fix(settings): improve nop mode logging to protect config values

When running in nop mode without a check run (e.g. full-sync), the results previously went to info level logs. Since the full diff can contain sensitive configuration values like Actions variables, this now:
- Logs the full diff at debug level only
- Logs a summary at info level that excludes config values
- Shows the count of planned changes and references the debug log

Author: tdabasinskas

lib/settings.js

@@ -204,10 +204,14 @@ class Settings {
     })
 
     // A nop run triggered outside the webhook flow (e.g. the full-sync entrypoint)
-    // has no check run or repository in its payload, so there is nowhere to post
-    // the results other than the log.
+    // can be missing the check run and repository webhook fields in its payload.
+    // If either is absent there is no check run to report to, so put the plan in
+    // the log instead. The full diff can contain config values (e.g. Actions
+    // variables), so it goes to debug; info gets a summary without them.
     if (!payload?.check_run || !payload?.repository) {
-      this.log.info(`Dry-run results:\n${JSON.stringify(this.results, null, 2)}`)
+      this.log.debug(`Dry-run results:\n${JSON.stringify(this.results, null, 2)}`)
+      const summary = this.results.map(res => `${res.type} ${res.plugin} ${res.repo}: ${res.action?.msg ?? ''}`).join('\n')
+      this.log.info(`Dry-run finished with ${this.results.length} planned change(s); the full diff is logged at debug level.\n${summary}`)
       return
     }
 

test/unit/lib/settings.test.js

@@ -564,17 +564,19 @@ repository:
           repo: 'test/test-repo',
           endpoint: '',
           body: '',
-          action: { msg: 'Changes found', additions: {}, modifications: { branch: {} }, deletions: {} }
+          action: { msg: 'Changes found', additions: {}, modifications: { MY_VAR: { value: 'plain-value' } }, deletions: {} }
         }
       ]
     })
 
     describe('in nop mode without a check run in the payload (full sync)', () => {
-      it('logs the results instead of updating a check run', async () => {
+      it('logs a summary instead of updating a check run, keeping config values out of info', async () => {
         // stubContext.payload only contains `installation`, like a full-sync context
         await settings.handleResults()
 
         expect(stubContext.log.info).toHaveBeenCalledWith(expect.stringContaining('Changes found'))
+        expect(stubContext.log.info).not.toHaveBeenCalledWith(expect.stringContaining('plain-value'))
+        expect(stubContext.log.debug).toHaveBeenCalledWith(expect.stringContaining('plain-value'))
         expect(stubContext.octokit.rest.checks.update).not.toHaveBeenCalled()
       })
     })