From 537f470f82df6a83c1ea2b6881baacd0bccc6305 Mon Sep 17 00:00:00 2001 From: Jon Langevin Date: Mon, 4 May 2026 04:08:59 -0400 Subject: [PATCH] =?UTF-8?q?fix(drivers):=20implement=20ResourceDriver.Sens?= =?UTF-8?q?itiveKeys=20(returns=20nil)=20=E2=80=94=20closes=20pre-existing?= =?UTF-8?q?=20gap=20from=20workflow#499=20SensitiveKeys=20interface=20addi?= =?UTF-8?q?tion?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds the SensitiveKeys() []string method (returning nil) to all 13 ResourceDriver implementations: ACMDriver, ALBDriver, APIGatewayDriver, ECRDriver, ECSDriver, EKSDriver, ElastiCacheDriver, IAMDriver, RDSDriver, Route53Driver, S3Driver, SecurityGroupDriver, VPCDriver. The interfaces.ResourceDriver method was added to GoCodeAlone/workflow on 2026-04-08 (commit 4853126); this plugin's drivers never adopted it. Surfaced by workflow PR #534's new cross-plugin-build CI gate. Returning nil is the standard "no sensitive outputs" stub. Per-driver review of which output keys (if any) genuinely warrant masking is a follow-up activity, not this PR's scope. Co-Authored-By: Claude Opus 4.7 (1M context) --- drivers/acm.go | 3 +++ drivers/alb.go | 3 +++ drivers/apigateway.go | 3 +++ drivers/ecr.go | 3 +++ drivers/ecs.go | 3 +++ drivers/eks.go | 3 +++ drivers/elasticache.go | 3 +++ drivers/iam.go | 3 +++ drivers/rds.go | 3 +++ drivers/route53.go | 3 +++ drivers/s3.go | 3 +++ drivers/sg.go | 3 +++ drivers/vpc.go | 3 +++ 13 files changed, 39 insertions(+) diff --git a/drivers/acm.go b/drivers/acm.go index 8ac3404..83b55a7 100644 --- a/drivers/acm.go +++ b/drivers/acm.go @@ -182,4 +182,7 @@ func acmCertToOutput(name string, cert *acmtypes.CertificateDetail) *interfaces. } } +// SensitiveKeys returns output keys whose values should be masked in logs and plan output. +func (d *ACMDriver) SensitiveKeys() []string { return nil } + var _ interfaces.ResourceDriver = (*ACMDriver)(nil) diff --git a/drivers/alb.go b/drivers/alb.go index ebd5933..903bdef 100644 --- a/drivers/alb.go +++ b/drivers/alb.go @@ -194,4 +194,7 @@ func albLBToOutput(lb *elbtypes.LoadBalancer) *interfaces.ResourceOutput { } } +// SensitiveKeys returns output keys whose values should be masked in logs and plan output. +func (d *ALBDriver) SensitiveKeys() []string { return nil } + var _ interfaces.ResourceDriver = (*ALBDriver)(nil) diff --git a/drivers/apigateway.go b/drivers/apigateway.go index 588fd5d..b653112 100644 --- a/drivers/apigateway.go +++ b/drivers/apigateway.go @@ -161,4 +161,7 @@ func apigwAPIToOutput(name string, apiID, endpoint *string, protocol string) *in } } +// SensitiveKeys returns output keys whose values should be masked in logs and plan output. +func (d *APIGatewayDriver) SensitiveKeys() []string { return nil } + var _ interfaces.ResourceDriver = (*APIGatewayDriver)(nil) diff --git a/drivers/ecr.go b/drivers/ecr.go index 8403bf4..5d7062f 100644 --- a/drivers/ecr.go +++ b/drivers/ecr.go @@ -129,4 +129,7 @@ func ecrRepoToOutput(repo *ecrtypes.Repository) *interfaces.ResourceOutput { } } +// SensitiveKeys returns output keys whose values should be masked in logs and plan output. +func (d *ECRDriver) SensitiveKeys() []string { return nil } + var _ interfaces.ResourceDriver = (*ECRDriver)(nil) diff --git a/drivers/ecs.go b/drivers/ecs.go index 7ce2e42..d9e7e3f 100644 --- a/drivers/ecs.go +++ b/drivers/ecs.go @@ -247,4 +247,7 @@ func ecsServiceToOutput(name string, svc *ecstypes.Service) *interfaces.Resource } } +// SensitiveKeys returns output keys whose values should be masked in logs and plan output. +func (d *ECSDriver) SensitiveKeys() []string { return nil } + var _ interfaces.ResourceDriver = (*ECSDriver)(nil) diff --git a/drivers/eks.go b/drivers/eks.go index 265dde7..01bc191 100644 --- a/drivers/eks.go +++ b/drivers/eks.go @@ -151,4 +151,7 @@ func eksClusterToOutput(c *ekstypes.Cluster) *interfaces.ResourceOutput { } } +// SensitiveKeys returns output keys whose values should be masked in logs and plan output. +func (d *EKSDriver) SensitiveKeys() []string { return nil } + var _ interfaces.ResourceDriver = (*EKSDriver)(nil) diff --git a/drivers/elasticache.go b/drivers/elasticache.go index b392cac..7c1a4c2 100644 --- a/drivers/elasticache.go +++ b/drivers/elasticache.go @@ -173,4 +173,7 @@ func ecRGToOutput(rg *ectypes.ReplicationGroup) *interfaces.ResourceOutput { } } +// SensitiveKeys returns output keys whose values should be masked in logs and plan output. +func (d *ElastiCacheDriver) SensitiveKeys() []string { return nil } + var _ interfaces.ResourceDriver = (*ElastiCacheDriver)(nil) diff --git a/drivers/iam.go b/drivers/iam.go index 2202868..91c8df9 100644 --- a/drivers/iam.go +++ b/drivers/iam.go @@ -229,4 +229,7 @@ func defaultAssumeRolePolicy() string { return string(data) } +// SensitiveKeys returns output keys whose values should be masked in logs and plan output. +func (d *IAMDriver) SensitiveKeys() []string { return nil } + var _ interfaces.ResourceDriver = (*IAMDriver)(nil) diff --git a/drivers/rds.go b/drivers/rds.go index 5dbc370..5b415e6 100644 --- a/drivers/rds.go +++ b/drivers/rds.go @@ -200,4 +200,7 @@ func rdsDBToOutput(db *rdstypes.DBInstance) *interfaces.ResourceOutput { } } +// SensitiveKeys returns output keys whose values should be masked in logs and plan output. +func (d *RDSDriver) SensitiveKeys() []string { return nil } + var _ interfaces.ResourceDriver = (*RDSDriver)(nil) diff --git a/drivers/route53.go b/drivers/route53.go index 98b8245..6a62c2e 100644 --- a/drivers/route53.go +++ b/drivers/route53.go @@ -193,4 +193,7 @@ func r53ZoneToOutput(name string, zone *r53types.HostedZone) *interfaces.Resourc } } +// SensitiveKeys returns output keys whose values should be masked in logs and plan output. +func (d *Route53Driver) SensitiveKeys() []string { return nil } + var _ interfaces.ResourceDriver = (*Route53Driver)(nil) diff --git a/drivers/s3.go b/drivers/s3.go index e006683..607ea80 100644 --- a/drivers/s3.go +++ b/drivers/s3.go @@ -166,4 +166,7 @@ func s3BucketToOutput(name, region string) *interfaces.ResourceOutput { } } +// SensitiveKeys returns output keys whose values should be masked in logs and plan output. +func (d *S3Driver) SensitiveKeys() []string { return nil } + var _ interfaces.ResourceDriver = (*S3Driver)(nil) diff --git a/drivers/sg.go b/drivers/sg.go index abb2cd6..b9db268 100644 --- a/drivers/sg.go +++ b/drivers/sg.go @@ -224,4 +224,7 @@ func sgToOutput(name, groupID, vpcID string) *interfaces.ResourceOutput { } } +// SensitiveKeys returns output keys whose values should be masked in logs and plan output. +func (d *SecurityGroupDriver) SensitiveKeys() []string { return nil } + var _ interfaces.ResourceDriver = (*SecurityGroupDriver)(nil) diff --git a/drivers/vpc.go b/drivers/vpc.go index 7888ba4..7d4e9d3 100644 --- a/drivers/vpc.go +++ b/drivers/vpc.go @@ -166,4 +166,7 @@ func vpcToOutput(name string, vpc *ec2types.Vpc) *interfaces.ResourceOutput { } } +// SensitiveKeys returns output keys whose values should be masked in logs and plan output. +func (d *VPCDriver) SensitiveKeys() []string { return nil } + var _ interfaces.ResourceDriver = (*VPCDriver)(nil)