatch.yml — zero changes to this repo.
+#
+# Concurrency: per-role cancel-in-progress groups live in reusable-dispatch.yml
+# stage jobs and agent-scoped groups on reusable-{stage}.yml — not on this shim.
+# A monolithic shim group would serialize unrelated roles and drop pending runs (#2452).
+name: fullsend
+
+permissions:
+  actions: write
+  id-token: write
+  contents: write
+  issues: write
+  packages: read
+  pull-requests: write
+
+on:
+  issues:
+    types: [opened, edited, labeled]
+  issue_comment:
+    types: [created]
+  pull_request_target:
+    types: [opened, synchronize, ready_for_review, closed]
+  pull_request_review:
+    types: [submitted]
+
+jobs:
+  dispatch:
+    if: >-
+      github.event_name != 'issue_comment'
+      || github.event.comment.user.type != 'Bot'
+    uses: fullsend-ai/fullsend/.github/workflows/reusable-dispatch.yml@10b62b5510e1c8a22ed08ad0b1061aa346dd1373 # v0.21.0
+    with:
+      event_action: ${{ github.event.action }}
+      install_mode: per-repo
+      mint_url: ${{ vars.FULLSEND_MINT_URL }}
+      gcp_region: ${{ vars.FULLSEND_GCP_REGION }}
+      fullsend_ai_ref: 10b62b5510e1c8a22ed08ad0b1061aa346dd1373 # v0.21.0
+    secrets:
+      FULLSEND_GCP_WIF_PROVIDER: ${{ secrets.FULLSEND_GCP_WIF_PROVIDER }}
+      FULLSEND_GCP_PROJECT_ID: ${{ secrets.FULLSEND_GCP_PROJECT_ID }}
+
+  stop-fix:
+    if: >-
+      github.event_name == 'issue_comment'
+        && github.event.issue.pull_request
+        && github.event.comment.user.type != 'Bot'
+        && github.event.comment.body == '/fs-fix-stop'
+        && (
+          github.event.comment.author_association == 'OWNER'
+          || github.event.comment.author_association == 'MEMBER'
+          || github.event.comment.author_association == 'COLLABORATOR'
+          || github.event.comment.author_association == 'CONTRIBUTOR'
+          || github.event.comment.user.login == github.event.issue.user.login
+        )
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      issues: write
+      pull-requests: write
+    steps:
+      - name: Add fullsend-no-fix label and notify
+        env:
+          GH_TOKEN: ${{ github.token }}
+          PR_NUMBER: ${{ github.event.issue.number }}
+          REPO: ${{ github.repository }}
+        run: |
+          set -euo pipefail
+          gh label create "fullsend-no-fix" --repo "$REPO" \
+            --description "Skip bot-triggered fix agent runs" --color "FBCA04" \
+            --force 2>/dev/null || true
+          gh pr edit "$PR_NUMBER" --repo "$REPO" \
+            --add-label "fullsend-no-fix"
+          gh pr comment "$PR_NUMBER" --repo "$REPO" \
+            --body "Fix agent disabled for this PR. Remove the \`fullsend-no-fix\` label or use \`/fs-fix\` to re-engage."

OWNERS

@@ -1,5 +1,4 @@
 reviewers:
-  - wanghaoran1988
   - feichashao
   - MitaliBhalla
   - Tafhim
@@ -12,7 +11,6 @@ reviewers:
   - diakovnec
 
 approvers:
-  - wanghaoran1988
   - feichashao
   - bmeng
   - typeid
@@ -23,7 +21,6 @@ approvers:
   - diakovnec
 
 maintainers:
-  - wanghaoran1988
   - feichashao
   - MitaliBhalla
   - bmeng

cmd/ocm-backplane/cloud/ssm.go

@@ -248,10 +248,10 @@ func runSSMsession(ssmClient SSMClient, instanceID string, command []string, reg
 		return fmt.Errorf("session details are incomplete: SessionId=%v, StreamUrl=%v, TokenValue=%v", result.SessionId, result.StreamUrl, result.TokenValue)
 	}
 
