fix(ci): harden release and CodeQL checks (#164)

## Related Issue

No issue. This maintainer follow-up fixes failed `main` Release run
32620664188 and the linked CodeQL configuration warning.

## Problem

The Nix lock freshness check preferred a release branch's stale upstream
over the current default branch. Changesets release PRs could therefore
fail after they reset onto a newer `main`. The CodeQL analysis also
emitted an oversized related-location warning because public OAuth
endpoint identifiers flowed directly into a SHA-256 filename fingerprint
and were classified as password-like values.

## What changed

- Compare lock and flake changes with `origin/HEAD`, then `origin/main`,
before a branch upstream.
- Cover stale release upstreams and real lock-only feature changes with
regression tests.
- Encode public endpoint identity as UTF-8 bytes before hashing in both
credential-name implementations. This keeps the exact existing digest
while preserving the full CodeQL security suite.
- Pin the existing scoped credential key in its test to protect
compatibility.

## Verification

- `pnpm lint`
- `pnpm run typecheck`
- `pnpm run test`
- `pnpm run build`
- `nix build .#pythinker-code`
- Focused Nix freshness, OAuth, and datasource plugin tests
- `pnpm run sherif`
- `node scripts/check-nix-workspace.mjs`
- Independent security, release-validation, and identifier audits: no
findings

## Checklist

- [x] I have read the
[CONTRIBUTING](https://github.com/PyModel/pythinker-code/blob/main/CONTRIBUTING.md)
document.
- [x] No related issue is required for this maintainer CI and security
follow-up.
- [x] I have added tests that prove the fixes work.
- [x] Ran `gen-changesets`; no changeset because behavior and published
output are unchanged.
- [x] No documentation update is needed because the change only repairs
internal validation and equivalent digest input encoding.


<!-- This is an auto-generated comment: release notes by coderabbit.ai
-->

## Summary by CodeRabbit

* **Bug Fixes**
* Improved release-branch checks to detect stale pinned hashes using the
current default remote branch.
* Updated OAuth and data-source credential hashing to consistently use
UTF-8 encoding.
* Refined diagnostics to more accurately describe potentially stale
hashes.

* **Tests**
* Added coverage for release-branch hash validation, including stale
tracking and lock-only changes.
  * Strengthened OAuth key tests with exact expected derived values.

<!-- end of auto-generated comment: release notes by coderabbit.ai -->

Author: elkaix

apps/pythinker-code/test/scripts/check-nix-hash-fresh.test.ts

@@ -0,0 +1,89 @@
+import { execFileSync, spawnSync, type SpawnSyncReturns } from 'node:child_process';
+import { mkdtempSync, rmSync, writeFileSync } from 'node:fs';
+import { tmpdir } from 'node:os';
+import { join, resolve } from 'node:path';
+
+import { afterEach, describe, expect, it } from 'vitest';
+
+const checkScript = resolve(import.meta.dirname, '../../../../scripts/check-nix-hash-fresh.mjs');
+const tempRoots: string[] = [];
+
+afterEach(() => {
+  for (const root of tempRoots.splice(0)) rmSync(root, { recursive: true, force: true });
+});
+
+describe('check-nix-hash-fresh', () => {
+  it('uses current origin/main when a release branch tracks a stale upstream', () => {
+    const root = makeRepository('changeset-release/main');
+    const staleRelease = revParse(root, 'HEAD');
+    setRemoteRef(root, 'changeset-release/main', staleRelease);
+
+    git(root, ['switch', '-c', 'main']);
+    writeFileSync(join(root, 'pnpm-lock.yaml'), 'lock from current main\n');
+    commit(root, 'update lock on main');
+    const currentMain = revParse(root, 'HEAD');
+    setRemoteRef(root, 'main', currentMain);
+
+    git(root, ['switch', 'changeset-release/main']);
+    git(root, ['reset', '--hard', currentMain]);
+    writeFileSync(join(root, 'package.json'), '{"version":"1.0.1"}\n');
+    commit(root, 'version packages');
+
+    const result = runCheck(root);
+    expect(result.status, result.stderr).toBe(0);
+  });
+
+  it('keeps a lock-only branch change gated after that change reaches its upstream', () => {
+    const root = makeRepository('feature');
+    const currentMain = revParse(root, 'HEAD');
+    setRemoteRef(root, 'main', currentMain);
+
+    writeFileSync(join(root, 'pnpm-lock.yaml'), 'unmatched lock change\n');
+    commit(root, 'update lock without flake');
+    setRemoteRef(root, 'feature', revParse(root, 'HEAD'));
+    writeFileSync(join(root, 'README.md'), 'follow-up\n');
+    commit(root, 'add follow-up');
+
+    const result = runCheck(root);
+    expect(result.status, result.stderr).toBe(1);
+    expect(result.stderr).toContain('pnpm-lock.yaml changed on this branch but flake.nix did not');
+  });
+});
+
+function makeRepository(branch: string): string {
+  const root = mkdtempSync(join(tmpdir(), 'pythinker-nix-hash-check-'));
+  tempRoots.push(root);
+  git(root, ['init', '--initial-branch', branch]);
+  git(root, ['config', 'core.hooksPath', '.git/no-hooks']);
+  git(root, ['config', 'user.name', 'Test User']);
+  git(root, ['config', 'user.email', 'test@example.test']);
+  git(root, ['config', 'commit.gpgSign', 'false']);
+  git(root, ['remote', 'add', 'origin', join(root, 'unused-origin.git')]);
+  writeFileSync(join(root, 'pnpm-lock.yaml'), 'initial lock\n');
+  writeFileSync(join(root, 'flake.nix'), 'initial flake\n');
+  commit(root, 'initial');
+  return root;
+}
+
+function commit(root: string, message: string): void {
+  git(root, ['add', '.']);
+  git(root, ['commit', '-m', message]);
+}
+
+function setRemoteRef(root: string, branch: string, sha: string): void {
+  git(root, ['update-ref', `refs/remotes/origin/${branch}`, sha]);
+  git(root, ['config', `branch.${branch}.remote`, 'origin']);
+  git(root, ['config', `branch.${branch}.merge`, `refs/heads/${branch}`]);
+}
+
+function revParse(root: string, ref: string): string {
+  return git(root, ['rev-parse', ref]);
+}
+
+function git(root: string, args: string[]): string {
+  return execFileSync('git', args, { cwd: root, encoding: 'utf8' }).trim();
+}
+
+function runCheck(root: string): SpawnSyncReturns<string> {
+  return spawnSync(process.execPath, [checkScript], { cwd: root, encoding: 'utf8' });
+}

