test(snapshot): compare the written header by string equality, never as a pattern built from the schema URL

The flow and library tests built a RegExp from SNAPSHOT_SCHEMA_URL (dots escaped by hand), which CodeQL reads as a hostname pattern that can match more hosts than intended. The header is now split into lines and the schema pin compared whole; a look-alike host with one dot replaced is pinned as rejected. The unwritable-path assertion drops its path-derived RegExp the same way.

Author: settings-as-code-release

test/flows/library.test.ts

@@ -155,16 +155,19 @@ describe("snapshotRepository and snapshotRepositories", () => {
         { key: "labels", status: "snapshot", detail: [] },
         { key: "actions_secrets", status: "snapshot", detail: [SECRET_NOTE] },
       ],
-      yaml: expect.stringMatching(
-        new RegExp(
-          `^# yaml-language-server: \\$schema=${SNAPSHOT_SCHEMA_URL.replaceAll(".", "\\.")}\n# Snapshot of o/r taken \\d{4}-\\d{2}-\\d{2}T[\\d:.]+Z\n# actions_secrets: ${SECRET_NOTE.replaceAll("[", "\\[").replaceAll("]", "\\]")}\nlabels:\n`,
-        ),
-      ),
-      log: [{ level: "notice", line: `actions_secrets: ${SECRET_NOTE}` }],
+      yaml: expect.any(String),
+      log: [{ level: "notice", line: SECRET_NOTE }],
     });
     if (report.yaml === undefined) {
       throw new Error("a snapshot result carries its file");
     }
+    // The header, line by line and by equality: the pin is a URL, never a pattern.
+    const [pin, dated, note, first] = report.yaml.split("\n");
+    expect(pin).toBe(`# yaml-language-server: $schema=${SNAPSHOT_SCHEMA_URL}`);
+    expect(dated).toMatch(
+      /^# Snapshot of o\/r taken \d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/,
+    );
+    expect([note, first]).toEqual([`# ${SECRET_NOTE}`, "labels:"]);
     expect(stringifyYaml(parseYamlDoc(report.yaml))).toBe(stringifyYaml(report.settings));
   });
 

test/flows/snapshot.test.ts

@@ -28,11 +28,22 @@ const labelsRoute = (slug: string, labels: Array<typeof BUG>) => ({
   [`GET /repos/${slug}/labels?per_page=100&page=1`]: { data: labels },
 });
 
-/** The header a written snapshot starts with: the schema pin, then the dated repository line. */
-const HEADER = (slug: string) =>
-  new RegExp(
-    `^# yaml-language-server: \\$schema=${SNAPSHOT_SCHEMA_URL.replaceAll(".", "\\.")}\\n# Snapshot of ${slug} taken \\d{4}-\\d{2}-\\d{2}T[\\d:.]+Z\\n`,
-  );
+/** An ISO-8601 UTC instant, the form the header dates the snapshot in. */
+const ISO_INSTANT = /^\d{4}-\d{2}-\d{2}T\d{2}:\d{2}:\d{2}(?:\.\d+)?Z$/;
+
+/**
+ * Whether `written` opens with the snapshot header for `slug`: the schema pin
+ * compared as a whole string (never as a pattern, so a look-alike host cannot
+ * pass), then the dated repository line.
+ */
+export function hasSnapshotHeader(written: string, slug: string): boolean {
+  const [pin, dated] = written.split("\n");
+  if (pin !== `# yaml-language-server: $schema=${SNAPSHOT_SCHEMA_URL}`) {
+    return false;
+  }
+  const prefix = `# Snapshot of ${slug} taken `;
+  return dated?.startsWith(prefix) === true && ISO_INSTANT.test(dated.slice(prefix.length));
+}
 
 let dir: string;
 beforeEach(() => {
@@ -80,14 +91,32 @@ const dirCfg = (overrides: Partial<DirConfig> = {}): DirConfig =>
     ...overrides,
   }) as DirConfig;
 
