Restrict tag for DomainHash to be alphanumeric

[vreff]

No description provided.

[github-actions]

👋 vreff, thanks for creating this pull request!

To help reviewers, please consider creating future PRs as drafts first. This allows you to self-review and make any final changes before notifying the team.

Once you're ready, you can mark it as "Ready for review" to request feedback. Thanks!

[github-actions]

⚠️ API Diff Results - github.com/smartcontractkit/chainlink-common

⚠️ Breaking Changes (1)

pkg/teeattestation (1)

• DomainHash — Type changed:

func(
  string, 
  []byte
)
- []byte
+ ([]byte, error)

---

📄 View full apidiff report

[Copilot]

Pull request overview

This PR tightens teeattestation.DomainHash by restricting the domain tag to non-empty ASCII alphanumeric characters and propagating validation failures to callers via an error return, updating dependent tests accordingly.

Changes:

• Updated DomainHash to return ([]byte, error) and reject non-alphanumeric/empty tags.
• Adjusted Nitro validation tests to use alphanumeric tags and handle the new error return.
• Updated DomainHash unit tests to handle the new signature and added an invalid-tag test.

Reviewed changes

Copilot reviewed 3 out of 3 changed files in this pull request and generated 2 comments.

File	Description
pkg/teeattestation/nitro/validate_test.go	Updates Nitro attestation validation tests to accommodate DomainHash’s new error return and tag restrictions.
pkg/teeattestation/hash.go	Adds tag validation to DomainHash and changes its signature to return an error on invalid tags.
pkg/teeattestation/hash_test.go	Updates tests for new DomainHash signature and introduces invalid-tag coverage.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 3 out of 3 changed files in this pull request and generated 1 comment.

Comments suppressed due to low confidence (1)

pkg/teeattestation/hash.go:21

• The tag validation rejects both non-ASCII characters and ASCII non-alphanumeric characters (e.g. '-'), but the docstring currently only mentions “non-ASCII alphanumeric characters”. Also, returning a fresh formatted error makes it harder for callers to reliably detect this validation failure. Consider updating the docstring to match the constraint and returning a sentinel error value (so callers can use errors.Is without string-matching).

// tag and data, so distinct (tag, data) pairs can never share a pre-image. [CL112-14]
// It returns an error if tag is empty or contains non-ASCII alphanumeric characters.
func DomainHash(tag string, data []byte) ([]byte, error) {
	if tag == "" || !isAlphanumeric(tag) {
		return nil, fmt.Errorf("invalid tag: must be non-empty and contain only alphanumeric characters")