fix: clear CodeQL weak sensitive hashing on model catalog cache key (#64)

[theCyberTech]

Summary

Fixes CodeQL alert #64: py/weak-sensitive-data-hashing in crewai_cli.model_catalog._cache_key.

After #6815 included lib/cli in CodeQL paths, scanning flagged:

digest = hashlib.sha256(api_key.encode("utf-8")).hexdigest()[:12]

CodeQL classifies api_key as password-like material, so plain SHA-256 is treated as insecure password hashing.

Fix

Use HMAC-SHA256 with the API key as the HMAC key and a fixed app string as the message:

digest = hmac.new(
    api_key.encode("utf-8"),
    b"crewai.model_catalog.cache_v1",
    hashlib.sha256,
).hexdigest()[:12]

This keeps a short, non-reversible local cache partition id (raw keys are still never stored) without password-style hashing of the credential.

Validation

• Local CodeQL python-code-scanning suite: 0 results (was 1× py/weak-sensitive-data-hashing)
• pytest lib/cli/tests/test_model_catalog.py: 39 passed

  

[Copilot]

Copilot was unable to review this pull request because the user who requested the review has reached their quota limit.

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: a3b0b7f1-1085-476e-a033-88265366bc8e

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}