Report secrets bootstrap outcomes safely

internal/app/secrets_bootstrap.go

@@ -4,6 +4,7 @@ import (
 	"bytes"
 	"errors"
 	"fmt"
+	"io"
 	"os"
 	"path/filepath"
 	"strings"
@@ -17,7 +18,7 @@ type secretsBootstrap struct {
 	called       bool
 }
 
-func (b *secretsBootstrap) load(pipelinePath string, loader func(string) (*configkit.SecretsReport, error)) error {
+func (b *secretsBootstrap) load(pipelinePath string, loader func(string) (*configkit.SecretsReport, error), diagnostics io.Writer) error {
 	if b == nil || b.called {
 		return nil
 	}
@@ -35,6 +36,11 @@ func (b *secretsBootstrap) load(pipelinePath string, loader func(string) (*confi
 	}
 	report, loadErr := loader(directory)
 	if loadErr == nil {
+		if report != nil {
+			if _, err := report.WriteTo(diagnostics); err != nil {
+				return fmt.Errorf("write secrets bootstrap report: %w", err)
+			}
+		}
 		return nil
 	}
 	var rendered bytes.Buffer