+describe("hasSnapshotHeader", () => {
+  const header = (url: string, slug = "o/r", instant = "2026-09-12T01:00:06.503Z") =>
+    `# yaml-language-server: $schema=${url}\n# Snapshot of ${slug} taken ${instant}\nlabels: []\n`;
+
+  test("accepts the exact pin and a dated line; rejects a look-alike host, another slug, and a non-instant", () => {
+    expect(hasSnapshotHeader(header(SNAPSHOT_SCHEMA_URL), "o/r")).toBe(true);
+    // The URL's dots are literal: a host with one dot swapped for another character is not the pin.
+    expect(
+      hasSnapshotHeader(
+        header(SNAPSHOT_SCHEMA_URL.replace("githubusercontent.com", "githubusercontentXcom")),
+        "o/r",
+      ),
+    ).toBe(false);
+    expect(hasSnapshotHeader(header(SNAPSHOT_SCHEMA_URL, "o/other"), "o/r")).toBe(false);
+    expect(hasSnapshotHeader(header(SNAPSHOT_SCHEMA_URL, "o/r", "yesterday"), "o/r")).toBe(false);
+  });
+});
+
 describe("runSnapshot, file form", () => {
   test("writes the document under its header and reports through the outputs, the log, and the summary", async () => {
     const api = new MockApi(labelsRoute("o/r", [BUG, DOCS]));
     const cfg = fileCfg();
     const collected = collectingIo();
     expect(await runSnapshot(api, cfg, collected.io)).toBe(0);
     const written = readFileSync(cfg.snapshotFile, "utf8");
-    expect(written).toMatch(HEADER("o/r"));
+    expect(hasSnapshotHeader(written, "o/r")).toBe(true);
     expect(parseYaml(written)).toEqual(doc(BUG, DOCS));
     expect(api.mutations()).toEqual([]);
     expect(collected.outputs).toEqual({ "skipped-sections": "", result: "snapshot" });
@@ -170,14 +199,14 @@ describe("runSnapshot, file form", () => {
     const collected = collectingIo();
     expect(await runSnapshot(api, cfg, collected.io)).toBe(1);
     expect(collected.outputs.result).toBe("failed");
-    expect(collected.lines[0]).toEqual({
-      level: "error",
-      line: expect.stringMatching(
-        new RegExp(
-          `^cannot write the snapshot to ${cfg.snapshotFile.replaceAll(".", "\\.")}: .*(EEXIST|ENOTDIR).*\\. Check that the "snapshot-file" input names a writable path$`,
-        ),
-      ),
-    });
+    const [first] = collected.lines;
+    expect(first?.level).toBe("error");
+    // The path is compared as text, never as a pattern; the OS error code sits between.
+    expect(first?.line.startsWith(`cannot write the snapshot to ${cfg.snapshotFile}: `)).toBe(true);
+    expect(first?.line).toMatch(/E(EXIST|NOTDIR)/);
+    expect(
+      first?.line.endsWith('. Check that the "snapshot-file" input names a writable path'),
+    ).toBe(true);
   });
 });
 
@@ -244,7 +273,7 @@ describe("runSnapshot, dir form", () => {
     expect(await runSnapshot(api, cfg, collected.io)).toBe(0);
     const fileA = join(cfg.snapshotDir, "o", "a.yml");
     const fileB = join(cfg.snapshotDir, "o", "b.yml");
-    expect(readFileSync(fileA, "utf8")).toMatch(HEADER("o/a"));
+    expect(hasSnapshotHeader(readFileSync(fileA, "utf8"), "o/a")).toBe(true);
     expect(parseYaml(readFileSync(fileA, "utf8"))).toEqual(doc(BUG));
     expect(parseYaml(readFileSync(fileB, "utf8"))).toEqual(doc(DOCS));
     expect(api.mutations()).toEqual([]);