Keep the token out of the debug output

lib/src/Gren.js

@@ -2300,10 +2300,15 @@ class Gren {
         .toLowerCase()
         .replace(/\w/, (a) => a.toUpperCase());
     const outputs = Object.entries(options)
-      .filter((option) => option !== "debug")
-      .map(
-        ([key, value]) => `${chalk.yellow(camelcaseToSpaces(key))}: ${value.toString() || "empty"}`,
-      );
+      .filter(([key]) => key !== "debug")
+      .map(([key, value]) => {
+        // --debug is the first thing anyone turns on in CI, and its output is the whole
+        // options object. A build log is not a private place to keep a credential that can
+        // write to the repository, so report that the token is set and not what it is.
+        const shown = key === "token" ? "<hidden>" : value.toString() || "empty";
+
+        return `${chalk.yellow(camelcaseToSpaces(key))}: ${shown}`;
+      });
 
     process.stdout.write("\n" + chalk.blue("Options: \n") + outputs.join("\n") + "\n");
   }

test/Gren.membership.spec.js

@@ -765,6 +765,27 @@ describe("Gren release membership", () => {
       assert.throws(() => createGren({ pullRequestRepos: ["just-a-name"] }), /owner\/repo/);
     });
 
+    it("Should not print the token in the debug output", () => {
+      // --debug is the first thing anyone turns on in CI, and a build log is not a private
+      // place to keep a credential that can write to the repository.
+      const written = [];
+      const { write } = process.stdout;
+
+      process.stdout.write = (chunk) => written.push(String(chunk));
+
+      try {
+        createGren({ debug: true, token: "ghp_averysecrettoken" });
+      } finally {
+        process.stdout.write = write;
+      }
+
+      const output = written.join("");
+
+      assert.notInclude(output, "ghp_averysecrettoken", "The token is not in the output");
+      assert.include(output, "Token:", "The option is still reported");
+      assert.include(output, "Repo: current", "The other options are still reported");
+    });
+
     it("Should reject commitNotes keys that are not commit SHAs", () => {
       assert.throws(() => createGren({ commitNotes: { abc: {} } }), /at least 7 characters/);
     });