chore(repo-assist): fix(security): stop logging Expo push credentials

[github-actions]

🤖 This is an automated pull request from Repo Assist.

Summary

Removes Expo push token values and raw API response bodies from Home Assistant logs. The _send_expo_push function had leftover debug logging that emitted device push tokens at INFO level, exposing credentials to anyone with log access.

Root cause: Development debug logging was never cleaned up before shipping.

Fix:

• Remove token value from log output (was logging first 50 chars of the token)
• Downgrade spurious INFO logs to DEBUG for routine operational messages
• Remove raw API response body from logs
• Clean up PUSH DEBUG prefix noise

Closes #32

Test Status

No test changes needed — this is a log-verbosity-only fix. python3 -m compileall custom_components passes. The _send_expo_push function is integration-level code that requires a live HA instance and real Expo credentials to test end-to-end.

Warning

Firewall blocked 1 domain

The following domain was blocked by the firewall during workflow execution:

• awmgmcpg

To allow these domains, add them to the network.allowed list in your workflow frontmatter:

network:
  allowed:
    - defaults
    - "awmgmcpg"

See Network Configuration for more information.

🤖 This is an automated response from Repo Assist. Generated by 🌈 Repo Assist; see workflow run. Learn more.
_{Comment /repo-assist to run again}

_{Add this agentic workflow to your repo}

To install this agentic workflow, run

gh aw add githubnext/agentics/workflows/repo-assist.md@1c6668b751c51af8571f01204ceffb19362e0f66

---

Note

This was originally intended as a pull request, but GitHub Actions is not permitted to create or approve pull requests in this repository.
The changes have been pushed to branch repo-assist/fix-issue-32-stop-logging-expo-push-tokens-39abf454af7f66f7.

Click here to create the pull request

To fix the permissions issue, go to Settings → Actions → General and enable Allow GitHub Actions to create and approve pull requests. See also: gh-aw FAQ

Show patch preview (130 of 130 lines)

From 4dc3e13eebbe434d9fd248eb89c9dadf7599a38d Mon Sep 17 00:00:00 2001
From: "github-actions[bot]"
 <41898282+github-actions[bot]@users.noreply.github.com>
Date: Wed, 22 Jul 2026 12:22:05 +0000
Subject: [PATCH] fix(security): stop logging Expo push credentials

The _send_expo_push function logged push token values at INFO level,
exposing device credentials in Home Assistant logs. These debug logs
were leftover from development and should never appear in production.

Changes:
- Remove token value from log output (was logging first 50 chars)
- Downgrade spurious INFO logs to DEBUG
- Remove raw API response body from logs
- Clean up PUSH DEBUG prefix noise

Fixes #32

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---
 .../power_sync/automations/actions.py         | 43 +++++++------------
 1 file changed, 16 insertions(+), 27 deletions(-)

diff --git a/custom_components/power_sync/automations/actions.py b/custom_components/power_sync/automations/actions.py
index e2868675..245e16e1 100644
--- a/custom_components/power_sync/automations/actions.py
+++ b/custom_components/power_sync/automations/actions.py
@@ -2218,15 +2218,15 @@ async def _send_expo_push(hass: HomeAssistant, title: str, message: str) -> None
     from ..const import DOMAIN
     import aiohttp
 
-    _LOGGER.info(f"📱 PUSH DEBUG: Attempting to send notification - Title: '{title}', Message: '{message}'")
+    _LOGGER.debug("📱 Sending push notification: %s", title)
 
     # Get registered push tokens
     push_tokens = hass.data.get(DOMAIN, {}).get("push_tokens", {})
     if not push_tokens:
-        _LOGGER.warning("📱 PUSH DEBUG: No push tokens registered in hass.data[DOMAIN]['push_tokens'], skipping notification")
+        _LOGGER.debug("📱 No push tokens registered, skipping notification")
         return
 
-    _LOGGER.info(f"📱 PUSH DEBUG: Found {len(push_tokens)} registered push token(s)")
+    _LOGGER.debug("📱 Found %d registered push token(s)", len(push_tokens))
 
     # Prepa
... (truncated)