Do not call setSecret on any unmasked secrets (#17)

* Do not call `setSecret` on any unmasked secrets

Right now, every value that's pulled from Doppler is marked as a secret
in GitHub Actions, which means any workflow using this action ends up
with a ton of unnecessary redactions.

For example, if you have the following Doppler values:

```
NODE_ENV = test
WORKER_COUNT = 3
```

Then *every* output that includes `test` and the number 3 gets redacted,
making the output rather difficult to read. Now I'm unable to tell the
real difference between Listing and Downloading secrets, but from what I
can tell from the [api
docs](https://docs.doppler.com/reference/secrets-list) only List Secrets
includes the visibility information, so I had to change how secrets are
pulled.

Fixes #16

* Add some debugging

* Provide fallback to raw secret

* Need to return the nested `secrets` object

* Clear out the debugging lines

* Remove `raw` fallback, that's not necessary

doppler.js

@@ -6,15 +6,15 @@ import { VERSION } from "./meta.js";
  * @param {string} dopplerToken
  * @param {string | null} [dopplerProject]
  * @param {string | null} [dopplerConfig]
- * @returns {() => Promise<Record<string, string>>}
+ * @returns {() => Promise<Record<string, Record>>}
  */
 async function fetch(dopplerToken, dopplerProject, dopplerConfig) {
   return new Promise(function (resolve, reject) {
     const encodedAuthData = Buffer.from(`${dopplerToken}:`).toString("base64");
     const authHeader = `Basic ${encodedAuthData}`;
     const userAgent = `secrets-fetch-github-action/${VERSION}`;
 
-    const url = new URL("https://api.doppler.com/v3/configs/config/secrets/download?format=json");
+    const url = new URL("https://api.doppler.com/v3/configs/config/secrets");
     if (dopplerProject && dopplerConfig) {
       url.searchParams.append("project", dopplerProject);
       url.searchParams.append("config", dopplerConfig);
@@ -27,14 +27,15 @@ async function fetch(dopplerToken, dopplerProject, dopplerConfig) {
           headers: {
             Authorization: authHeader,
             "user-agent": userAgent,
+            "accepts": "application/json",
           },
         },
         (res) => {
           let payload = "";
           res.on("data", (data) => (payload += data));
           res.on("end", () => {
             if (res.statusCode === 200) {
-              resolve(JSON.parse(payload));
+              resolve(JSON.parse(payload).secrets);
             } else {
               try {
                 const error = JSON.parse(payload).messages.join(" ");

index.js

@@ -27,9 +27,11 @@ if (IS_SA_TOKEN && !(DOPPLER_PROJECT && DOPPLER_CONFIG)) {
 
 const secrets = await fetch(DOPPLER_TOKEN, DOPPLER_PROJECT, DOPPLER_CONFIG);
 
-for (const [key, value] of Object.entries(secrets)) {
+for (const [key, secret] of Object.entries(secrets)) {
+  const value = secret.computed || "";
+
   core.setOutput(key, value);
-  if (!DOPPLER_META.includes(key)) {
+  if (!DOPPLER_META.includes(key) && secret.computedVisibility !== "unmasked") {
     core.setSecret(value);
   }