fix(security): close open CodeQL alerts (0600 lock file, hostname-safe URL asserts, pinned actions)

.github/workflows/docker.yml

@@ -87,13 +87,13 @@ jobs:
           persist-credentials: false
 
       - name: Set up QEMU (multi-arch emulation)
-        uses: docker/setup-qemu-action@v4
+        uses: docker/setup-qemu-action@96fe6ef7f33517b61c61be40b68a1882f3264fb8 # v4.2.0
 
       - name: Set up Docker Buildx
-        uses: docker/setup-buildx-action@v4
+        uses: docker/setup-buildx-action@bb05f3f5519dd87d3ba754cc423b652a5edd6d2c # v4.2.0
 
       - name: Log in to GitHub Container Registry
-        uses: docker/login-action@v4
+        uses: docker/login-action@af1e73f918a031802d376d3c8bbc3fe56130a9b0 # v4.4.0
         with:
           registry: ghcr.io
           username: ${{ github.actor }}
@@ -140,7 +140,7 @@ jobs:
 
       - name: Build and push image
         id: build
-        uses: docker/build-push-action@v7
+        uses: docker/build-push-action@53b7df96c91f9c12dcc8a07bcb9ccacbed38856a # v7.3.0
         with:
           context: .
           file: ./Dockerfile

.github/workflows/publish.yml

@@ -69,7 +69,7 @@ jobs:
       # Trusted Publishing — no API token needed; PyPI verifies the GitHub
       # workflow's OIDC identity. skip-existing: true makes retries idempotent.
       - name: Publish to PyPI
-        uses: pypa/gh-action-pypi-publish@release/v1
+        uses: pypa/gh-action-pypi-publish@ba38be9e461d3875417946c167d0b5f3d385a247 # v1.14.1
         with:
           skip-existing: true
 

src/althing/checkpoint.py

@@ -169,7 +169,7 @@ def _acquire_dir_lock(directory: Path) -> int | None:
     if fcntl is None:  # pragma: no cover - Windows path
         return None
     path = _lock_path(directory)
-    fd = os.open(str(path), os.O_RDWR | os.O_CREAT, 0o644)
+    fd = os.open(str(path), os.O_RDWR | os.O_CREAT, 0o600)
     try:
         fcntl.flock(fd, fcntl.LOCK_EX | fcntl.LOCK_NB)
     except (BlockingIOError, OSError) as exc:

tests/test_credentials.py

@@ -4,8 +4,10 @@
 
 import json
 import os
+import re
 import stat
 from pathlib import Path
+from urllib.parse import urlparse
 
 import pytest
 
@@ -352,7 +354,8 @@ def test_anthropic_message_warns_about_claude_code_oauth_footgun(self):
         assert "Claude Code" in msg
         assert "OAuth" in msg
         assert "NOT reusable" in msg
-        assert "console.anthropic.com" in msg
+        linked_hosts = [urlparse(u).hostname for u in re.findall(r"https?://[^\s]+", msg)]
+        assert any(host == "console.anthropic.com" for host in linked_hosts)
 
     def test_openai_message_names_provider_and_skips_oauth_note(self):
         msg = missing_api_key_message("OPENAI_API_KEY")

tests/test_pack_calibrate.py

@@ -13,6 +13,7 @@
 
 from pathlib import Path
 from unittest.mock import patch
+from urllib.parse import urlparse
 
 import pytest
 import yaml
@@ -47,7 +48,8 @@ def test_calibration_entry_to_yaml_dict_drops_none_alignment_error():
     assert d["dataset"] == "gss"
     assert d["jsd"] == 0.18
     assert d["models"] == ["haiku:0.5", "gemini-flash-lite:0.5"]
-    assert d["methodology_url"].startswith("https://althing.dev")
+    methodology = urlparse(d["methodology_url"])
+    assert (methodology.scheme, methodology.hostname) == ("https", "althing.dev")
 
 
 def test_calibration_entry_keeps_alignment_error_when_set():