packages/oauth/src/managed-pythinker-code.ts

@@ -333,8 +333,11 @@ export function resolvePythinkerCodeOAuthKey(options: {
     return PYTHINKER_CODE_OAUTH_KEY;
   }
 
+  const publicEndpointIdentity = new TextEncoder().encode(
+    JSON.stringify({ oauthHost, baseUrl }),
+  );
   const digest = createHash('sha256')
-    .update(JSON.stringify({ oauthHost, baseUrl }))
+    .update(publicEndpointIdentity)
     .digest('hex')
     .slice(0, 16);
   return `${PYTHINKER_CODE_SCOPED_OAUTH_KEY_PREFIX}${digest}`;

packages/oauth/test/managed-pythinker-code.test.ts

@@ -61,8 +61,7 @@ describe('provisionManagedPythinkerCodeConfig', () => {
       baseUrl: 'https://api.dev.example.test/coding/v1',
     });
 
-    expect(devKey).not.toBe(PYTHINKER_CODE_OAUTH_KEY);
-    expect(devKey).toMatch(/^oauth\/pythinker-code-env-[a-f0-9]{16}$/);
+    expect(devKey).toBe('oauth/pythinker-code-env-51d35a57390d1c7e');
     expect(
       resolvePythinkerCodeOAuthKey({
         oauthHost: 'https://auth.dev.example.test/',

plugins/official/pythinker-datasource/bin/pythinker-datasource.mjs

@@ -299,8 +299,11 @@ function resolvePythinkerCodeCredentialName() {
   }
 
   // Keep this in sync with packages/oauth/src/managed-pythinker-code.ts.
+  const publicEndpointIdentity = new TextEncoder().encode(
+    JSON.stringify({ oauthHost, baseUrl }),
+  );
   const digest = createHash('sha256')
-    .update(JSON.stringify({ oauthHost, baseUrl }))
+    .update(publicEndpointIdentity)
     .digest('hex')
     .slice(0, 16);
   return `pythinker-code-env-${digest}`;

scripts/check-nix-hash-fresh.mjs

@@ -18,15 +18,20 @@ function git(args) {
 }
 
 function resolveBaseRef() {
-  try {
-    const upstream = git(['rev-parse', '--abbrev-ref', '--symbolic-full-name', '@{u}']);
-    if (upstream) return upstream;
-  } catch {
-    // no upstream configured
+  for (const [ref, fullRef] of [
+    ['origin/HEAD', 'refs/remotes/origin/HEAD'],
+    ['origin/main', 'refs/remotes/origin/main'],
+  ]) {
+    try {
+      git(['show-ref', '--verify', '--quiet', fullRef]);
+      return ref;
+    } catch {
+      // ref is unavailable
+    }
   }
   try {
-    git(['show-ref', '--verify', '--quiet', 'refs/remotes/origin/HEAD']);
-    return 'origin/HEAD';
+    const upstream = git(['rev-parse', '--abbrev-ref', '--symbolic-full-name', '@{u}']);
+    return upstream || null;
   } catch {
     return null;
   }
@@ -57,7 +62,7 @@ if (!lockChanged || flakeChanged) {
 
 console.error(
   '❌ pnpm-lock.yaml changed on this branch but flake.nix did not.\n' +
-    "   flake.nix pins a fetchPnpmDeps hash of pnpm-lock.yaml; CI's nix build will fail with a hash mismatch.\n" +
+    '   flake.nix pins a fetchPnpmDeps hash of pnpm-lock.yaml, so its hash may be stale.\n' +
     '   Refresh it: run a nix build (e.g. `nix build .#pythinker-code`), take the sha256-... hash\n' +
     '   from the mismatch error, paste it into the `hash = "sha256-...";` line in flake.nix, commit, and re-push.',
 );