From 384ebe9cf75953f8d97f528e16ee0c48e0df4829 Mon Sep 17 00:00:00 2001
From: Cory Davenport <Cory.Davenport@goeverbright.com>
Date: Thu, 30 Jul 2026 13:13:16 -0400
Subject: [PATCH] fix: paginate environment and repo variable API calls

GitHub's Actions Variables API returns results paginated with a default
page size of 10. Repos or environments with more than 10 variables would
only have the first page fetched, causing safe-settings to incorrectly
treat the remaining variables as additions on every sync.

Switch variables.js and environments.js to use github.paginate() with
per_page: 100, and add a || [] guard on the mapper so that environments
with zero variables don't inject undefined into the accumulated array.
---
 lib/plugins/environments.js | 10 +++++-----
 lib/plugins/variables.js    |  9 +++++----
 2 files changed, 10 insertions(+), 9 deletions(-)

diff --git a/lib/plugins/environments.js b/lib/plugins/environments.js
index 73bef0e0f..736f1b285 100644
--- a/lib/plugins/environments.js
+++ b/lib/plugins/environments.js
@@ -71,11 +71,11 @@ module.exports = class Environments extends Diffable {
                 type: policy.type
               }))
             },
-        variables: (await this.github.request('GET /repos/:org/:repo/environments/:environment_name/variables', {
-          org: this.repo.owner,
-          repo: this.repo.repo,
-          environment_name: environment.name
-        })).data.variables.map(variable => ({ name: variable.name.toLowerCase(), value: variable.value })),
+        variables: (await this.github.paginate(
+          'GET /repos/{owner}/{repo}/environments/{environment_name}/variables',
+          { owner: this.repo.owner, repo: this.repo.repo, environment_name: environment.name, per_page: 100 },
+          (response) => response.data.variables || []
+        )).map(variable => ({ name: variable.name.toLowerCase(), value: variable.value })),
         deployment_protection_rules: (await this.github.request('GET /repos/:org/:repo/environments/:environment_name/deployment_protection_rules', {
           org: this.repo.owner,
           repo: this.repo.repo,
diff --git a/lib/plugins/variables.js b/lib/plugins/variables.js
index a8e65b91e..c01084a0c 100644
--- a/lib/plugins/variables.js
+++ b/lib/plugins/variables.js
@@ -14,10 +14,11 @@ module.exports = class Variables extends Diffable {
 
   find () {
     this.log.debug(`Finding repo vars for ${this.repo.owner}/${this.repo.repo}`)
-    return this.github.request('GET /repos/:org/:repo/actions/variables', {
-      org: this.repo.owner,
-      repo: this.repo.repo
-    }).then(({ data: { variables } }) => variables.map(({ name, value }) => ({ name, value })))
+    return this.github.paginate(
+      'GET /repos/{owner}/{repo}/actions/variables',
+      { owner: this.repo.owner, repo: this.repo.repo, per_page: 100 },
+      (response) => response.data.variables || []
+    ).then(variables => variables.map(({ name, value }) => ({ name, value })))
   }
 
   comparator (existing, attrs) {