Authentication and security

[TinaHeiligers]

User Story ID: OAS-011

Description: As a security-conscious developer, I want the validation system to handle API specifications securely and not expose sensitive information, following existing Kibana security patterns and Buildkite integration standards.

Acceptance Criteria:

• Processes OAS files without persistent storage of sensitive data, following existing scripts/validate_oas_docs.js security patterns
• Uses secure GitHub API authentication for PR comment creation, leveraging current capture_oas_snapshot authentication mechanisms
• Complies with Kibana security standards for CI/CD integration using existing Buildkite security configurations
• Validates security annotations without exposing security details, building on current @kbn/validate-oas security-aware processing
• Maintains audit trails for validation system access and usage through existing Buildkite logging infrastructure
• Ensures secure handling of API specifications according to new contribution guidelines' security requirements
• Integrates with existing Kibana authentication and authorization patterns for tool access

Priority: High
Phase: 3 - CI/CD Integration

Related Files:

• scripts/validate_oas_docs.js
• .buildkite/scripts/steps/checks/capture_oas_snapshot.sh
• packages/kbn-validate-oas/

Implementation Notes:

• Review existing capture_oas_snapshot security implementation patterns
• Ensure enhanced CLI tool follows current Kibana security guidelines
• Implement secure credential handling for GitHub API integration

This issue is part of the OAS Quality Feedback Automation project tracked in elastic/kibana-team#1971.

[elasticmachine]

Pinging @elastic/kibana-core (Team:Core)

[TinaHeiligers]

AOS generation and validation is handled in dev and doesn't expose sensitive info. Closing as not needed.