-	// Log session details for debugging
-	logger.Infof("SessionId: %v", *result.SessionId)
-	logger.Infof("StreamUrl: %v", *result.StreamUrl)
-	logger.Infof("TokenValue: %v", *result.TokenValue)
+	// Log non-sensitive session identifier for debugging.
+	// StreamUrl and TokenValue are intentionally excluded from logs
+	// to prevent credential exposure (CWE-532, CWE-312).
+	logger.Debugf("SessionId: %v", *result.SessionId)
 
 	sessionJSON, err := json.Marshal(map[string]string{
 		"SessionId":  *result.SessionId,

cmd/ocm-backplane/cloud/ssm_test.go

@@ -1,6 +1,7 @@
 package cloud
 
 import (
+	"bytes"
 	"context"
 	"encoding/json"
 	"errors"
@@ -11,7 +12,6 @@ import (
 
 	"github.com/aws/aws-sdk-go-v2/aws"
 	"github.com/aws/aws-sdk-go-v2/service/ssm"
-	"go.uber.org/mock/gomock"
 	. "github.com/onsi/ginkgo/v2"
 	. "github.com/onsi/gomega"
 	cmv1 "github.com/openshift-online/ocm-sdk-go/clustersmgmt/v1"
@@ -21,7 +21,9 @@ import (
 	ocmMock "github.com/openshift/backplane-cli/pkg/ocm/mocks"
 	"github.com/openshift/backplane-cli/pkg/ssm/mocks"
 	"github.com/openshift/backplane-cli/pkg/utils"
+	log "github.com/sirupsen/logrus"
 	"github.com/spf13/cobra"
+	"go.uber.org/mock/gomock"
 	v1 "k8s.io/api/core/v1"
 	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/client-go/kubernetes"
@@ -136,6 +138,69 @@ var _ = Describe("SSM command", func() {
 		})
 	})
 
+	Context("SSM session should not log sensitive credentials", func() {
+		var (
+			logBuf              bytes.Buffer
+			originalExecCommand func(string, ...string) *exec.Cmd
+			originalLevel       log.Level
+		)
+
+		BeforeEach(func() {
+			// Capture log output at Info level (the default logrus level)
+			logBuf.Reset()
+			originalLevel = log.GetLevel()
+			log.SetLevel(log.InfoLevel)
+			log.SetOutput(&logBuf)
+
+			originalExecCommand = ExecCommand
+			ExecCommand = func(name string, arg ...string) *exec.Cmd {
+				return exec.Command("echo", "mock command")
+			}
+
+			mockSSMClient.EXPECT().StartSession(
+				context.TODO(),
+				gomock.Any(),
+			).Return(&ssm.StartSessionOutput{
+				SessionId:  aws.String("test-session-id"),
+				StreamUrl:  aws.String("wss://secret-stream-url.example.com"),
+				TokenValue: aws.String("secret-token-value-abc123"),
+			}, nil)
+		})
+
+		AfterEach(func() {
+			ExecCommand = originalExecCommand
+			log.SetLevel(originalLevel)
+			log.SetOutput(os.Stderr)
+		})
+
+		It("should not log TokenValue at Info level", func() {
+			err := runSSMsession(mockSSMClient, "i-1234567890abcdef0", nil, "us-west-2")
+			Expect(err).ToNot(HaveOccurred())
+
+			logOutput := logBuf.String()
+			Expect(logOutput).ToNot(ContainSubstring("secret-token-value-abc123"),
+				"TokenValue should not appear in log output at Info level")
+		})
+
+		It("should not log StreamUrl at Info level", func() {
+			err := runSSMsession(mockSSMClient, "i-1234567890abcdef0", nil, "us-west-2")
+			Expect(err).ToNot(HaveOccurred())
+
+			logOutput := logBuf.String()
+			Expect(logOutput).ToNot(ContainSubstring("wss://secret-stream-url.example.com"),
+				"StreamUrl should not appear in log output at Info level")
+		})
+
+		It("should not log SessionId at Info level", func() {
+			err := runSSMsession(mockSSMClient, "i-1234567890abcdef0", nil, "us-west-2")
+			Expect(err).ToNot(HaveOccurred())
+
+			logOutput := logBuf.String()
+			Expect(logOutput).ToNot(ContainSubstring("test-session-id"),
+				"SessionId should only appear at Debug level, not Info")
+		})
+	})
+
 	var _ = Describe("SSM command", func() {
 		var (
 			originalExecCommand func(string, ...string) *exec.Cmd