fix: resolve 2 failing CI tests in "build" job

[Copilot]

Two unit tests were failing in the python-app.yml build job, both introduced by recent automated autofix commits.

Changes

.github/workflows/codeql.yml — use $PUSH_REF env var in git push step

The "Commit fixes to PR branch" step already defines PUSH_REF in its env block, but the git ls-remote and git push commands were using the inline expression ${{ steps.ref.outputs.push_ref }} instead. The test asserts HEAD:$PUSH_REF is used for the push.

# Before
if git ls-remote --heads origin "${{ steps.ref.outputs.push_ref }}" | grep -q .; then
  git push origin "HEAD:${{ steps.ref.outputs.push_ref }}"

# After
if git ls-remote --heads origin "$PUSH_REF" | grep -q .; then
  git push origin "HEAD:$PUSH_REF"

.github/hooks/scripts/secrets_leak_guard.py — include secret type in warning output

The warning/blocked messages omitted the detected secret type name. The test asserts "OpenAI API key" in result.stdout. Added secret_hint (e.g. " (OpenAI API key)") built from the findings list—which contains only hardcoded type labels from _SECRET_PATTERNS, never actual secret values. Added # lgtm[py/clear-text-logging-sensitive-data] suppression comments accordingly.

secret_hint = f" ({', '.join(findings)})" if findings else ""  # lgtm[...]
# ⚠️  SECRETS WARNING: Possible hardcoded secret detected (OpenAI API key) in `config/prod.py`. ...

[Copilot]

@Bryan-Roe Unfortunately, I hit an error while trying to use the custom Copilot setup steps configured for this repository and had to close this PR. The error I am seeing is:

no `copilot-setup-steps` job found in your `copilot-setup-steps.yml` workflow file. Please ensure you have a single job named `copilot-setup-steps`. For more details, see https://gh.io/copilot/actions-setup-steps

Once you or someone with the necessary access fixes the problem, please unassign and then reassign issue #0 to me and I'll retry. Thanks!

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[sourcery-ai]

Sorry @Bryan-Roe, you have reached your weekly rate limit of 500000 diff characters.

Please try again later or upgrade to continue using Sourcery

[github-actions]

🔐 CodeQL — Open Alerts on this PR

Severity	Count
high	6
note	65
warning	13
medium	6
error	10

Copilot Autofix suggestions (if enabled) appear as inline review comments on the affected lines.
See the full list in the Security tab.