fix(ci): harden release and CodeQL checks

[elkaix]

Related Issue

No issue. This maintainer follow-up fixes failed main Release run 32620664188 and the linked CodeQL configuration warning.

Problem

The Nix lock freshness check preferred a release branch's stale upstream over the current default branch. Changesets release PRs could therefore fail after they reset onto a newer main. The CodeQL analysis also emitted an oversized related-location warning because public OAuth endpoint identifiers flowed directly into a SHA-256 filename fingerprint and were classified as password-like values.

What changed

• Compare lock and flake changes with origin/HEAD, then origin/main, before a branch upstream.
• Cover stale release upstreams and real lock-only feature changes with regression tests.
• Encode public endpoint identity as UTF-8 bytes before hashing in both credential-name implementations. This keeps the exact existing digest while preserving the full CodeQL security suite.
• Pin the existing scoped credential key in its test to protect compatibility.

Verification

• pnpm lint
• pnpm run typecheck
• pnpm run test
• pnpm run build
• nix build .#pythinker-code
• Focused Nix freshness, OAuth, and datasource plugin tests
• pnpm run sherif
• node scripts/check-nix-workspace.mjs
• Independent security, release-validation, and identifier audits: no findings

Checklist

• I have read the CONTRIBUTING document.
• No related issue is required for this maintainer CI and security follow-up.
• I have added tests that prove the fixes work.
• Ran gen-changesets; no changeset because behavior and published output are unchanged.
• No documentation update is needed because the change only repairs internal validation and equivalent digest input encoding.

Summary by CodeRabbit

• Bug Fixes

  • Improved release-branch checks to detect stale pinned hashes using the current default remote branch.
  • Updated OAuth and data-source credential hashing to consistently use UTF-8 encoding.
  • Refined diagnostics to more accurately describe potentially stale hashes.

• Tests

  • Added coverage for release-branch hash validation, including stale tracking and lock-only changes.
  • Strengthened OAuth key tests with exact expected derived values.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: d69d4fff-0945-4902-9690-196eee59af3f

📥 Commits

Reviewing files that changed from the base of the PR and between 0b3f72d and f37513c.

📒 Files selected for processing (5)

• apps/pythinker-code/test/scripts/check-nix-hash-fresh.test.ts
• packages/oauth/src/managed-pythinker-code.ts
• packages/oauth/test/managed-pythinker-code.test.ts
• plugins/official/pythinker-datasource/bin/pythinker-datasource.mjs
• scripts/check-nix-hash-fresh.mjs

Included review availability: Your plan provides up to 10 included reviews per hour; 8 remain after this review.

---

📝 Walkthrough

Walkthrough

The PR updates OAuth identity hashing to use UTF-8 bytes, improves Nix base-reference selection, revises stale-hash diagnostics, and adds integration tests for release and lockfile-only branches.

Changes

Nix hash freshness

Layer / File(s)	Summary
Base reference resolution and validation scripts/check-nix-hash-fresh.mjs, apps/pythinker-code/test/scripts/check-nix-hash-fresh.test.ts	The script checks origin/HEAD and origin/main before the configured upstream ref. Integration tests cover stale upstream tracking and lockfile-only changes.

OAuth identity hashing

Layer / File(s)	Summary
UTF-8 identity hashing packages/oauth/src/managed-pythinker-code.ts, plugins/official/pythinker-datasource/bin/pythinker-datasource.mjs, packages/oauth/test/managed-pythinker-code.test.ts	OAuth identity payloads are UTF-8 encoded before SHA-256 hashing. The development OAuth key test asserts the exact derived value.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Merge Risk: ⚪ Minimal · up to f3751

This PR hardens release validation and preserves OAuth digest compatibility; no actionable merge-blocking risk remains after normal checks and review.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title uses a valid conventional-commit prefix, stays within 72 characters, uses imperative mood, and accurately summarizes the changes.
Description check	✅ Passed	The description covers the problem, changes, verification, checklist, and rationale for omitting an issue, changeset, and documentation update.
Docstring Coverage	✅ Passed	Docstring check was indeterminate for this PR — some files could not be analyzed in time. Not blocking.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

_{Comment @coderabbitai help to get the list of available commands.}

[pkg-pr-new]

pnpm dlx https://pkg.pr.new/@pymodel/pythinker-code@f37513c

npx https://pkg.pr.new/@pymodel/pythinker-code@f37513c

commit: f37513c