fix(security): don't read the OAuth secret value in the orchestration debug printer (aws-samples#247 PR aws-samples#373 CodeQL high)

CodeQL flagged py/clear-text-logging-sensitive-data (HIGH) at
scripts/orchestration_debug.py:53 — the parent-meta printer derived
has_oauth via m.get('linear_oauth_secret_arn'), which READS the secret
ARN value (CodeQL's taint source) even though only 'yes'/'no' is printed.
The secret never actually reached output, but the value-read started the
taint. Fix: test KEY PRESENCE ('linear_oauth_secret_arn' in m) so the
secret string is never accessed at all — no taint source, and the printed
line provably logs only the parent issue id, repo, user id, and a
presence flag. Debug-only script (DynamoDB pretty-printer), not prod code.

Resolves the 1 high-severity CodeQL alert on PR aws-samples#373.

Author: isadeks

scripts/orchestration_debug.py

@@ -48,9 +48,16 @@ def main():
 
     for m in meta:
         n = m.get("child_count", {}).get("N", "?")
-        has_oauth = "yes" if m.get("linear_oauth_secret_arn") else "no"
-        print(f"  PARENT  issue={s(m, 'parent_linear_issue_id')}  repo={s(m, 'repo')}  children={n}")
-        print(f"          release_ctx: user={s(m, 'platform_user_id')}  oauth={has_oauth}")
+        # Never print the OAuth secret ARN/value — only WHETHER one is present.
+        # Test KEY PRESENCE (``in``) rather than reading the value with
+        # ``.get(...)``: the secret ARN string is never accessed, so it can't be
+        # logged and CodeQL's clear-text-logging-of-secrets taint never starts.
+        has_oauth = "yes" if "linear_oauth_secret_arn" in m else "no"
+        parent_issue = s(m, "parent_linear_issue_id")
+        repo = s(m, "repo")
+        user = s(m, "platform_user_id")
+        print(f"  PARENT  issue={parent_issue}  repo={repo}  children={n}")
+        print(f"          release_ctx: user={user}  oauth={has_oauth}")
 
     for k in sorted(kids, key=lambda i: s(i, "linear_identifier")):
         st = s(k, "child_status")