chore: harden repo defaults for secrets, deployment, and logging

1 files changed, 16 insertions, 7 deletions

diff --git a/src/srht_contrib/services/srht_client.py b/src/srht_contrib/services/srht_client.py
index c8e2649..ee09bff 100644
--- a/src/srht_contrib/services/srht_client.py
+++ b/src/srht_contrib/services/srht_client.py
@@ -13,6 +13,12 @@ class SourceHutClientError(RuntimeError):
     """Raised when a SourceHut GraphQL request fails."""
 
 
+def _graphql_error_summary(errors: Any) -> str:
+    if not isinstance(errors, list):
+        return "unexpected error payload"
+    return f"{len(errors)} GraphQL error(s)"
+
+
 class SourceHutGraphQLClient:
     def __init__(
         self,
@@ -42,20 +48,16 @@ class SourceHutGraphQLClient:
                 response.raise_for_status()
                 body = response.json()
             except httpx.HTTPStatusError as exc:
-                response_text = exc.response.text[:500]
                 logger.warning(
-                    "SourceHut HTTP failure from %s on attempt %s/%s: %s %s",
+                    "SourceHut HTTP failure from %s on attempt %s/%s: status=%s",
                     self.endpoint,
                     attempt,
                     attempts,
                     exc.response.status_code,
-                    response_text,
                 )
                 if exc.response.status_code >= 500 and attempt < attempts:
                     continue
-                raise SourceHutClientError(
-                    f"HTTP error from SourceHut: {exc.response.status_code} {response_text}".strip()
-                ) from exc
+                raise SourceHutClientError(f"HTTP error from SourceHut: {exc.response.status_code}") from exc
             except httpx.HTTPError as exc:
                 logger.warning(
                     "SourceHut network failure from %s on attempt %s/%s",
@@ -68,7 +70,14 @@ class SourceHutGraphQLClient:
                 raise SourceHutClientError("Network error while contacting SourceHut") from exc
 
             if "errors" in body:
-                raise SourceHutClientError(f"GraphQL errors returned by SourceHut: {body['errors']}")
+                logger.warning(
+                    "SourceHut GraphQL failure from %s: %s",
+                    self.endpoint,
+                    _graphql_error_summary(body["errors"]),
+                )
+                raise SourceHutClientError(
+                    f"GraphQL errors returned by SourceHut: {_graphql_error_summary(body['errors'])}"
+                )
             return body.get("data", {})
 
         raise SourceHutClientError("SourceHut request exhausted retries")