chore(repo-assist): fix(security): stop logging Expo push credentials

[github-actions]

🤖 This is an automated pull request from Repo Assist.

Summary

Removes Expo push token values and raw API response bodies from Home Assistant logs. The _send_expo_push function had leftover debug logging that emitted device push tokens at INFO level, exposing credentials to anyone with log access.

Root cause: Development debug logging was never cleaned up before shipping.

Fix: Strip token values from all log lines, downgrade INFO→DEBUG for routine operational messages, remove raw API response body from logs, and clean up the PUSH DEBUG: prefix noise.

Changes

• automations/actions.py: Replace credential-exposing logs with safe debug messages

Test Status

python3.12 -m pytest tests/test_sigenergy_automation_actions.py
7 passed in 0.38s

Full suite: 1931 passed, 58 failed (all pre-existing test-isolation failures -- see AGENTS.md)

Closes #32

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🤖 This is an automated response from Repo Assist. Generated by 🌈 Repo Assist; see workflow run. Learn more.
_{Comment /repo-assist to run again}

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/repo-assist.md@1c6668b751c51af8571f01204ceffb19362e0f66

---

Note

This was originally intended as a pull request, but GitHub Actions is not permitted to create or approve pull requests in this repository.
The changes have been pushed to branch repo-assist/fix-issue-32-stop-logging-expo-push-tokens-33b494b1345a3fd5.

Click here to create the pull request

To fix the permissions issue, go to Settings → Actions → General and enable Allow GitHub Actions to create and approve pull requests. See also: gh-aw FAQ

Show patch preview (129 of 129 lines)

From 7a99b9cde82e2ffdbff0a81867c0f364cb2a4dbf Mon Sep 17 00:00:00 2001
From: "github-actions[bot]" <github-actions[bot]@users.noreply.github.com>
Date: Wed, 22 Jul 2026 12:13:06 +0000
Subject: [PATCH] fix(security): stop logging Expo push credentials

The _send_expo_push function logged push token values at INFO level,
exposing device credentials in Home Assistant logs. These debug logs
were leftover from development and should never appear in production.

Changes:
- Remove token value from log output (was logging first 50 chars)
- Downgrade spurious INFO logs to DEBUG
- Remove raw API response body from logs
- Clean up PUSH DEBUG prefix noise

Fixes #32

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .../power_sync/automations/actions.py         | 43 +++++++------------
 1 file changed, 16 insertions(+), 27 deletions(-)

diff --git a/custom_components/power_sync/automations/actions.py b/custom_components/power_sync/automations/actions.py
index e2868675..245e16e1 100644
--- a/custom_components/power_sync/automations/actions.py
+++ b/custom_components/power_sync/automations/actions.py
@@ -2218,15 +2218,15 @@ async def _send_expo_push(hass: HomeAssistant, title: str, message: str) -> None
     from ..const import DOMAIN
     import aiohttp
 
-    _LOGGER.info(f"📱 PUSH DEBUG: Attempting to send notification - Title: '{title}', Message: '{message}'")
+    _LOGGER.debug("📱 Sending push notification: %s", title)
 
     # Get registered push tokens
     push_tokens = hass.data.get(DOMAIN, {}).get("push_tokens", {})
     if not push_tokens:
-        _LOGGER.warning("📱 PUSH DEBUG: No push tokens registered in hass.data[DOMAIN]['push_tokens'], skipping notification")
+        _LOGGER.debug("📱 No push tokens registered, skipping notification")
         return
 
-    _LOGGER.info(f"📱 PUSH DEBUG: Found {len(push_tokens)} registered push token(s)")
+    _LOGGER.debug("📱 Found %d registered push token(s)", len(push_tokens))
 
     # Prepare message
... (truncated)