fix: harden release artifact checks and fixture isolation

scripts/release-check.ts

@@ -1,27 +1,46 @@
 import { spawnSync } from 'node:child_process';
+import { readdirSync, readFileSync, statSync } from 'node:fs';
 import { parseCapabilityAllowlist, releaseIdIsImmutable } from '../src/lib/server/release-gate';
 
+const RELEASE_ENVIRONMENTS = new Set(['fixture', 'development', 'staging', 'production']);
+const DIGEST_IMAGE = /@sha256:[a-f0-9]{64}$/i;
+
 type ReleaseCheckInput = {
   mode: string;
   releaseId: string;
   releaseEnvironment: string;
   dashboardImage: string;
+  convexImage: string;
+  dockerfile: string;
   capabilityAllowlist: string | undefined;
   trackedFiles: readonly string[];
+  browserBundleFiles?: readonly string[];
 };
 
 export function releaseSafetyErrors(input: ReleaseCheckInput): string[] {
   const errors: string[] = [];
   try { parseCapabilityAllowlist(input.capabilityAllowlist); }
   catch (error) { errors.push(error instanceof Error ? error.message : 'Invalid capability allowlist'); }
+  if (!RELEASE_ENVIRONMENTS.has(input.releaseEnvironment)) {
+    errors.push('RELEASE_ENV must be explicitly set to fixture, development, staging, or production');
+  }
 
   const strictEnvironment = input.releaseEnvironment === 'production' || input.releaseEnvironment === 'staging';
   if (!releaseIdIsImmutable(input.releaseId, strictEnvironment ? 'production' : 'development')) {
     errors.push('APP_RELEASE_ID must be a non-placeholder immutable identifier for this release environment');
   }
-  if (strictEnvironment && !input.dashboardImage.includes('@sha256:')) {
+  if (strictEnvironment && !DIGEST_IMAGE.test(input.dashboardImage)) {
     errors.push('CONVEX_DASHBOARD_IMAGE must be digest-pinned for staging/production');
   }
+  if (strictEnvironment && !DIGEST_IMAGE.test(input.convexImage)) {
+    errors.push('CONVEX_IMAGE must be digest-pinned for staging/production');
+  }
+  if (strictEnvironment) {
+    const baseImages = [...input.dockerfile.matchAll(/^FROM\s+([^\s]+)(?:\s+AS\s+[^\s]+)?$/gim)].map((match) => match[1]);
+    if (baseImages.length === 0 || baseImages.some((image) => !DIGEST_IMAGE.test(image))) {
+      errors.push('Dockerfile base images must be digest-pinned for staging/production');
+    }
+  }
   if (input.mode === 'demo' && strictEnvironment) {
     errors.push('APP_MODE=demo is not permitted for a staging/production release');
   }
@@ -30,6 +49,9 @@ export function releaseSafetyErrors(input: ReleaseCheckInput): string[] {
       errors.push(`secret-like file is tracked: ${file}`);
     }
   }
+  if ((input.browserBundleFiles ?? []).length > 0) {
+    errors.push('browser client artifacts contain managed secret names');
+  }
   return errors;
 }
 
@@ -39,15 +61,36 @@ function trackedFiles(): string[] {
   return result.stdout.split('\n').filter(Boolean);
 }
 
+const MANAGED_SECRET_NAMES = ['TOKEN_ENCRYPTION_KEY', 'CONVEX_BRIDGE_SECRET', 'APP_AUTH_PRIVATE_KEY', 'TYPESAFE_API_KEY', 'refresh_token'];
+function browserBundleFiles(directory = 'build/client'): string[] {
+  try { statSync(directory); } catch { return []; }
+  const files: string[] = [];
+  const visit = (path: string) => {
+    for (const entry of readdirSync(path, { withFileTypes: true })) {
+      const child = `${path}/${entry.name}`;
+      if (entry.isDirectory()) visit(child);
+      else if (entry.isFile()) {
+        const source = readFileSync(child, 'utf8');
+        if (MANAGED_SECRET_NAMES.some((name) => source.includes(name))) files.push(child);
+      }
+    }
+  };
+  visit(directory);
+  return files;
+}
+
 if (import.meta.main) {
-  const releaseEnvironment = process.env.RELEASE_ENV ?? (process.env.APP_MODE === 'demo' ? 'fixture' : 'development');
+  const releaseEnvironment = process.env.RELEASE_ENV ?? (process.env.APP_MODE === 'demo' ? 'fixture' : '');
   const errors = releaseSafetyErrors({
     mode: process.env.APP_MODE ?? 'live',
     releaseId: process.env.APP_RELEASE_ID ?? 'local',
     releaseEnvironment,
     dashboardImage: process.env.CONVEX_DASHBOARD_IMAGE ?? '',
+    convexImage: process.env.CONVEX_IMAGE ?? '',
+    dockerfile: readFileSync(new URL('../Dockerfile', import.meta.url), 'utf8'),
     capabilityAllowlist: process.env.APP_CAPABILITY_ALLOWLIST,
     trackedFiles: trackedFiles(),
+    browserBundleFiles: browserBundleFiles(),
   });
   if (errors.length) {
     console.error(`Release safety check failed (${errors.length} issue${errors.length === 1 ? '' : 's'})`);